mirror of
https://github.com/aquasecurity/trivy.git
synced 2025-12-12 15:50:15 -08:00
18b80e3781
* refactor(docker_conf): rename and remove unnecessary options * feat(rpc): define new API * fix(cli): change default timeout * fix(import): fix package names * refactor(vulnerability): remove old mock * refactor(utils): remove un-needed functions * feat(cache): implement cache communicating with a server * refactor(scan): separate scan function as local scanner * test(scanner): add tests for ScanImage * refactor(scan): remove unused options * test(vulnerability): generate mock * refactor(server): split a file * feat(server): implement new RPC server * feat(client): implement new RPC client * fix(cache): use new cache interface * fix(standalone): use new scanner * fix(client): use new scanner * fix(server): pass cache * test(integration): make sure an error is not nil before calling the method * fix(mod): update dependencies * test(integration): ensure the image load finishes * feat(docker): support DOCKER_HOST and DOCKER_CERT_PATH * chore(mod): update dependencies * refactor(rpc): remove old client * feat(server): support old API for backward compatibility * fix(server): check a schema version of JSON cache * fix(rpc): add a version to packages * feat(rpc): add PutImage * test: rename expectations * refactor(cache): rename LayerCache to ImageCache * refactor: rename ImageInfo to ImageReference * fix(applier): pass image_id to ApplyLayer * feat(cache): handle image cache * chore(mod): update dependencies * refactor(server): pass only config * feat(cli): add -removed-pkgs option * refactor(err): wrap errors
105 lines
2.9 KiB
Go
105 lines
2.9 KiB
Go
package scanner
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/google/wire"
|
|
digest "github.com/opencontainers/go-digest"
|
|
"golang.org/x/xerrors"
|
|
|
|
"github.com/aquasecurity/fanal/analyzer"
|
|
"github.com/aquasecurity/fanal/extractor"
|
|
"github.com/aquasecurity/fanal/extractor/docker"
|
|
ftypes "github.com/aquasecurity/fanal/types"
|
|
"github.com/aquasecurity/trivy/pkg/log"
|
|
"github.com/aquasecurity/trivy/pkg/report"
|
|
"github.com/aquasecurity/trivy/pkg/rpc/client"
|
|
"github.com/aquasecurity/trivy/pkg/scanner/local"
|
|
"github.com/aquasecurity/trivy/pkg/types"
|
|
)
|
|
|
|
// StandaloneSuperSet is used in the standalone mode
|
|
var StandaloneSuperSet = wire.NewSet(
|
|
analyzer.New,
|
|
wire.Bind(new(Analyzer), new(analyzer.Config)),
|
|
local.SuperSet,
|
|
wire.Bind(new(Driver), new(local.Scanner)),
|
|
NewScanner,
|
|
)
|
|
|
|
var StandaloneDockerSet = wire.NewSet(
|
|
types.GetDockerOption,
|
|
docker.NewDockerExtractor,
|
|
wire.Bind(new(extractor.Extractor), new(docker.Extractor)),
|
|
StandaloneSuperSet,
|
|
)
|
|
|
|
var StandaloneArchiveSet = wire.NewSet(
|
|
types.GetDockerOption,
|
|
docker.NewDockerArchiveExtractor,
|
|
wire.Bind(new(extractor.Extractor), new(docker.Extractor)),
|
|
StandaloneSuperSet,
|
|
)
|
|
|
|
// RemoteSuperSet is used in the client mode
|
|
var RemoteSuperSet = wire.NewSet(
|
|
analyzer.New,
|
|
wire.Bind(new(Analyzer), new(analyzer.Config)),
|
|
client.SuperSet,
|
|
wire.Bind(new(Driver), new(client.Scanner)),
|
|
NewScanner,
|
|
)
|
|
|
|
var RemoteDockerSet = wire.NewSet(
|
|
types.GetDockerOption,
|
|
docker.NewDockerExtractor,
|
|
wire.Bind(new(extractor.Extractor), new(docker.Extractor)),
|
|
RemoteSuperSet,
|
|
)
|
|
|
|
var RemoteArchiveSet = wire.NewSet(
|
|
types.GetDockerOption,
|
|
docker.NewDockerArchiveExtractor,
|
|
wire.Bind(new(extractor.Extractor), new(docker.Extractor)),
|
|
RemoteSuperSet,
|
|
)
|
|
|
|
type Scanner struct {
|
|
driver Driver
|
|
analyzer Analyzer
|
|
}
|
|
|
|
type Driver interface {
|
|
Scan(target string, imageID digest.Digest, layerIDs []string, options types.ScanOptions) (results report.Results, osFound *ftypes.OS, eols bool, err error)
|
|
}
|
|
|
|
type Analyzer interface {
|
|
Analyze(ctx context.Context) (info ftypes.ImageReference, err error)
|
|
}
|
|
|
|
func NewScanner(driver Driver, ac Analyzer) Scanner {
|
|
return Scanner{driver: driver, analyzer: ac}
|
|
}
|
|
|
|
func (s Scanner) ScanImage(options types.ScanOptions) (report.Results, error) {
|
|
ctx := context.Background()
|
|
imageInfo, err := s.analyzer.Analyze(ctx)
|
|
if err != nil {
|
|
return nil, xerrors.Errorf("failed analysis: %w", err)
|
|
}
|
|
|
|
log.Logger.Debugf("Image ID: %s", imageInfo.ID)
|
|
log.Logger.Debugf("Layer IDs: %v", imageInfo.LayerIDs)
|
|
|
|
results, osFound, eosl, err := s.driver.Scan(imageInfo.Name, imageInfo.ID, imageInfo.LayerIDs, options)
|
|
if err != nil {
|
|
return nil, xerrors.Errorf("scan failed: %w", err)
|
|
}
|
|
if eosl {
|
|
log.Logger.Warnf("This OS version is no longer supported by the distribution: %s %s", osFound.Family, osFound.Name)
|
|
log.Logger.Warnf("The vulnerability detection may be insufficient because security updates are not provided")
|
|
}
|
|
|
|
return results, nil
|
|
}
|