Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: add HTTP support for downloading DBs #7892

Draft
wants to merge 9 commits into
base: main
Choose a base branch
from
Draft

feat: add HTTP support for downloading DBs #7892

wants to merge 9 commits into from

Conversation

knqyf263
Copy link
Collaborator

@knqyf263 knqyf263 commented Nov 8, 2024 •
edited by DmitriyLewen
Loading

Description

Add HTTP support in addition to OCI.

$ trivy image --scanners vuln --db-repository https://github.com/knqyf263/trivy-db/releases/download/v2/db.tar.gz alpine:3.20
2024-11-08T15:13:30+04:00       INFO    [vulndb] Need to update DB
2024-11-08T15:13:30+04:00       INFO    [vulndb] Downloading vulnerability DB...
2024-11-08T15:13:30+04:00       INFO    [vulndb] Downloading artifact...        location="https://github.com/knqyf263/trivy-db/releases/download/v2/db.tar.gz"
2024-11-08T15:13:34+04:00       INFO    [vulndb] OCI successfully downloaded    location="https://github.com/knqyf263/trivy-db/releases/download/v2/db.tar.gz"
2024-11-08T15:13:34+04:00       INFO    [vuln] Vulnerability scanning is enabled
2024-11-08T15:13:37+04:00       INFO    Detected OS     family="alpine" version="3.20.3"
2024-11-08T15:13:37+04:00       INFO    [alpine] Detecting vulnerabilities...   os_version="3.20" repository="3.20" pkg_num=14

DBs

  • Vulnerability DB (--db-repository)
  • Java DB (--java-db-repository)
  • Misconfiguration Checks DB (--checks-bundle-repository)

Currently, misconfiguration checks DB don't support multiple repositories, so it's out-of-scope for this PR.

Caveat

I've implemented the progress bar, but the change was bigger than expected. I reverted the changes and will open another PR.

2024-11-08T15:13:30+04:00       INFO    [vulndb] Downloading artifact...        location="https://github.com/knqyf263/trivy-db/releases/download/v2/db.tar.gz"
55.21 MiB / 55.21 MiB [-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 97.01 MiB p/s 800ms
2024-11-08T15:13:34+04:00       INFO    [vulndb] OCI successfully downloaded    location="https://github.com/knqyf263/trivy-db/releases/download/v2/db.tar.gz"

We might want to rename --db-repository to --db-locations or something like that, but we can discuss it later.

TODO

  • Refactor OCI support
  • Fix tests
  • Add HTTP support
  • Add progress bar (out of scope)
  • Add unit tests
  • Add integration tests

Related issues

Checklist

  • I've read the guidelines for contributing to this repository.
  • I've followed the conventions in the PR title.
  • I've added tests that prove my fix is effective or that my feature works.
  • I've updated the documentation with the relevant information (if needed).
  • I've added usage information (if the PR introduces new options)
  • I've included a "before" and "after" example to the description (if the PR is a user interface change).

knqyf263 and others added 8 commits November 8, 2024 14:29
@knqyf263
refactor: add a new interface for assets
98506b8 
Signed-off-by: knqyf263 <knqyf263@gmail.com>
@knqyf263
feat: show checks repo
7e8d9ee 
Signed-off-by: knqyf263 <knqyf263@gmail.com>
@knqyf263
feat: add http support
dbef58b 
Signed-off-by: knqyf263 <knqyf263@gmail.com>
@knqyf263
refactor: use embedded field
231a307 
Signed-off-by: knqyf263 <knqyf263@gmail.com>
@knqyf263
refactor: create a contextual logger
6ccd3f8 
Signed-off-by: knqyf263 <knqyf263@gmail.com>
@DmitriyLewen
refactor(asset): add ShouldTryOtherRepo into Asset interface + ad…
7719732 
…d `"http://` prefix
@DmitriyLewen
test: move tests to asset_test.go + add new tests
60442a8
@DmitriyLewen
fix: linter errors
acf838d
@nikpivkin nikpivkin mentioned this pull request Nov 13, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@DmitriyLewen DmitriyLewen Awaiting requested review from DmitriyLewen DmitriyLewen will be requested when the pull request is marked ready for review DmitriyLewen is a code owner

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Add HTTP support for downloading HTTP
2 participants
@knqyf263 @DmitriyLewen