feat(vuln): add `--pkg-relationships` #7237

knqyf263 · 2024-07-26T07:23:24Z

Description

Add --pkg-relationships to filter vulnerabilities by relationships. It cannot be used with --dependency-tree, --vex or --format spdx|spdx-json|cyclonedx|github.

Usage

Withot `--pkg-relationships`

$ trivy repo ./go.mod
...

go.mod (gomod)
==============
Total: 1 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

┌────────────────────────┬─────────────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────────┐
│        Library         │    Vulnerability    │ Severity │ Status │ Installed Version │ Fixed Version │                           Title                           │
├────────────────────────┼─────────────────────┼──────────┼────────┼───────────────────┼───────────────┼───────────────────────────────────────────────────────────┤
│ google.golang.org/grpc │ GHSA-xr7q-jx4m-x55m │ LOW      │ fixed  │ 1.64.0            │ 1.64.1        │ Private tokens could appear in logs if context containing │
│                        │                     │          │        │                   │               │ gRPC metadata is...                                       │
│                        │                     │          │        │                   │               │ https://github.com/advisories/GHSA-xr7q-jx4m-x55m         │
└────────────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────────────┘

With `--pkg-relationships`

$ trivy repo --scanners vuln --pkg-relationships direct ./go.mod
2024-07-26T11:19:11+04:00       INFO    [vuln] Vulnerability scanning is enabled
2024-07-26T11:19:13+04:00       INFO    Number of language-specific files       num=1
2024-07-26T11:19:13+04:00       INFO    [gomod] Detecting vulnerabilities...

With `--pkg-relationships` and `--format spdx`

$ trivy repo --pkg-relationships direct --format spdx ./go.mod
2024-07-26T11:20:33+04:00       INFO    "--format spdx" and "--format spdx-json" disable security scanning
2024-07-26T11:20:33+04:00       FATAL   Fatal error     flag error: align options error: '--pkg-relationships' cannot be used with '--dependency-tree', '--vex' or SBOM formats

Related issues

Close feat(vuln): add --relationship flag to filter vulnerabilities by package relationship #6889

Checklist

I've read the guidelines for contributing to this repository.
I've followed the conventions in the PR title.
I've added tests that prove my fix is effective or that my feature works.
I've updated the documentation with the relevant information (if needed).
I've added usage information (if the PR introduces new options)
I've included a "before" and "after" example to the description (if the PR is a user interface change).

Signed-off-by: knqyf263 <knqyf263@gmail.com>

DmitriyLewen

LGTM

Left a couple of comments.

DmitriyLewen · 2024-07-29T04:35:22Z

docs/docs/scanner/vulnerability.md

+By default, all relationships are included in the scan.
+
+!!! info
+    This flag filters the packages themselves, so it also affects the `--list-all-pkgs` option and SBOM generation.


Let's add warning that this flag can't be used with --dependency-tree, --vex or --format spdx|spdx-json|cyclonedx|github.

I deleted the warning in aaea1ea as it now returns an error. Do you want to document it?

Yes, I think it won't be superfluous

Done
f0e1104

DmitriyLewen · 2024-07-29T04:46:23Z

pkg/commands/app.go

I assume that users will want to use new flag in convert mode.
e.g. scan image once, but show 2 tables - with direct and indirect dependencies.

But for this change we need to change location of new logic.
So I suggest waiting for user requests.

Actually, I was also thinking about it. --include-dev-deps and --pkg-types cannot be used in convert now. Detecting vulnerabilities is not expensive. We might want to move it in the filtering process.

--include-dev-deps and --pkg-types cannot be used in convert now.

Users can't use --pkg-types (--vuln-type) in v0.53.0 (or earlier) in convert mode:

➜ trivy -d convert --vuln-type os ... 2024-07-29T11:42:11+06:00 FATAL Fatal error unknown flag: --vuln-type

But I haven't seen any requests to add this flag for convert mode.

We might want to wait for user feedback on --pkg-relationships.

Signed-off-by: knqyf263 <knqyf263@gmail.com>

DmitriyLewen

LGTM

Package relationship has been introduced on aquasecurity/trivy#7237 and using CLI there are default relationship values (all). Using the library directly there is no default value and having 0 relationships and retrieving 0 finginds. Therefore on this commit we added the default value with all relationships

* Bump trivy to v0.54.1 and fix breaking changes * Add default cli values of --pkg-relationships Package relationship has been introduced on aquasecurity/trivy#7237 and using CLI there are default relationship values (all). Using the library directly there is no default value and having 0 relationships and retrieving 0 finginds. Therefore on this commit we added the default value with all relationships

- Fix --vuln-type flag renamed into --pkg-types aquasecurity/trivy#7104; \n- Adopt package relationships aquasecurity/trivy#7237

* Bump trivy to v0.49.1 * Bump trivy to v0.51.4 - Fix registry version aquasecurity/trivy#6219; - Fix replace zap with slog aquasecurity/trivy#6466; - The fix with slog used a zap to slog bridge (official from zap, but exp). It didn't have a license file, so I hardcoded a commit version that had; - Adopt opts.Align() to validate options object; * Bump trivy to v0.52.2 * Temp change the workflow trigger to test changes * Free up space on runner * Bump trivy to v0.53.0 - Fix go clear cache aquasecurity/trivy#7010 * Bump trivy to v0.54.1 - Fix --vuln-type flag renamed into --pkg-types aquasecurity/trivy#7104; - Adopt package relationships aquasecurity/trivy#7237 * Rollback CI run on target * Clean 'scan cache clean' code and add timeout to it

It's only necessary to specifiy these types when running the scanners directly, as we do. When running Trivy via the command line it's not necessary. See aquasecurity/trivy#7237

…#83) * chore(deps): bump github.com/aquasecurity/trivy from 0.53.0 to 0.54.1 Bumps [github.com/aquasecurity/trivy](https://github.com/aquasecurity/trivy) from 0.53.0 to 0.54.1. - [Release notes](https://github.com/aquasecurity/trivy/releases) - [Changelog](https://github.com/aquasecurity/trivy/blob/v0.54.1/CHANGELOG.md) - [Commits](aquasecurity/trivy@v0.53.0...v0.54.1) --- updated-dependencies: - dependency-name: github.com/aquasecurity/trivy dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * fix: Use new flag for vulnerability type See aquasecurity/trivy#7104 * bump: Trivy version for vulnerability DB updates * fix: Specify types of dependencies to analyze It's only necessary to specifiy these types when running the scanners directly, as we do. When running Trivy via the command line it's not necessary. See aquasecurity/trivy#7237 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: André Meira <andre.meira@codacy.com>

knqyf263 added 5 commits July 23, 2024 12:28

feat: add package flag group and '--pkg-relationships'

c6b6491

Signed-off-by: knqyf263 <knqyf263@gmail.com>

test: add tests for package flag group

0122e18

Signed-off-by: knqyf263 <knqyf263@gmail.com>

test: add relationship tests

829dcc4

Signed-off-by: knqyf263 <knqyf263@gmail.com>

docs: add --pkg-relationships

4839d3d

Signed-off-by: knqyf263 <knqyf263@gmail.com>

feat: return error for option combination, leading to incomplete results

aaea1ea

Signed-off-by: knqyf263 <knqyf263@gmail.com>

knqyf263 self-assigned this Jul 26, 2024

knqyf263 added 6 commits July 26, 2024 11:26

refactor: combine into a single line

43781f0

Signed-off-by: knqyf263 <knqyf263@gmail.com>

Merge branch 'main' into add_relationship

5149028

merge main

d6974a3

Signed-off-by: knqyf263 <knqyf263@gmail.com>

docs: auto-generate

53f0db0

Signed-off-by: knqyf263 <knqyf263@gmail.com>

feat(server): support package relationships

e0143d2

Signed-off-by: knqyf263 <knqyf263@gmail.com>

fix: respect --include-dev-deps

1377896

Signed-off-by: knqyf263 <knqyf263@gmail.com>

knqyf263 marked this pull request as ready for review July 26, 2024 12:23

knqyf263 requested a review from DmitriyLewen as a code owner July 26, 2024 12:23

DmitriyLewen reviewed Jul 29, 2024

View reviewed changes

docs: add warning

f0e1104

Signed-off-by: knqyf263 <knqyf263@gmail.com>

DmitriyLewen approved these changes Jul 29, 2024

View reviewed changes

knqyf263 added this pull request to the merge queue Jul 29, 2024

Merged via the queue into aquasecurity:main with commit 5c37361 Jul 29, 2024
17 checks passed

knqyf263 deleted the add_relationship branch July 29, 2024 06:40

aqua-bot mentioned this pull request Jul 29, 2024

release: v0.54.0 [main] #7075

Merged

romulets mentioned this pull request Aug 9, 2024

Bump trivy to v0.54.1 and fix breaking changes elastic/cloudbeat#2399

Merged

romulets added a commit to elastic/cloudbeat that referenced this pull request Aug 13, 2024

Bump trivy to v0.54.1

54d01fa

- Fix --vuln-type flag renamed into --pkg-types aquasecurity/trivy#7104; \n- Adopt package relationships aquasecurity/trivy#7237

romulets added a commit to romulets/cloudbeat that referenced this pull request Aug 13, 2024

Bump trivy to v0.54.1

76bb972

- Fix --vuln-type flag renamed into --pkg-types aquasecurity/trivy#7104; \n- Adopt package relationships aquasecurity/trivy#7237

romulets mentioned this pull request Aug 13, 2024

Bump Trivy to v0.54.1 elastic/cloudbeat#2427

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(vuln): add `--pkg-relationships` #7237

feat(vuln): add `--pkg-relationships` #7237

knqyf263 commented Jul 26, 2024

DmitriyLewen left a comment

DmitriyLewen Jul 29, 2024

knqyf263 Jul 29, 2024

DmitriyLewen Jul 29, 2024

knqyf263 Jul 29, 2024

DmitriyLewen Jul 29, 2024

knqyf263 Jul 29, 2024

DmitriyLewen Jul 29, 2024 •

edited

Loading

knqyf263 Jul 29, 2024

DmitriyLewen left a comment

feat(vuln): add --pkg-relationships #7237

feat(vuln): add --pkg-relationships #7237

Conversation

knqyf263 commented Jul 26, 2024

Description

Usage

Withot --pkg-relationships

With --pkg-relationships

With --pkg-relationships and --format spdx

Related issues

Checklist

DmitriyLewen left a comment

Choose a reason for hiding this comment

DmitriyLewen Jul 29, 2024

Choose a reason for hiding this comment

knqyf263 Jul 29, 2024

Choose a reason for hiding this comment

DmitriyLewen Jul 29, 2024

Choose a reason for hiding this comment

knqyf263 Jul 29, 2024

Choose a reason for hiding this comment

DmitriyLewen Jul 29, 2024

Choose a reason for hiding this comment

knqyf263 Jul 29, 2024

Choose a reason for hiding this comment

DmitriyLewen Jul 29, 2024 • edited Loading

Choose a reason for hiding this comment

knqyf263 Jul 29, 2024

Choose a reason for hiding this comment

DmitriyLewen left a comment

Choose a reason for hiding this comment

feat(vuln): add `--pkg-relationships` #7237

feat(vuln): add `--pkg-relationships` #7237

Withot `--pkg-relationships`

With `--pkg-relationships`

With `--pkg-relationships` and `--format spdx`

DmitriyLewen Jul 29, 2024 •

edited

Loading