From dc07329aa19eafa1dbca655efef619667f02d2b5 Mon Sep 17 00:00:00 2001 From: Damian Ellwart Date: Thu, 29 Feb 2024 13:29:53 +0100 Subject: [PATCH] docs(license): review fixes --- docs/docs/configuration/filtering.md | 4 ++-- pkg/scanner/local/scan.go | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/docs/configuration/filtering.md b/docs/docs/configuration/filtering.md index e1fa08e9228c..75e880af4f49 100644 --- a/docs/docs/configuration/filtering.md +++ b/docs/docs/configuration/filtering.md @@ -338,7 +338,7 @@ Available fields: | Field | Required | Type | Description | |------------|:--------:|---------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | id | ✓ | string | The identifier of the vulnerability, misconfiguration, secret, or license[^1]. | -| paths | | string array | The list of file paths to ignore. If `paths` is not set, the ignore finding is applied to all files. | +| paths[^2] | | string array | The list of file paths to ignore. If `paths` is not set, the ignore finding is applied to all files. | | purls | | string array | The list of PURLs to ignore packages. If `purls` is not set, the ignore finding is applied to all packages. This field is currently available only for vulnerabilities. | | expired_at | | date (`yyyy-mm-dd`) | The expiration date of the ignore finding. If `expired_at` is not set, the ignore finding is always valid. | | statement | | string | The reason for ignoring the finding. (This field is not used for filtering.) | @@ -494,4 +494,4 @@ Please refer to the [VEX documentation](../supply-chain/vex.md) for the details. [^1]: license name is used as id for `.trivyignore.yaml` files. -[^2]: This doesn't work for os package licenses (e.g. apk, dpkg, rpm). \ No newline at end of file +[^2]: This doesn't work for os package licenses (e.g. apk, dpkg, rpm). For projects which manage dependencies through a dependency file (e.g. go.mod, yarn.lock) `path` should point to that particular file. diff --git a/pkg/scanner/local/scan.go b/pkg/scanner/local/scan.go index 52b575b64b6d..43e90a3e0bba 100644 --- a/pkg/scanner/local/scan.go +++ b/pkg/scanner/local/scan.go @@ -312,10 +312,10 @@ func (s Scanner) scanLicenses(target types.ScanTarget, options types.ScanOptions for _, license := range lib.Licenses { category, severity := scanner.Scan(license) langLicenses = append(langLicenses, types.DetectedLicense{ - Severity: severity, - Category: category, - PkgName: lib.Name, - Name: license, + Severity: severity, + Category: category, + PkgName: lib.Name, + Name: license, // Lock files use app.FilePath - https://github.com/aquasecurity/trivy/blob/6ccc0a554b07b05fd049f882a1825a0e1e0aabe1/pkg/fanal/types/artifact.go#L245-L246 // Applications use lib.FilePath - https://github.com/aquasecurity/trivy/blob/6ccc0a554b07b05fd049f882a1825a0e1e0aabe1/pkg/fanal/types/artifact.go#L93-L94 FilePath: lo.Ternary(lib.FilePath != "", lib.FilePath, app.FilePath),