Skip to content

Commit 7e183c9

Browse files
DmitriyLewenDmitriyLewen
committed
Merge branch 'main' of github.com:DmitriyLewen/trivy into jar-license-urls
2 parents 1bceacd + 2c64b8f commit 7e183c9

43 files changed

Lines changed: 2316 additions & 665 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎docs/guide/scanner/vulnerability.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,11 @@ In such cases, unrecognized third-party packages will still be scanned against o
120120
Conversely, packages from lesser-known but legitimate OS vendors may be incorrectly classified as third-party and skipped, leading to false negatives.
121121
If you notice such cases, please [report it](https://github.com/aquasecurity/trivy/discussions/new?category=bugs).
122122

123+
!!! note
124+
This applies to packages that are matched against an OS vendor's advisories.
125+
A distribution whose own advisories describe the packages it rebuilds, such as [Echo](../coverage/os/echo.md), scans them even when they are classified as third-party.
126+
[Seal Security](../coverage/others/seal.md) does both: its own `seal-*` packages are always scanned, while the remaining packages are matched against the base OS vendor's advisories and follow the rule above.
127+
123128
### Unfixed Vulnerabilities
124129
The unfixed/unfixable vulnerabilities mean that the patch has not yet been provided on their distribution.
125130
To hide unfixed/unfixable vulnerabilities, you can use the `--ignore-unfixed` flag.

‎docs/guide/supply-chain/vex/oci.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,13 @@ This feature allows you to automatically use VEX during container image scanning
1111
Trivy can automatically discover and utilize VEX attestations for container images during scanning by using the `--vex oci` flag.
1212
This process enhances vulnerability detection results by incorporating the information from the VEX attestation.
1313

14+
Trivy discovers attestations in both layouts produced by Cosign:
15+
16+
- An **OCI 1.1 referrer** holding a Sigstore bundle, which is the default for `cosign attest` since Cosign v3.
17+
- The **legacy `.att` tag**, which is the default for Cosign v2.
18+
19+
The referrer layout takes precedence; Trivy falls back to the legacy `.att` tag when no VEX referrer is found.
20+
1421
To use this feature, follow these three steps:
1522

1623
1. Create a VEX document
@@ -117,5 +124,9 @@ $ trivy image --vex oci --show-suppressed <IMAGE>
117124

118125
The `<IMAGE>` specified in these commands must be the same as the one to which you attached the VEX attestation.
119126

127+
!!! warning "Signatures are not verified"
128+
Trivy does not verify the signature of the discovered VEX attestation.
129+
Anyone able to push to the image's repository can attach a VEX attestation that suppresses findings, so use `--vex oci` only with registries you trust.
130+
120131
[purl]: https://github.com/package-url/purl-spec
121132
[qualifiers]: https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst

‎go.mod‎

Lines changed: 2 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,6 @@ require (
8585
github.com/open-policy-agent/opa v1.18.0
8686
github.com/opencontainers/go-digest v1.0.0
8787
github.com/opencontainers/image-spec v1.1.1
88-
github.com/openvex/discovery v0.1.1-0.20240802171711-7c54efc57553
8988
github.com/openvex/go-vex v0.2.7
9089
github.com/owenrumney/go-sarif/v2 v2.3.3
9190
github.com/package-url/packageurl-go v0.1.6
@@ -152,6 +151,7 @@ require (
152151
cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
153152
cloud.google.com/go/compute/metadata v0.9.0 // indirect
154153
cloud.google.com/go/iam v1.11.0 // indirect
154+
cloud.google.com/go/longrunning v1.0.0 // indirect
155155
cloud.google.com/go/monitoring v1.25.0 // indirect
156156
cloud.google.com/go/storage v1.62.2 // indirect
157157
connectrpc.com/connect v1.20.0 // indirect
@@ -198,7 +198,6 @@ require (
198198
github.com/aws/aws-sdk-go-v2/service/sts v1.43.3 // indirect
199199
github.com/aws/smithy-go v1.27.2 // indirect
200200
github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
201-
github.com/blang/semver v3.5.1+incompatible // indirect
202201
github.com/blang/semver/v4 v4.0.0 // indirect
203202
github.com/briandowns/spinner v1.23.0 // indirect
204203
github.com/bufbuild/buf v1.70.0 // indirect
@@ -222,15 +221,11 @@ require (
222221
github.com/containerd/plugin v1.1.0 // indirect
223222
github.com/containerd/ttrpc v1.2.8 // indirect
224223
github.com/containerd/typeurl/v2 v2.3.0 // indirect
225-
github.com/coreos/go-oidc/v3 v3.17.0 // indirect
226224
github.com/cpuguy83/dockercfg v0.3.2 // indirect
227225
github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
228-
github.com/cyberphone/json-canonicalization v0.0.0-20241213102144-19d51d7fe467 // indirect
229226
github.com/cyphar/filepath-securejoin v0.6.1 // indirect
230227
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
231228
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.1 // indirect
232-
github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352 // indirect
233-
github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 // indirect
234229
github.com/dlclark/regexp2 v1.11.0 // indirect
235230
github.com/docker/distribution v2.8.3+incompatible // indirect
236231
github.com/docker/docker v28.5.2+incompatible // indirect
@@ -252,7 +247,6 @@ require (
252247
github.com/fsnotify/fsnotify v1.10.1 // indirect
253248
github.com/fvbommel/sortorder v1.1.0 // indirect
254249
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
255-
github.com/go-chi/chi/v5 v5.3.0 // indirect
256250
github.com/go-errors/errors v1.5.1 // indirect
257251
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
258252
github.com/go-git/go-billy/v5 v5.9.0 // indirect
@@ -290,10 +284,8 @@ require (
290284
github.com/gofrs/uuid v4.3.1+incompatible // indirect
291285
github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
292286
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
293-
github.com/golang/snappy v0.0.4 // indirect
294287
github.com/google/btree v1.1.3 // indirect
295288
github.com/google/cel-go v0.28.1 // indirect
296-
github.com/google/certificate-transparency-go v1.3.3 // indirect
297289
github.com/google/gnostic-models v0.7.0 // indirect
298290
github.com/google/go-cmp v0.7.0 // indirect
299291
github.com/google/go-github/v31 v31.0.0 // indirect
@@ -315,7 +307,6 @@ require (
315307
github.com/inconshreveable/mousetrap v1.1.0 // indirect
316308
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
317309
github.com/jdx/go-netrc v1.0.0 // indirect
318-
github.com/jedisct1/go-minisign v0.0.0-20230811132847-661be99b8267 // indirect
319310
github.com/jmoiron/sqlx v1.4.0 // indirect
320311
github.com/josephburnett/jd/v2 v2.3.0 // indirect
321312
github.com/json-iterator/go v1.1.12 // indirect
@@ -333,7 +324,6 @@ require (
333324
github.com/lestrrat-go/httprc/v3 v3.0.5 // indirect
334325
github.com/lestrrat-go/jwx/v3 v3.1.1 // indirect
335326
github.com/lestrrat-go/option/v2 v2.0.0 // indirect
336-
github.com/letsencrypt/boulder v0.20260309.0 // indirect
337327
github.com/lib/pq v1.12.3 // indirect
338328
github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
339329
github.com/lufia/plan9stats v0.0.0-20240226150601-1dcf7310316a // indirect
@@ -364,7 +354,6 @@ require (
364354
github.com/morikuni/aec v1.1.0 // indirect
365355
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
366356
github.com/ncruces/go-strftime v1.0.0 // indirect
367-
github.com/nozzle/throttler v0.0.0-20180817012639-2ea982251481 // indirect
368357
github.com/oklog/ulid/v2 v2.1.1 // indirect
369358
github.com/opencontainers/runtime-spec v1.3.0 // indirect
370359
github.com/owenrumney/squealer v1.2.12 // indirect
@@ -382,6 +371,7 @@ require (
382371
github.com/quic-go/qpack v0.6.0 // indirect
383372
github.com/quic-go/quic-go v0.59.1 // indirect
384373
github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 // indirect
374+
github.com/redis/go-redis/extra/redisotel/v9 v9.5.3 // indirect
385375
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
386376
github.com/rivo/uniseg v0.4.7 // indirect
387377
github.com/rs/cors v1.11.1 // indirect
@@ -390,39 +380,28 @@ require (
390380
github.com/sagikazarmark/locafero v0.11.0 // indirect
391381
github.com/samber/oops v1.18.1 // indirect
392382
github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
393-
github.com/sassoftware/relic v7.2.1+incompatible // indirect
394383
github.com/segmentio/asm v1.2.1 // indirect
395384
github.com/segmentio/encoding v0.5.4 // indirect
396385
github.com/sergi/go-diff v1.4.0 // indirect
397386
github.com/shibumi/go-pathspec v1.3.0 // indirect
398387
github.com/shirou/gopsutil/v4 v4.26.5 // indirect
399388
github.com/shopspring/decimal v1.4.0 // indirect
400-
github.com/sigstore/cosign/v2 v2.6.2 // indirect
401389
github.com/sigstore/protobuf-specs v0.5.1 // indirect
402-
github.com/sigstore/rekor-tiles/v2 v2.2.2-0.20260601073857-5d098a2b6443 // indirect
403390
github.com/sigstore/sigstore v1.10.8 // indirect
404-
github.com/sigstore/sigstore-go v1.2.1 // indirect
405-
github.com/sigstore/timestamp-authority/v2 v2.1.2 // indirect
406391
github.com/skeema/knownhosts v1.3.1 // indirect
407392
github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
408393
github.com/spf13/afero v1.15.0 // indirect
409394
github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
410395
github.com/stretchr/objx v0.5.3 // indirect
411396
github.com/subosito/gotenv v1.6.0 // indirect
412-
github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d // indirect
413397
github.com/tchap/go-patricia/v2 v2.3.3 // indirect
414398
github.com/tetratelabs/wabin v0.0.0-20230304001439-f6f874872834 // indirect
415-
github.com/theupdateframework/go-tuf v0.7.0 // indirect
416-
github.com/theupdateframework/go-tuf/v2 v2.4.2 // indirect
417399
github.com/tidwall/btree v1.8.1 // indirect
418-
github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 // indirect
419400
github.com/tklauser/go-sysconf v0.3.16 // indirect
420401
github.com/tklauser/numcpus v0.11.0 // indirect
421402
github.com/tonglil/versioning v0.0.0-20170205083536-8b2a4334bd1d // indirect
422403
github.com/tonistiigi/go-csvvalue v0.0.0-20240814133006-030d3b2625d0 // indirect
423404
github.com/toqueteos/webbrowser v1.2.0 // indirect
424-
github.com/transparency-dev/formats v0.1.1 // indirect
425-
github.com/transparency-dev/merkle v0.0.2 // indirect
426405
github.com/ulikunitz/xz v0.5.15 // indirect
427406
github.com/valyala/fastjson v1.6.10 // indirect
428407
github.com/vektah/gqlparser/v2 v2.5.34 // indirect
@@ -437,7 +416,6 @@ require (
437416
github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect
438417
github.com/yuin/gopher-lua v1.1.1 // indirect
439418
github.com/yusufpapurcu/wmi v1.2.4 // indirect
440-
github.com/zalando/go-keyring v0.2.6 // indirect
441419
go.lsp.dev/jsonrpc2 v0.10.0 // indirect
442420
go.lsp.dev/pkg v0.0.0-20210717090340-384b27a52fb2 // indirect
443421
go.lsp.dev/protocol v0.12.0 // indirect

0 commit comments

Comments
 (0)