diff --git a/DATAROBOT_RELEASE.md b/DATAROBOT_RELEASE.md new file mode 100644 index 000000000000..a0a595e3972f --- /dev/null +++ b/DATAROBOT_RELEASE.md @@ -0,0 +1,53 @@ +## How to release our fork + +It uses goreleaser: https://goreleaser.com/customization/release/#github + +What you need to release? + +`GITHUB_TOKEN` set to a GitHub API token that has release permissions + +Logged into Docker Hub with a user that has permission to write images to datarobotdev/trivy + +Make a tag that represents the version we are "forking". + +I typically pick the latest release from the upstream, for example v0.48.3 + +I would do + +``` +git checkout v0.48.3 +git checkout -b u/v0.48.3 +git checkout main_datarobot +git rebase u/v0.48.3 +git push -f +git tag v0.48.3-dr1 +git push origin v0.48.3-dr1 +``` +then I'm ready to run the releaser that will build and push everything + +To try out the release and make sure it should work: + +https://goreleaser.com/quick-start/?h=dry+run#dry-run + + +``` +goreleaser -f goreleaser-datarobot.yml build --clean +``` + +Make sure that works then: + +``` +goreleaser -f goreleaser-datarobot.yml release --clean + +``` + +You probably will have some docker error: + +``` +docker context use default +``` +should fix it, then run again + + +To update the drone-trivy plugin, just run the main branch build from the harness ui. +It is built from the latest tag of our forked trivy repo diff --git a/contrib/csv.tpl b/contrib/csv.tpl new file mode 100644 index 000000000000..ac070531751d --- /dev/null +++ b/contrib/csv.tpl @@ -0,0 +1,8 @@ +VulnerabilityID,Severity,PackageName,InstalledVersion,FixedVersion,PackagePath,Target +{{- range . }} +{{- $target := .Target -}} +{{- if (gt (len .Vulnerabilities) 0) }} +{{- range .Vulnerabilities }} +"{{- .VulnerabilityID | replace "\"" "\"\"" }}","{{- .Vulnerability.Severity | replace "\"" "\"\"" }}","{{- .PkgName | replace "\"" "\"\""}}","{{- .InstalledVersion | replace "\"" "\"\"" }}","{{- .FixedVersion | replace "\"" "\"\"" }}","{{- .PkgPath | replace "\"" "\"\"" }}","{{- $target | replace "\"" "\"\"" }}",{{- end }} +{{- end -}} +{{- end }} diff --git a/contrib/html.tpl b/contrib/html.tpl index e92b1b1cf7f5..bd718507d4a9 100644 --- a/contrib/html.tpl +++ b/contrib/html.tpl @@ -25,6 +25,9 @@ table { margin: 0 auto; } + .pkg-path { + white-space: normal; + } .severity { text-align: center; font-weight: bold; @@ -52,7 +55,7 @@ } a.toggle-more-links { cursor: pointer; } - {{- escapeXML ( index . 0 ).Target }} - Trivy Report - {{ now }} + Trivy Report - {{ now }} -

{{- escapeXML ( index . 0 ).Target }} - Trivy Report - {{ now }}

+

Trivy Report - {{ now }}

{{- range . }} - + + + {{- if (eq (len .Vulnerabilities) 0) }} - + {{- else }} @@ -95,6 +100,7 @@ + {{- range .Vulnerabilities }} @@ -104,6 +110,7 @@ + + {{- else }} @@ -137,6 +144,28 @@ {{- end }} {{- end }} + {{- if (eq (len .Secrets ) 0) }} + + {{- else }} + + + + + + + + {{- range .Secrets }} + + + + + + + + {{- end }} + {{- end }} {{- end }}
{{ .Type | toString | escapeXML }}
Target: {{ escapeXML .Target }} —
No Vulnerabilities found
No Vulnerabilities found
PackageSeverity Installed Version Fixed VersionPackage Path Links
{{ escapeXML .Vulnerability.Severity }} {{ escapeXML .InstalledVersion }} {{ escapeXML .FixedVersion }}{{ escapeXML .PkgPath }} {{- range .Vulnerability.References }} {{ escapeXML . }} @@ -113,7 +120,7 @@ {{- end }} {{- end }} {{- if (eq (len .Misconfigurations ) 0) }} -
No Misconfigurations found
No Misconfigurations found
Type
No Secrets found
CategoryRule IDCheckSeverityMatch
{{ .Category }}{{ escapeXML .RuleID }}{{ escapeXML .Title }}{{ escapeXML .Severity }} + {{ escapeXML .Match }} +
{{- else }} diff --git a/contrib/junit.tpl b/contrib/junit.tpl index 27b654b7b049..377d4fe04a31 100644 --- a/contrib/junit.tpl +++ b/contrib/junit.tpl @@ -2,15 +2,19 @@ {{- range . -}} {{- $failures := len .Vulnerabilities }} - + {{- if not (eq .Type "") }} {{- end -}} {{ range .Vulnerabilities }} - - {{ escapeXML .Description }} + + + Severity: {{ .Severity }} + Package Path (if available): {{ .PkgPath }} + Description: {{ escapeXML .Description }} + {{- end }} @@ -44,5 +48,19 @@ {{- end }} +{{- $failures := len .Secrets }} + + {{- if not (eq .Type "") }} + + + + {{- end -}} + {{ $Path := .Target }} + {{ range .Secrets }} + + {{ escapeXML .Match }} + + {{- end }} + {{- end }} diff --git a/goreleaser-datarobot.yml b/goreleaser-datarobot.yml new file mode 100644 index 000000000000..7331998d483a --- /dev/null +++ b/goreleaser-datarobot.yml @@ -0,0 +1,90 @@ +project_name: trivy +builds: + - id: build-linux + main: cmd/trivy/main.go + binary: trivy + ldflags: + - -s -w + - "-extldflags '-static'" + - -X github.com/aquasecurity/trivy/pkg/version.ver={{.Version}} + env: + - CGO_ENABLED=0 + goos: + - linux + goarch: + - 386 + - arm + - amd64 + - arm64 + goarm: + - 7 + - id: build-macos + main: cmd/trivy/main.go + binary: trivy + ldflags: + - -s -w + - "-extldflags '-static'" + - -X github.com/aquasecurity/trivy/pkg/version.ver={{.Version}} + env: + - CGO_ENABLED=0 + goos: + - darwin + goarch: + - amd64 + - arm64 + goarm: + - 7 + +dockers: + - image_templates: + - "docker.io/datarobotdev/trivy:{{ .Version }}-amd64" + - "docker.io/datarobotdev/trivy:latest-amd64" + use: buildx + goos: linux + goarch: amd64 + ids: + - build-linux + build_flag_templates: + - "--label=org.opencontainers.image.title={{ .ProjectName }}" + - "--label=org.opencontainers.image.description=A Fast Vulnerability Scanner for Containers" + - "--label=org.opencontainers.image.vendor=Aqua Security" + - "--label=org.opencontainers.image.version={{ .Version }}" + - "--label=org.opencontainers.image.created={{ .Date }}" + - "--label=org.opencontainers.image.source=https://github.com/aquasecurity/trivy" + - "--label=org.opencontainers.image.revision={{ .FullCommit }}" + - "--label=org.opencontainers.image.url=https://www.aquasec.com/products/trivy/" + - "--label=org.opencontainers.image.documentation=https://aquasecurity.github.io/trivy/v{{ .Version }}/" + - "--platform=linux/amd64" + extra_files: + - contrib/ + - image_templates: + - "docker.io/datarobotdev/trivy:{{ .Version }}-arm64" + - "docker.io/datarobotdev/trivy:latest-arm64" + use: buildx + goos: linux + goarch: arm64 + ids: + - build-linux + build_flag_templates: + - "--label=org.opencontainers.image.title={{ .ProjectName }}" + - "--label=org.opencontainers.image.description=A Fast Vulnerability Scanner for Containers" + - "--label=org.opencontainers.image.vendor=Aqua Security" + - "--label=org.opencontainers.image.version={{ .Version }}" + - "--label=org.opencontainers.image.created={{ .Date }}" + - "--label=org.opencontainers.image.source=https://github.com/aquasecurity/trivy" + - "--label=org.opencontainers.image.revision={{ .FullCommit }}" + - "--label=org.opencontainers.image.url=https://www.aquasec.com/products/trivy/" + - "--label=org.opencontainers.image.documentation=https://aquasecurity.github.io/trivy/v{{ .Version }}/" + - "--platform=linux/arm64" + extra_files: + - contrib/ + +docker_manifests: + - name_template: 'datarobotdev/trivy:{{ .Version }}' + image_templates: + - 'datarobotdev/trivy:{{ .Version }}-amd64' + - 'datarobotdev/trivy:{{ .Version }}-arm64' + - name_template: 'datarobotdev/trivy:latest' + image_templates: + - 'datarobotdev/trivy:{{ .Version }}-amd64' + - 'datarobotdev/trivy:{{ .Version }}-arm64' diff --git a/pkg/flag/report_flags.go b/pkg/flag/report_flags.go index d69443e89547..e4f51bbdf534 100644 --- a/pkg/flag/report_flags.go +++ b/pkg/flag/report_flags.go @@ -68,7 +68,7 @@ var ( IgnorePolicyFlag = Flag[string]{ Name: "ignore-policy", ConfigName: "ignore-policy", - Usage: "specify the Rego file path to evaluate each vulnerability", + Usage: "specify the Rego file path (or dir path with Rego files) to evaluate each vulnerability", } ExitCodeFlag = Flag[int]{ Name: "exit-code", diff --git a/pkg/result/filter.go b/pkg/result/filter.go index 83e0c0a7170e..0db8a46cf8b2 100644 --- a/pkg/result/filter.go +++ b/pkg/result/filter.go @@ -3,16 +3,19 @@ package result import ( "context" "fmt" + "io/fs" "os" "path/filepath" "slices" "sort" + "github.com/open-policy-agent/opa/bundle" "github.com/open-policy-agent/opa/rego" "github.com/samber/lo" "golang.org/x/xerrors" dbTypes "github.com/aquasecurity/trivy-db/pkg/types" + "github.com/aquasecurity/trivy/pkg/log" "github.com/aquasecurity/trivy/pkg/types" "github.com/aquasecurity/trivy/pkg/vex" ) @@ -70,8 +73,19 @@ func FilterResult(ctx context.Context, result *types.Result, ignoreConf IgnoreCo filterLicenses(result, severities, opt.IgnoreLicenses, ignoreConf) if opt.PolicyFile != "" { - if err := applyPolicy(ctx, result, opt.PolicyFile); err != nil { - return xerrors.Errorf("failed to apply the policy: %w", err) + log.Debugf("Filtering result with ignore policies, type: %s, path: %s", result.Type, result.Target) + + // Get ignore policy files from the input path (either file or files in dir) + policyFiles, err := findPolicyFiles(opt.PolicyFile) + if err != nil { + return err + } + + for _, policyFile := range policyFiles { + log.Debugf("Applying ignore policy: %s", policyFile) + if err := applyPolicy(ctx, result, policyFile); err != nil { + return xerrors.Errorf("failed to apply ignore policy %s: %w", policyFile, err) + } } } sort.Sort(types.BySeverity(result.Vulnerabilities)) @@ -212,6 +226,37 @@ func summarize(status types.MisconfStatus, summary *types.MisconfSummary) { } } +func findPolicyFiles(policiesPath string) ([]string, error) { + var files []string + fi, err := os.Stat(policiesPath) + if err != nil { + return nil, xerrors.Errorf("failed to analyze ignore policy %q: %w", policiesPath, err) + } + // If the ignore policy option is a dir find and apply rego files in it + if fi.IsDir() { + err := filepath.WalkDir(policiesPath, func(path string, d fs.DirEntry, err error) error { + if err != nil { + return err + } + if !d.IsDir() && filepath.Ext(path) == bundle.RegoExt { + files = append(files, path) + } + return nil + }) + if err != nil { + return nil, xerrors.Errorf("failed to find policy files in %q: %w", policiesPath, err) + } + + if len(files) == 0 { + log.Warnf("No ignore policies found in %q", policiesPath) + } + } else { + files = append(files, policiesPath) + } + + return files, nil +} + func applyPolicy(ctx context.Context, result *types.Result, policyFile string) error { policy, err := os.ReadFile(policyFile) if err != nil {