gitea-mirror/trivy
1
0
Fork 0
mirror of https://github.com/aquasecurity/trivy.git synced 2025-12-12 15:50:15 -08:00
Code Issues Packages Projects Releases Wiki Activity
3,437 Commits 29 Branches 177 Tags
7d3b4ffdd6b22ae80215f3a04421606b1f78de6a
Commit Graph

353 Commits

Author SHA1 Message Date
Juan Ariza Toledano
1f0d6290c3 feat(vuln): include pkg identifier on detected vulnerabilities (#5439) 
Signed-off-by: juan131 <jariza@vmware.com>
Signed-off-by: knqyf263 <knqyf263@gmail.com>
Co-authored-by: DmitriyLewen <dmitriy.lewen@smartforce.io>
Co-authored-by: DmitriyLewen <91113035+DmitriyLewen@users.noreply.github.com>
Co-authored-by: Nikita Pivkin <nikita.pivkin@smartforce.io>
Co-authored-by: knqyf263 <knqyf263@gmail.com>
 2023-12-27 07:54:56 +00:00
DmitriyLewen
df49ea4a14 refactor(sbom): disable html escaping for CycloneDX (#5764) 2023-12-17 09:25:08 +00:00
DmitriyLewen
6cc00c2f0c fix(report): use OS information for OS packages purl in github template (#5783) 2023-12-13 09:37:14 +00:00
DmitriyLewen
c317fe828d fix(report): fix error if miconfigs are empty (#5782) 2023-12-13 09:34:37 +00:00
DmitriyLewen
9b4bcedf0e refactor(vuln): don't remove VendorSeverity in JSON report (#5761) 2023-12-12 12:33:41 +00:00
Dirk Klimpel
eb9741954c fix(report): update Gitlab template (#5721) 2023-12-07 11:13:43 +00:00
yuriShafet
16b757d180 feat: Packagesprops support (#5605) 
Co-authored-by: DmitriyLewen <dmitriy.lewen@smartforce.io>
 2023-11-28 01:23:47 +00:00
simar7
372efc9ec7 chore(deps): Bump up trivy misconf deps (#5656) 2023-11-28 00:47:23 +00:00
Teppei Fukuda
ae4bcf6a06 fix(report): use time.Time for CreatedAt (#5598) 
Signed-off-by: knqyf263 <knqyf263@gmail.com>
 2023-11-16 05:42:30 +00:00
Teppei Fukuda
ac0e327492 feat(flag): replace '--slow' with '--parallel' (#5572) 
Signed-off-by: knqyf263 <knqyf263@gmail.com>
 2023-11-15 06:41:13 +00:00
DmitriyLewen
5372067611 fix(report): add escaping for Sarif format (#5568) 2023-11-15 04:29:23 +00:00
Y.Horie
f4dd062f58 feat(report): Add CreatedAt to the JSON report. (#5542) (#5549) 
Signed-off-by: knqyf263 <knqyf263@gmail.com>
Co-authored-by: knqyf263 <knqyf263@gmail.com>
 2023-11-15 04:11:09 +00:00
Teppei Fukuda
a96ec35572 feat: add aliases to '--scanners' (#5558) 
Signed-off-by: knqyf263 <knqyf263@gmail.com>
 2023-11-15 00:53:22 +00:00
DmitriyLewen
cb241a8007 fix(sbom): add FilesAnalyzed and PackageVerificationCode fields for SPDX (#5533) 2023-11-09 09:25:27 +00:00
chenk
05df24477e fix: fail k8s resource scanning (#5529) 
Signed-off-by: chenk <hen.keinan@gmail.com>
 2023-11-08 05:39:53 +00:00
DmitriyLewen
a1b47441a5 refactor(misconf): don't remove Highlighted in json format (#5531) 2023-11-07 23:40:42 +00:00
dependabot[bot]
d0d956fdc1 chore(deps): bump github.com/owenrumney/go-sarif/v2 from 2.2.2 to 2.3.0 (#5493) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: DmitriyLewen <dmitriy.lewen@smartforce.io>
 2023-11-03 01:38:04 +00:00
dependabot[bot]
474167c47e chore(deps): bump github.com/testcontainers/testcontainers-go/modules/localstack from 0.21.0 to 0.26.0 (#5475) 
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: DmitriyLewen <dmitriy.lewen@smartforce.io>
 2023-11-03 01:36:27 +00:00
Nikita Pivkin
520830b51b fix(server): add licenses to BlobInfo message (#5382) 2023-11-02 01:46:32 +00:00
DmitriyLewen
6040d9f43a fix(sbom): add missed primaryURL and source severity for CycloneDX (#5399) 
Signed-off-by: knqyf263 <knqyf263@gmail.com>
Co-authored-by: knqyf263 <knqyf263@gmail.com>
 2023-10-19 05:37:32 +00:00
Sylvain Baubeau
9fba79f0b6 chore(deps): move to aws-sdk-go-v2 (#5381) 2023-10-18 14:21:56 +00:00
AliDatadog
5b2b4ea380 feat(report): Add InstalledFiles field to Package (#4706) 
Co-authored-by: Sylvain Baubeau <lebauce@gmail.com>
Co-authored-by: knqyf263 <knqyf263@gmail.com>
 2023-10-16 06:15:23 +00:00
Teppei Fukuda
cbbd1ce1f0 feat(k8s): add support for vulnerability detection (#5268) 
Signed-off-by: knqyf263 <knqyf263@gmail.com>
Signed-off-by: chenk <hen.keinan@gmail.com>
Co-authored-by: DmitriyLewen <dmitriy.lewen@smartforce.io>
Co-authored-by: chenk <hen.keinan@gmail.com>
 2023-10-14 12:32:55 +00:00
Nikita Pivkin
9ebc25d88b test: validate SPDX with the JSON schema (#5124) 
* test: validate SPDX with the JSON schema

* use the SPDX schema version based on the document version

* additionally validate the document using spdx
 2023-09-14 06:10:09 +00:00
Juan Ariza Toledano
7acc5e8312 feat(docker): add support for scanning Bitnami components (#5062) 
* feat(bitnami): add support for scanning Bitnami components

Signed-off-by: juan131 <jariza@vmware.com>

* chore(deps): bump packageurl-go

TypeBitnami is not included in v0.1.1

* feat(spdx): handle orphan packages

* fix: update Elastic SPDX

Signed-off-by: juan131 <jariza@vmware.com>

* Update pkg/fanal/analyzer/sbom/sbom.go

Co-authored-by: DmitriyLewen <91113035+DmitriyLewen@users.noreply.github.com>

* fix: remove useless else

Signed-off-by: juan131 <jariza@vmware.com>

* call AnalysisResult.Sort()

Signed-off-by: knqyf263 <knqyf263@gmail.com>

* delete app packages

Signed-off-by: knqyf263 <knqyf263@gmail.com>

* fix: set the component path to packages

Signed-off-by: knqyf263 <knqyf263@gmail.com>

* docs: add a comment about continue

Signed-off-by: knqyf263 <knqyf263@gmail.com>

* chore: bump trivy-db

Signed-off-by: knqyf263 <knqyf263@gmail.com>

* docs: add Bitnami

Signed-off-by: knqyf263 <knqyf263@gmail.com>

---------

Signed-off-by: juan131 <jariza@vmware.com>
Signed-off-by: knqyf263 <knqyf263@gmail.com>
Co-authored-by: knqyf263 <knqyf263@gmail.com>
Co-authored-by: DmitriyLewen <91113035+DmitriyLewen@users.noreply.github.com>
 2023-08-31 20:18:05 +00:00
DmitriyLewen
c04f234fa4 fix(sbom): cyclonedx advisory should omit null value (#5041) 
* return nil for advisories, if len of refs == 0
add marshal test

* add integration test for cyclonedx with vulns

* use existing testcase

* test(pom): add ID for cyclondedx integration golden file

* test(integration): add sorting cyclonedx vulns
 2023-08-31 10:16:34 +00:00
chenk
69ea5bf70e feat: improve kbom component name (#5058) 
* feat: improve component name - merge

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: improve component name

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: improve component name

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: improve component name

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: improve component name

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: improve component name

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: improve component name

Signed-off-by: chenk <hen.keinan@gmail.com>

---------

Signed-off-by: chenk <hen.keinan@gmail.com>
 2023-08-31 07:35:47 +00:00
simar7
07f7e9853b chore(deps): Update defsec to v0.92.0 (#5068) 
* chore(deps): Update defsec to v0.92.0

* update tests

* update integration tests
 2023-08-30 20:43:08 +00:00
DmitriyLewen
4401998ec1 feat(java): add graph support for pom.xml (#4902) 
* add graph support

* update docs

* bump go-dep-parser

* remove replace for go-dep-parser

* update docs
 2023-08-30 06:56:41 +00:00
DmitriyLewen
9c211d005d feat(swift): add vulns for cocoapods (#5037) 
* add vulns for cocoapods, fix purl

* update docs

* remove go-dep-parser replace

* update purl and test

* bump github.com/DmitriyLewen/trivy-db

* remove replace for trivy-db

* remove added sbom tests

* add test for Package() func

* add wrong epoch test

* refactor docs

* add comment to join the module and submodule in purl

* docs: add an example

---------

Co-authored-by: knqyf263 <knqyf263@gmail.com>
 2023-08-29 12:46:49 +00:00
DmitriyLewen
ef70d20766 feat: add Package.resolved swift files support (#4932) 
* add Package.resolved files analyzer

* add Swift detector and integration test

* refactor after go-dep-parser changes

* bump go-dep-parser

* remove replaces

* use filePath for Required func

* add ID field
 2023-08-23 11:23:50 +00:00
Nikita Pivkin
ec5d8bec0d feat(nodejs): parse licenses in yarn projects (#4652) 
* feat(nodejs): parse licenses in yarn projects

* close the zip file

* use fsutils.WalkDir

* refactor: extract traverseFunc

* update tests

* update required

* improve required fn

* handle error

* fix required

* fix required

* fix required

* update test

* fix after review

* simplify test data

* fix path

* rename fn

* update docs

* update docs

* simplify required fn

* skip an empty license

* improve required

* improve required

* update golden

* classify license file

* fix path

* fix path

* improve license parsing from cache

* classify the license file from zip

* refactor

* refactor

* fix lint

* fix after review

* fix test

* mv files

* mv files

* fix dbg message

* refactor: use zip.Reader as fs.FS

* refactor: pass io.Reader

* refactor: use fs.Sub

* refactor: add a struct for license traversing

* refactor: use lo.Some

* feat: bump the yarn analyzer version

* go mod tidy

* fix: sort imports

* use multierror

---------

Co-authored-by: knqyf263 <knqyf263@gmail.com>
 2023-08-23 06:35:54 +00:00
Nikita Pivkin
d442176405 feat(server): add version endpoint (#4869) 
* feat(server): add version endpoint

* fix panic and test

* move version.go

* move version variable

* add docs about endpoints

* move testdata

* refactor

* update build command

* refactor
 2023-08-20 06:12:31 +00:00
DmitriyLewen
6f03c79405 feat(c): add location for lock file dependencies. (#4994) 
* add location for conan lock files

* bump go-dep-parser

* go mod tidy
 2023-08-16 11:34:03 +00:00
Teppei Fukuda
d3a34e409c test: validate CycloneDX with the JSON schema (#4956) 
* test: validate CycloneDX with the JSON schema

* fix(sbom): move licenses to `name` field in Cyclonedx format (#4941)

* use license.Name instead of Expression

* update tests

* test: add uuid package

* test: compare UUID

---------

Co-authored-by: DmitriyLewen <91113035+DmitriyLewen@users.noreply.github.com>
 2023-08-08 12:51:10 +00:00
Nikita Pivkin
e8cf281471 fix(aws): resolve endpoint if endpoint is passed (#4925) 
* fix(aws): resolve endpoint to get identity if endpoint is passed

* resolve endpoint for ami and ebs

* return an error if aws region is missing
 2023-08-08 07:19:40 +00:00
DmitriyLewen
f18b0db583 fix(sbom): move licenses to name field in Cyclonedx format (#4941) 
* use license.Name instead of Expression

* update tests
 2023-08-06 12:50:35 +00:00
Nikita Pivkin
39ccbf7b58 test(aws): move part of unit tests to integration (#4884) 
* test(aws): move part of unit tests to integration

* fix typo

* fix test

---------

Co-authored-by: knqyf263 <knqyf263@gmail.com>
 2023-08-02 15:48:52 +00:00
Teppei Fukuda
d19c7d9f29 feat(repo): support local repositories (#4890) 
* feat(repo): support local repositories

* fix tests

* test: fix client/server tests

* docs: update

* test: add fs tests

* test: do not update golden files if overridden

* docs: remove a comment about fs deprecation
 2023-07-31 11:27:36 +00:00
simar7
7271d682fb chore(deps): Update defsec to v0.91.0 (#4886) 
* chore(deps): Update defsec to v0.91.0

* update tests

Signed-off-by: Simar <simar@linux.com>

---------

Signed-off-by: Simar <simar@linux.com>
 2023-07-30 07:31:34 +00:00
Teppei Fukuda
232ba823e1 feat(vuln): support vulnerability status (#4867) 
* feat: support vulnerability status

* feat: show status in table

* don't add `fixed` status in debian/redhat

* update test golden files

* add Status in rpc

* update docs

* update ignore-status example

* add ignore-status in integration test

* docs: add the explanation for statuses

---------

Co-authored-by: DmitriyLewen <dmitriy.lewen@smartforce.io>
 2023-07-26 11:55:03 +00:00
DmitriyLewen
ce77bb46c3 remove govulndb (#4783) 2023-07-19 07:24:35 +00:00
DmitriyLewen
a9badeaba8 fix(rocky): add architectures support for advisories (#4691) 
* add multi-arch support for rocky linux advisories

* feat: comply with the new signagure

* bump trivy-db

* fix tests

* chore(deps): remove fork replace

---------

Co-authored-by: knqyf263 <knqyf263@gmail.com>
 2023-07-03 08:48:57 +00:00
DmitriyLewen
22463ababd feat(cli): add include-dev-deps flag (#4700) 
* add Dev field for Package

* fix integration test

* update docs

* feat(cli): add include-dev flag

* bump go-dep-parser

* update docs

* add integration test

* refactor

* refactor

* fix integration test

* refactor: rename flag to include-dev-deps

* update docs

* update docs

* filter dev deps when scanning packages

* add flag support for server mode

* refactor: remove comment that might confuse

* refactor: move --include-dev-deps to the scanner flag group

* refactor: not return apps

* docs: update

---------

Co-authored-by: knqyf263 <knqyf263@gmail.com>
 2023-06-29 13:15:52 +00:00
chenk
85c681d443 feat: kbom and cyclonedx v1.5 spec support (#4708) 
* feat: kbom and cyclonedx v1.5 spec support

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: kbom and cyclonedx v1.5 spec support

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: kbom and cyclonedx v1.5 spec support

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: feat: kbom and cyclonedx 1.5 spec support

Signed-off-by: chenk <hen.keinan@gmail.com>

* fix: unmarshal bom on v1.5 return invalid specification version

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: cyclonedx-1.5 spec support

Signed-off-by: chenk <hen.keinan@gmail.com>

---------

Signed-off-by: chenk <hen.keinan@gmail.com>
 2023-06-25 13:47:06 +00:00
chenk
35c4262d0b feat(k8s): cyclonedx kbom support (#4557) 
* feat: cyclonedx kbom support

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: cyclonedx kbom support

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: kubernetes bill of materials

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: kubernetes bill of materials

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: kubernetes bill of materials

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: kubernetes bill of materials

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: kubernetes bill of materials

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: kubernetes bill of materials

Signed-off-by: chenk <hen.keinan@gmail.com>

* chore: update sum db

Signed-off-by: chenk <hen.keinan@gmail.com>

* chore: update sum db

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: kubernetes bill of materials

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: kubernetes bill of materials

Signed-off-by: chenk <hen.keinan@gmail.com>

* chore: update sumdb

Signed-off-by: chenk <hen.keinan@gmail.com>

* chore: update sumdb

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: kubernetes bill of materials

Signed-off-by: chenk <hen.keinan@gmail.com>

* feat: kubernetes bill of materials

Signed-off-by: chenk <hen.keinan@gmail.com>

---------

Signed-off-by: chenk <hen.keinan@gmail.com>
 2023-06-19 10:48:26 +00:00
Masahiro331
4d9b444499 fix(vm): update ext4-filesystem parser for parse multi block extents (#4616) 
* chore(deps): update ext4-filesystem parser for parse multi block extents

* test(vm): update integration-vm test fixtures

* test(vm): add gzip decompresser for sparse file

* test(vm): add mage command update golden file for vm integration test

* chore(magefile): [WIP] change test repository

* Revert "chore(magefile): [WIP] change test repository"

This reverts commit c015c8892f.

* fix(test): update fixtures and golden file

* fix(test): revert fixVersion and PkgID
 2023-06-18 16:41:55 +00:00
Teppei Fukuda
9ef01133c8 feat: add SBOM analyzer (#4210) 
Co-authored-by: DmitriyLewen <91113035+DmitriyLewen@users.noreply.github.com>
Co-authored-by: DmitriyLewen <dmitriy.lewen@smartforce.io>
 2023-06-02 09:34:07 +03:00
DmitriyLewen
dadd1e10c2 fix(sbom): update logic for work with files in spdx format (#4513) 
Co-authored-by: Teppei Fukuda <knqyf263@gmail.com>
 2023-06-01 12:52:56 +03:00
DmitriyLewen
411862c908 feat(ubuntu): add eol date for 18.04 ESM (#4524) 2023-06-01 09:48:33 +03:00