fix(vuln): skip empty versions

[knqyf263]

Description

It currently shows warnings on empty versions.

$ trivy sbom /tmp/sbom-k8s-cluster.json
2024-04-23T13:53:05+04:00       INFO    Vulnerability scanning is enabled
2024-04-23T13:53:05+04:00       INFO    Detected SBOM format    format="cyclonedx-json"
...
2024-04-23T13:53:05+04:00       INFO    [kubernetes] Detecting vulnerabilities...
2024-04-23T13:53:05+04:00       WARN    Version matching error  err="version error (): malformed version: "
2024-04-23T13:53:05+04:00       WARN    Version matching error  err="version error (): malformed version: "
2024-04-23T13:53:05+04:00       WARN    Version matching error  err="version error (): malformed version: "
2024-04-23T13:53:05+04:00       WARN    Version matching error  err="version error (): malformed version: "

This PR changed it to skip empty versions and show debug messages.

$ trivy sbom /tmp/sbom-k8s-cluster.json -d
...
2024-04-23T13:47:40+04:00       INFO    [kubernetes] Detecting vulnerabilities...
2024-04-23T13:47:40+04:00       DEBUG   [kubernetes] Scanning packages from the file    file_path=""
2024-04-23T13:47:40+04:00       DEBUG   [kubernetes] Skipping package without version   name="cilium"
2024-04-23T13:47:40+04:00       DEBUG   [kubernetes] Skipping package without version   name="hubble-relay"
2024-04-23T13:47:40+04:00       DEBUG   [kubernetes] Skipping package without version   name="hubble-ui"
2024-04-23T13:47:40+04:00       DEBUG   [kubernetes] Skipping package without version   name="k8s.io/kube-proxy"
2024-04-23T13:47:40+04:00       DEBUG   [kubernetes] Skipping package without version   name="kube-dns"

Also it passes context to the scanner to make logger context-aware.

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[DmitriyLewen]

LGTM.
Left 1 comment