Skip to content
This repository has been archived by the owner on Sep 20, 2024. It is now read-only.

add --db-repository options #267

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

add --db-repository options #267

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
9daf7d8
add --db-repository options
EricRoux Oct 7, 2022
1020d3c
Updating the indentation
EricRoux Oct 7, 2022
ddba759
Changing the sequence of arguments for unit tests
EricRoux Oct 11, 2022
b72ce9a
Changing the value of argument for unit tests
EricRoux Oct 19, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions helm/harbor-scanner-trivy/templates/statefulset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,8 @@ spec:
value: {{ .Values.scanner.trivy.severity | default "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL" | quote }}
- name: "SCANNER_TRIVY_IGNORE_UNFIXED"
value: {{ .Values.scanner.trivy.ignoreUnfixed | default false | quote }}
- name: "SCANNER_TRIVY_REPOSITORY"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- name: "SCANNER_TRIVY_REPOSITORY"
- name: "SCANNER_TRIVY_DB_REPOSITORY"

value: {{ .Values.scanner.trivy.repository | default "ghcr.io/aquasecurity/trivy-db" | quote }}
- name: "SCANNER_TRIVY_TIMEOUT"
value: {{ .Values.scanner.trivy.timeout | quote }}
- name: "SCANNER_TRIVY_SKIP_UPDATE"
Expand Down
2 changes: 2 additions & 0 deletions helm/harbor-scanner-trivy/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,8 @@ scanner:
severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
## ignoreUnfixed the flag to display only fixed vulnerabilities
ignoreUnfixed: false
## OCI repository to retrieve trivy-db
repository: "ghcr.io/aquasecurity/trivy-db"
## timeout the duration to wait for scan completion
timeout: 5m0s
## skipUpdate the flag to enable or disable Trivy DB downloads from GitHub
Expand Down
1 change: 1 addition & 0 deletions pkg/etc/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@ type Trivy struct {
Severity string `env:"SCANNER_TRIVY_SEVERITY" envDefault:"UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"`
IgnoreUnfixed bool `env:"SCANNER_TRIVY_IGNORE_UNFIXED" envDefault:"false"`
IgnorePolicy string `env:"SCANNER_TRIVY_IGNORE_POLICY"`
Repository string `env:"SCANNER_TRIVY_REPOSITORY"`
SkipUpdate bool `env:"SCANNER_TRIVY_SKIP_UPDATE" envDefault:"false"`
OfflineScan bool `env:"SCANNER_TRIVY_OFFLINE_SCAN" envDefault:"false"`
GitHubToken string `env:"SCANNER_TRIVY_GITHUB_TOKEN"`
Expand Down
1 change: 1 addition & 0 deletions pkg/etc/config_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,6 +155,7 @@ func TestGetConfig(t *testing.T) {
"SCANNER_TRIVY_SECURITY_CHECKS": "vuln",
"SCANNER_TRIVY_SEVERITY": "CRITICAL",
"SCANNER_TRIVY_IGNORE_UNFIXED": "true",
"SCANNER_TRIVY_REPOSITORY": "",
"SCANNER_TRIVY_INSECURE": "true",
"SCANNER_TRIVY_SKIP_UPDATE": "true",
"SCANNER_TRIVY_OFFLINE_SCAN": "true",
Expand Down
6 changes: 5 additions & 1 deletion pkg/trivy/wrapper.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -140,10 +140,14 @@ func (w *wrapper) prepareScanCmd(imageRef ImageRef, outputFile string) (*exec.Cm
args = append([]string{"--offline-scan"}, args...)
}

if w.config.Repository != "" {
args = append([]string{"--db-repository", w.config.Repository}, args...)
}

if w.config.IgnorePolicy != "" {
args = append([]string{"--ignore-policy", w.config.IgnorePolicy}, args...)
}

name, err := w.ambassador.LookPath(trivyCmd)
if err != nil {
return nil, err
Expand Down
3 changes: 3 additions & 0 deletions pkg/trivy/wrapper_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,6 +98,7 @@ func TestWrapper_Scan(t *testing.T) {
Severity: "CRITICAL,MEDIUM",
IgnoreUnfixed: true,
IgnorePolicy: "/home/scanner/opa/policy.rego",
Repository: "ghcr.io/aquasecurity/trivy-db",
SkipUpdate: true,
GitHubToken: "<github_token>",
Insecure: true,
Expand All @@ -118,6 +119,8 @@ func TestWrapper_Scan(t *testing.T) {
"image",
"--ignore-policy",
"/home/scanner/opa/policy.rego",
"--db-repository",
"ghcr.io/aquasecurity/trivy-db",
"--skip-update",
"--ignore-unfixed",
"--no-progress",
Expand Down