diff --git a/.github/workflows/auto-update-labels.yaml b/.github/workflows/auto-update-labels.yaml
index 26307a3f50c5..6dab8481873b 100644
--- a/.github/workflows/auto-update-labels.yaml
+++ b/.github/workflows/auto-update-labels.yaml
@@ -20,7 +20,7 @@ jobs:
go-version-file: go.mod
- name: Install aqua tools
- uses: aquaproj/aqua-installer@v2.1.2
+ uses: aquaproj/aqua-installer@v2.2.0
with:
aqua_version: v1.25.0
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index a6401facaa68..802fe53f0814 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -47,7 +47,7 @@ jobs:
if: ${{ failure() && steps.lint.conclusion == 'failure' }}
- name: Install tools
- uses: aquaproj/aqua-installer@v2.1.2
+ uses: aquaproj/aqua-installer@v2.2.0
with:
aqua_version: v1.25.0
aqua_opts: ""
@@ -77,7 +77,7 @@ jobs:
go-version-file: go.mod
- name: Install tools
- uses: aquaproj/aqua-installer@v2.1.2
+ uses: aquaproj/aqua-installer@v2.2.0
with:
aqua_version: v1.25.0
@@ -106,7 +106,7 @@ jobs:
go-version-file: go.mod
- name: Install tools
- uses: aquaproj/aqua-installer@v2.1.2
+ uses: aquaproj/aqua-installer@v2.2.0
with:
aqua_version: v1.25.0
@@ -126,7 +126,7 @@ jobs:
go-version-file: go.mod
- name: Install tools
- uses: aquaproj/aqua-installer@v2.1.2
+ uses: aquaproj/aqua-installer@v2.2.0
with:
aqua_version: v1.25.0
@@ -156,7 +156,7 @@ jobs:
with:
go-version-file: go.mod
- name: Install tools
- uses: aquaproj/aqua-installer@v2.1.2
+ uses: aquaproj/aqua-installer@v2.2.0
with:
aqua_version: v1.25.0
- name: Run vm integration tests
diff --git a/brand/Trivy-OSS-Logo-Color-Horizontal-RGB-2022.png b/brand/Trivy-OSS-Logo-Color-Horizontal-RGB-2022.png
deleted file mode 100644
index bd5034c50943..000000000000
Binary files a/brand/Trivy-OSS-Logo-Color-Horizontal-RGB-2022.png and /dev/null differ
diff --git a/brand/Trivy-OSS-Logo-Color-Horizontal-RGB-2022.svg b/brand/Trivy-OSS-Logo-Color-Horizontal-RGB-2022.svg
deleted file mode 100644
index df77ea97d3d1..000000000000
--- a/brand/Trivy-OSS-Logo-Color-Horizontal-RGB-2022.svg
+++ /dev/null
@@ -1,56 +0,0 @@
-
-
-
-
-
-
-
-
-
-
-
-
diff --git a/brand/Trivy-OSS-Logo-Color-Horizontal-RGB.png b/brand/Trivy-OSS-Logo-Color-Horizontal-RGB.png
new file mode 100644
index 000000000000..04ae7cd4e9ad
Binary files /dev/null and b/brand/Trivy-OSS-Logo-Color-Horizontal-RGB.png differ
diff --git a/brand/Trivy-OSS-Logo-Color-Horizontal-RGB.svg b/brand/Trivy-OSS-Logo-Color-Horizontal-RGB.svg
new file mode 100644
index 000000000000..9cdd1b594dd9
--- /dev/null
+++ b/brand/Trivy-OSS-Logo-Color-Horizontal-RGB.svg
@@ -0,0 +1,85 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/brand/Trivy-OSS-Logo-Color-Stacked-RGB-2022.png b/brand/Trivy-OSS-Logo-Color-Stacked-RGB-2022.png
deleted file mode 100644
index 6cb94ab62f3f..000000000000
Binary files a/brand/Trivy-OSS-Logo-Color-Stacked-RGB-2022.png and /dev/null differ
diff --git a/brand/Trivy-OSS-Logo-Color-Stacked-RGB-2022.svg b/brand/Trivy-OSS-Logo-Color-Stacked-RGB-2022.svg
deleted file mode 100644
index 0328bac69133..000000000000
--- a/brand/Trivy-OSS-Logo-Color-Stacked-RGB-2022.svg
+++ /dev/null
@@ -1,202 +0,0 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
diff --git a/brand/Trivy-OSS-Logo-Color-Stacked-RGB.png b/brand/Trivy-OSS-Logo-Color-Stacked-RGB.png
new file mode 100644
index 000000000000..de36d4fcd7d3
Binary files /dev/null and b/brand/Trivy-OSS-Logo-Color-Stacked-RGB.png differ
diff --git a/brand/Trivy-OSS-Logo-Color-Stacked-RGB.svg b/brand/Trivy-OSS-Logo-Color-Stacked-RGB.svg
new file mode 100644
index 000000000000..fad8b53fbab5
--- /dev/null
+++ b/brand/Trivy-OSS-Logo-Color-Stacked-RGB.svg
@@ -0,0 +1,3206 @@
+
+
+
+
+
+
+
+
+
+
+]>
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/brand/Trivy-OSS-Logo-White-Horizontal-RGB-2022.png b/brand/Trivy-OSS-Logo-White-Horizontal-RGB-2022.png
deleted file mode 100644
index 89613872a98b..000000000000
Binary files a/brand/Trivy-OSS-Logo-White-Horizontal-RGB-2022.png and /dev/null differ
diff --git a/brand/Trivy-OSS-Logo-White-Horizontal-RGB-2022.svg b/brand/Trivy-OSS-Logo-White-Horizontal-RGB-2022.svg
deleted file mode 100644
index 475c4b577eb7..000000000000
--- a/brand/Trivy-OSS-Logo-White-Horizontal-RGB-2022.svg
+++ /dev/null
@@ -1,84 +0,0 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
diff --git a/brand/Trivy-OSS-Logo-White-Horizontal-RGB.png b/brand/Trivy-OSS-Logo-White-Horizontal-RGB.png
new file mode 100644
index 000000000000..06587180294a
Binary files /dev/null and b/brand/Trivy-OSS-Logo-White-Horizontal-RGB.png differ
diff --git a/brand/Trivy-OSS-Logo-White-Horizontal-RGB.svg b/brand/Trivy-OSS-Logo-White-Horizontal-RGB.svg
new file mode 100644
index 000000000000..b3183574dde0
--- /dev/null
+++ b/brand/Trivy-OSS-Logo-White-Horizontal-RGB.svg
@@ -0,0 +1,69 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/brand/Trivy-OSS-Logo-White-Stacked-RGB-2022.png b/brand/Trivy-OSS-Logo-White-Stacked-RGB-2022.png
deleted file mode 100644
index 2417ddf34a92..000000000000
Binary files a/brand/Trivy-OSS-Logo-White-Stacked-RGB-2022.png and /dev/null differ
diff --git a/brand/Trivy-OSS-Logo-White-Stacked-RGB-2022.svg b/brand/Trivy-OSS-Logo-White-Stacked-RGB-2022.svg
deleted file mode 100644
index 32e110ded500..000000000000
--- a/brand/Trivy-OSS-Logo-White-Stacked-RGB-2022.svg
+++ /dev/null
@@ -1,59 +0,0 @@
-
-
-
-
-
-
-
-
-
-
-
-
diff --git a/brand/Trivy-OSS-Logo-White-Stacked-RGB.png b/brand/Trivy-OSS-Logo-White-Stacked-RGB.png
new file mode 100644
index 000000000000..0ece65b88a0a
Binary files /dev/null and b/brand/Trivy-OSS-Logo-White-Stacked-RGB.png differ
diff --git a/brand/Trivy-OSS-Logo-White-Stacked-RGB.svg b/brand/Trivy-OSS-Logo-White-Stacked-RGB.svg
new file mode 100644
index 000000000000..52def3a62ddc
--- /dev/null
+++ b/brand/Trivy-OSS-Logo-White-Stacked-RGB.svg
@@ -0,0 +1,3179 @@
+
+
+
+
+
+
+
+
+
+
+]>
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/contrib/asff.tpl b/contrib/asff.tpl
index 4c33de7e0b49..d6833a1d7ff1 100644
--- a/contrib/asff.tpl
+++ b/contrib/asff.tpl
@@ -128,7 +128,7 @@
{
"SchemaVersion": "2018-10-08",
"Id": "{{ $target }}",
- "ProductArn": "arn:aws:securityhub:{{ env "AWS_DEFAULT_REGION" }}::product/aquasecurity/aquasecurity",
+ "ProductArn": "arn:aws:securityhub:{{ env "AWS_REGION" }}::product/aquasecurity/aquasecurity",
"GeneratorId": "Trivy",
"AwsAccountId": "{{ env "AWS_ACCOUNT_ID" }}",
"Types": [ "Sensitive Data Identifications" ],
@@ -145,7 +145,7 @@
"Type": "Other",
"Id": "{{ $target }}",
"Partition": "aws",
- "Region": "{{ env "AWS_DEFAULT_REGION" }}",
+ "Region": "{{ env "AWS_REGION" }}",
"Details": {
"Other": {
"Filename": "{{ $target }}"
diff --git a/docs/community/contribute/discussion.md b/docs/community/contribute/discussion.md
index bfcf2355dc55..b7e1a2d7294d 100644
--- a/docs/community/contribute/discussion.md
+++ b/docs/community/contribute/discussion.md
@@ -24,7 +24,7 @@ There are 4 categories:
If you find any false positives or false negatives, please make sure to report them under the "False Detection" category, not "Bugs".
## False detection
-Trivy depends on [multiple data sources](https://aquasecurity.github.io/trivy/latest/docs/vulnerability/detection/data-source/).
+Trivy depends on [multiple data sources](https://aquasecurity.github.io/trivy/latest/docs/scanner/vulnerability/#data-sources).
Sometime these databases contain mistakes.
If Trivy can't detect any CVE-IDs or shows false positive result, at first please follow the next steps:
diff --git a/docs/docs/configuration/filtering.md b/docs/docs/configuration/filtering.md
index a3d08daa897d..1f40d160c9cb 100644
--- a/docs/docs/configuration/filtering.md
+++ b/docs/docs/configuration/filtering.md
@@ -408,7 +408,7 @@ Total: 7 (UNKNOWN: 0, LOW: 1, MEDIUM: 1, HIGH: 3, CRITICAL: 2)
-## By Open Policy Agent
+## By Rego
| Scanner | Supported |
|:----------------:|:---------:|
@@ -420,75 +420,68 @@ Total: 7 (UNKNOWN: 0, LOW: 1, MEDIUM: 1, HIGH: 3, CRITICAL: 2)
!!! warning "EXPERIMENTAL"
This feature might change without preserving backwards compatibility.
-Trivy supports Open Policy Agent (OPA) to filter vulnerabilities.
-You can specify a Rego file with `--ignore-policy` option.
+[Rego](https://www.openpolicyagent.org/docs/latest/policy-language/) is a policy language that allows you to express decision logic in a concise syntax.
+Rego is part of the popular [Open Policy Agent (OPA)](https://www.openpolicyagent.org) CNCF project.
+For advanced filtering, Trivy allows you to use Rego language to filter vulnerabilities.
-The Rego package name must be `trivy` and it must include a rule called `ignore` which determines if each individual vulnerability should be excluded (ignore=true) or not (ignore=false). In the policy, each vulnerability will be available for inspection as the `input` variable. The structure of each vulnerability input is the same as for the Trivy JSON output.
-There is a built-in Rego library with helper functions that you can import into your policy using: `import data.lib.trivy`. For more info about the helper functions, look at the library [here][helper]
+Use the `--ignore-policy` flag which takes a path to a Rego file that defines the filtering policy.
+The Rego package name must be `trivy` and it must include a "rule" named `ignore` which determines if each individual scan result should be excluded (ignore=true) or not (ignore=false).
+The `input` for the evaluation is each [DetectedVulnerability](https://github.com/aquasecurity/trivy/blob/00f2059e5d7bc2ca2e3e8b1562bdfede1ed570e3/pkg/types/vulnerability.go#L9) and [DetectedMisconfiguration](https://github.com/aquasecurity/trivy/blob/00f2059e5d7bc2ca2e3e8b1562bdfede1ed570e3/pkg/types/misconfiguration.go#L6).
-To get started, see the [example policy][policy].
+A practical way to observe the filtering policy input in your case, is to run a scan with the `--format json` option and look at the resulting structure:
```bash
-$ trivy image --ignore-policy contrib/example_policy/basic.rego centos:7
+trivy image -f json centos:7
+
+...
+ "Results": [
+ {
+ "Target": "centos:7 (centos 7.9.2009)",
+ "Class": "os-pkgs",
+ "Type": "centos",
+ "Vulnerabilities": [
+ {
+ "VulnerabilityID": "CVE-2015-5186",
+ "PkgID": "audit-libs@2.8.5-4.el7.x86_64",
+ "PkgName": "audit-libs",
+ "InstalledVersion": "2.8.5-4.el7",
+ "Layer": {
+ "Digest": "sha256:2d473b07cdd5f0912cd6f1a703352c82b512407db6b05b43f2553732b55df3bc",
+ "DiffID": "sha256:174f5685490326fc0a1c0f5570b8663732189b327007e47ff13d2ca59673db02"
+ },
+ "SeveritySource": "redhat",
+ "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2015-5186",
+ "Title": "log terminal emulator escape sequences handling",
+ "Description": "Audit before 2.4.4 in Linux does not sanitize escape characters in filenames.",
+ "Severity": "MEDIUM",
+ "CweIDs": [
+ "CWE-20"
+ ],
+...
```
-
-Result
+Each individual vulnerability (under `Results.Vulnerabilities`) or Misconfiguration (under `Results.Misconfigurations`) is evaluated for exclusion or inclusion by the `ignore` rule.
+
+The following is a Rego ignore policy that filters out every vulnerability with a specific CWE ID (as seen in the JSON example above):
+
+```rego
+package trivy
+
+default ignore = false
+
+ignore {
+ input.CweIDs[_] == "CWE-20"
+}
+```
```bash
-centos:7 (centos 7.9.2009)
-==========================
-Total: 9 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 4, CRITICAL: 5)
-
-+--------------+------------------+----------+-------------------+-------------------+-----------------------------------------+
-| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |
-+--------------+------------------+----------+-------------------+-------------------+-----------------------------------------+
-| glib2 | CVE-2015-8385 | HIGH | 2.56.1-7.el7 | | pcre: buffer overflow caused |
-| | | | | | by named forward reference |
-| | | | | | to duplicate group number... |
-| | | | | | -->avd.aquasec.com/nvd/cve-2015-8385 |
-+ +------------------+ + +-------------------+-----------------------------------------+
-| | CVE-2016-3191 | | | | pcre: workspace overflow for |
-| | | | | | (*ACCEPT) with deeply nested |
-| | | | | | parentheses (8.39/13, 10.22/12) |
-| | | | | | -->avd.aquasec.com/nvd/cve-2016-3191 |
-+ +------------------+ + +-------------------+-----------------------------------------+
-| | CVE-2021-27219 | | | 2.56.1-9.el7_9 | glib: integer overflow in |
-| | | | | | g_bytes_new function on |
-| | | | | | 64-bit platforms due to an... |
-| | | | | | -->avd.aquasec.com/nvd/cve-2021-27219 |
-+--------------+------------------+----------+-------------------+-------------------+-----------------------------------------+
-| glibc | CVE-2019-1010022 | CRITICAL | 2.17-317.el7 | | glibc: stack guard protection bypass |
-| | | | | | -->avd.aquasec.com/nvd/cve-2019-1010022 |
-+--------------+ + + +-------------------+ +
-| glibc-common | | | | | |
-| | | | | | |
-+--------------+------------------+ +-------------------+-------------------+-----------------------------------------+
-| nss | CVE-2021-43527 | | 3.53.1-3.el7_9 | 3.67.0-4.el7_9 | nss: Memory corruption in |
-| | | | | | decodeECorDsaSignature with |
-| | | | | | DSA signatures (and RSA-PSS) |
-| | | | | | -->avd.aquasec.com/nvd/cve-2021-43527 |
-+--------------+ + + + + +
-| nss-sysinit | | | | | |
-| | | | | | |
-| | | | | | |
-| | | | | | |
-+--------------+ + + + + +
-| nss-tools | | | | | |
-| | | | | | |
-| | | | | | |
-| | | | | | |
-+--------------+------------------+----------+-------------------+-------------------+-----------------------------------------+
-| openssl-libs | CVE-2020-1971 | HIGH | 1:1.0.2k-19.el7 | 1:1.0.2k-21.el7_9 | openssl: EDIPARTYNAME |
-| | | | | | NULL pointer de-reference |
-| | | | | | -->avd.aquasec.com/nvd/cve-2020-1971 |
-+--------------+------------------+----------+-------------------+-------------------+-----------------------------------------+
+trivy image --ignore-policy contrib/example_policy/basic.rego centos:7
```
-
+For more advanced use cases, there is a built-in Rego library with helper functions that you can import into your policy using: `import data.lib.trivy`.
+More info about the helper functions are in the library [here](https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/pkg/result/module.go).
-[helper]: https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/pkg/result/module.go
-[policy]: https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/contrib/example_policy
+You can find more example policies [here](https://github.com/aquasecurity/trivy/tree/{{ git.tag }}/pkg/result/module.go)
## By Inline Comments
@@ -503,7 +496,7 @@ Some configuration file formats (e.g. Terraform) support inline comments.
In cases where trivy can detect comments of a specific format immediately adjacent to resource definitions, it is possible to filter/ignore findings from a single point of resource definition (in contrast to `.trivyignore`, which has a directory-wide scope on all of the files scanned).
-The format for these comments is `trivy:ignore:` immediately following the format-specific line-comment token.
+The format for these comments is `trivy:ignore:` immediately following the format-specific line-comment token. You can add multiple ignores on the same comment line.
For example, to filter a Vulnerability ID "AVD-GCP-0051" in a Terraform HCL file:
@@ -515,4 +508,14 @@ resource "google_container_cluster" "one_off_test" {
}
```
+For example, to filter vulnerabilities "AVD-GCP-0051" and "AVD-GCP-0053" in a Terraform HCL file:
+
+```terraform
+#trivy:ignore:AVD-GCP-0051 trivy:ignore:AVD-GCP-0053
+resource "google_container_cluster" "one_off_test" {
+ name = var.cluster_name
+ location = var.region
+}
+```
+
[^1]: license name is used as id for `.trivyignore.yaml` files
diff --git a/docs/docs/coverage/language/golang.md b/docs/docs/coverage/language/golang.md
index 31796bf531f8..54bebfdc4185 100644
--- a/docs/docs/coverage/language/golang.md
+++ b/docs/docs/coverage/language/golang.md
@@ -68,7 +68,7 @@ If there is a Go binary in your container image, Trivy automatically finds and s
Also, you can scan your local binaries.
```
-$ trivy fs ./your_binary
+$ trivy rootfs ./your_binary
```
!!! note
diff --git a/docs/docs/coverage/language/java.md b/docs/docs/coverage/language/java.md
index cf76d1ca5471..4043fc7e188f 100644
--- a/docs/docs/coverage/language/java.md
+++ b/docs/docs/coverage/language/java.md
@@ -11,11 +11,11 @@ Each artifact supports the following scanners:
The following table provides an outline of the features Trivy offers.
-| Artifact | Internet access | Dev dependencies | [Dependency graph][dependency-graph] |
-|------------------|:---------------------:|:----------------:|:------------------------------------:|
-| JAR/WAR/PAR/EAR | Trivy Java DB | Include | - |
-| pom.xml | Maven repository [^1] | Exclude | ✓ |
-| *gradle.lockfile | - | Exclude | - |
+| Artifact | Internet access | Dev dependencies | [Dependency graph][dependency-graph] | Position |
+|------------------|:---------------------:|:----------------:|:------------------------------------:|:--------:|
+| JAR/WAR/PAR/EAR | Trivy Java DB | Include | - | - |
+| pom.xml | Maven repository [^1] | Exclude | ✓ | ✓[^7] |
+| *gradle.lockfile | - | Exclude | - | - |
These may be enabled or disabled depending on the target.
See [here](./index.md) for the detail.
@@ -46,7 +46,7 @@ If your machine doesn't have the necessary files - Trivy tries to find the infor
!!! Note
Trivy only takes information about packages. We don't take a list of vulnerabilities for packages from the `maven repository`.
- Information about data sources for Java you can see [here](../../scanner/vulnerability.md#data-sources_1).
+ Information about data sources for Java you can see [here](../../scanner/vulnerability.md#data-sources-1).
You can disable connecting to the maven repository with the `--offline-scan` flag.
The `--offline-scan` flag does not affect the Trivy database.
@@ -67,5 +67,6 @@ It doesn't require the internet access.
[^4]: e.g. when parent pom.xml file has `../pom.xml` path
[^5]: When you use dependency path in `relativePath` field in pom.xml file
[^6]: `/Users//.m2/repository` (for Linux and Mac) and `C:/Users//.m2/repository` (for Windows) by default
+[^7]: To avoid confusion, Trivy only finds locations for direct dependencies from the base pom.xml file.
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
\ No newline at end of file
diff --git a/docs/docs/coverage/language/nodejs.md b/docs/docs/coverage/language/nodejs.md
index 393491b34f46..c371a1117178 100644
--- a/docs/docs/coverage/language/nodejs.md
+++ b/docs/docs/coverage/language/nodejs.md
@@ -1,14 +1,15 @@
# Node.js
-Trivy supports three types of Node.js package managers: `npm`, `Yarn` and `pnpm`.
+Trivy supports four types of Node.js package managers: `npm`, `Yarn`, `pnpm` and `Bun`[^1].
The following scanners are supported.
-| Artifact | SBOM | Vulnerability | License |
-| -------- | :---: | :-----------: | :-----: |
-| npm | ✓ | ✓ | ✓ |
-| Yarn | ✓ | ✓ | ✓ |
-| pnpm | ✓ | ✓ | - |
+| Artifact | SBOM | Vulnerability | License |
+|----------|:----:|:-------------:|:-------:|
+| npm | ✓ | ✓ | ✓ |
+| Yarn | ✓ | ✓ | ✓ |
+| pnpm | ✓ | ✓ | - |
+| Bun | ✓ | ✓ | ✓ |
The following table provides an outline of the features Trivy offers.
@@ -17,11 +18,12 @@ The following table provides an outline of the features Trivy offers.
| npm | package-lock.json | ✓ | [Excluded](#npm) | ✓ | ✓ |
| Yarn | yarn.lock | ✓ | [Excluded](#yarn) | ✓ | ✓ |
| pnpm | pnpm-lock.yaml | ✓ | Excluded | ✓ | - |
+| Bun | yarn.lock | ✓ | [Excluded](#yarn) | ✓ | ✓ |
In addition, Trivy scans installed packages with `package.json`.
| File | Dependency graph | Position | License |
-| ------------ | :--------------: | :------: | :-----: |
+|--------------|:----------------:|:--------:|:-------:|
| package.json | - | - | ✅ |
These may be enabled or disabled depending on the target.
@@ -53,6 +55,12 @@ By default, Trivy doesn't report development dependencies. Use the `--include-de
### pnpm
Trivy parses `pnpm-lock.yaml`, then finds production dependencies and builds a [tree][dependency-graph] of dependencies with vulnerabilities.
+### Bun
+Trivy supports scanning `yarn.lock` files generated by [Bun](https://bun.sh/docs/install/lockfile#how-do-i-inspect-bun-s-lockfile). You can use the command `bun install -y` to generate a Yarn-compatible `yarn.lock`.
+
+!!! note
+ `bun.lockb` is not supported.
+
## Packages
Trivy parses the manifest files of installed packages in container image scanning and so on.
@@ -60,4 +68,6 @@ Trivy parses the manifest files of installed packages in container image scannin
Trivy searches for `package.json` files under `node_modules` and identifies installed packages.
It only extracts package names, versions and licenses for those packages.
-[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
\ No newline at end of file
+[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
+
+[^1]: [yarn.lock](#bun) must be generated
diff --git a/docs/docs/coverage/os/index.md b/docs/docs/coverage/os/index.md
index 55e303c48521..e04a452fc4d3 100644
--- a/docs/docs/coverage/os/index.md
+++ b/docs/docs/coverage/os/index.md
@@ -11,7 +11,7 @@ Trivy supports operating systems for
| OS | Supported Versions | Package Managers |
|-----------------------------------------------|-------------------------------------|------------------|
-| [Alpine Linux](alpine.md) | 2.2 - 2.7, 3.0 - 3.18, edge | apk |
+| [Alpine Linux](alpine.md) | 2.2 - 2.7, 3.0 - 3.19, edge | apk |
| [Wolfi Linux](wolfi.md) | (n/a) | apk |
| [Chainguard](chainguard.md) | (n/a) | apk |
| [Red Hat Enterprise Linux](rhel.md) | 6, 7, 8 | dnf/yum/rpm |
@@ -42,4 +42,4 @@ Each page gives more details.
[sbom]: ../../supply-chain/sbom.md
[vuln]: ../../scanner/vulnerability.md
-[license]: ../../scanner/license.md
\ No newline at end of file
+[license]: ../../scanner/license.md
diff --git a/docs/docs/references/configuration/cli/trivy_filesystem.md b/docs/docs/references/configuration/cli/trivy_filesystem.md
index c09c46f69575..c34288188900 100644
--- a/docs/docs/references/configuration/cli/trivy_filesystem.md
+++ b/docs/docs/references/configuration/cli/trivy_filesystem.md
@@ -87,6 +87,7 @@ trivy filesystem [flags] PATH
--token-header string specify a header name for token in client/server mode (default "Trivy-Token")
--trace enable more verbose trace output for custom queries
--username strings username. Comma-separated usernames allowed.
+ --vex string [EXPERIMENTAL] file path to VEX
--vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])
```
diff --git a/docs/docs/references/configuration/cli/trivy_image.md b/docs/docs/references/configuration/cli/trivy_image.md
index c08206a51a5b..f016a7fff185 100644
--- a/docs/docs/references/configuration/cli/trivy_image.md
+++ b/docs/docs/references/configuration/cli/trivy_image.md
@@ -106,6 +106,7 @@ trivy image [flags] IMAGE_NAME
--token-header string specify a header name for token in client/server mode (default "Trivy-Token")
--trace enable more verbose trace output for custom queries
--username strings username. Comma-separated usernames allowed.
+ --vex string [EXPERIMENTAL] file path to VEX
--vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])
```
diff --git a/docs/docs/references/configuration/cli/trivy_kubernetes.md b/docs/docs/references/configuration/cli/trivy_kubernetes.md
index 9599ca493d84..00657886c681 100644
--- a/docs/docs/references/configuration/cli/trivy_kubernetes.md
+++ b/docs/docs/references/configuration/cli/trivy_kubernetes.md
@@ -28,6 +28,7 @@ trivy kubernetes [flags] { cluster | all | specific resources like kubectl. eg:
```
-A, --all-namespaces fetch resources from all cluster namespaces
+ --burst int specify the maximum burst for throttle (default 10)
--cache-backend string cache backend (e.g. redis://localhost:6379) (default "fs")
--cache-ttl duration cache TTL when using redis as cache backend
--clear-cache clear image caches without scanning
@@ -72,6 +73,7 @@ trivy kubernetes [flags] { cluster | all | specific resources like kubectl. eg:
--password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons.
--policy-bundle-repository string OCI registry URL to retrieve policy bundle from (default "ghcr.io/aquasecurity/trivy-policies:0")
--policy-namespaces strings Rego namespaces
+ --qps float specify the maximum QPS to the master from this client (default 5)
--redis-ca string redis ca file location, if using redis as cache backend
--redis-cert string redis certificate file location, if using redis as cache backend
--redis-key string redis key file location, if using redis as cache backend
@@ -95,6 +97,7 @@ trivy kubernetes [flags] { cluster | all | specific resources like kubectl. eg:
--tolerations strings specify node-collector job tolerations (example: key1=value1:NoExecute,key2=value2:NoSchedule)
--trace enable more verbose trace output for custom queries
--username strings username. Comma-separated usernames allowed.
+ --vex string [EXPERIMENTAL] file path to VEX
--vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])
```
diff --git a/docs/docs/references/configuration/cli/trivy_repository.md b/docs/docs/references/configuration/cli/trivy_repository.md
index 4f2a9f65d30b..b21ffd326db0 100644
--- a/docs/docs/references/configuration/cli/trivy_repository.md
+++ b/docs/docs/references/configuration/cli/trivy_repository.md
@@ -87,6 +87,7 @@ trivy repository [flags] (REPO_PATH | REPO_URL)
--token-header string specify a header name for token in client/server mode (default "Trivy-Token")
--trace enable more verbose trace output for custom queries
--username strings username. Comma-separated usernames allowed.
+ --vex string [EXPERIMENTAL] file path to VEX
--vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])
```
diff --git a/docs/docs/references/configuration/cli/trivy_rootfs.md b/docs/docs/references/configuration/cli/trivy_rootfs.md
index aaa120285021..47e9a434f075 100644
--- a/docs/docs/references/configuration/cli/trivy_rootfs.md
+++ b/docs/docs/references/configuration/cli/trivy_rootfs.md
@@ -88,6 +88,7 @@ trivy rootfs [flags] ROOTDIR
--token-header string specify a header name for token in client/server mode (default "Trivy-Token")
--trace enable more verbose trace output for custom queries
--username strings username. Comma-separated usernames allowed.
+ --vex string [EXPERIMENTAL] file path to VEX
--vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])
```
diff --git a/docs/docs/references/configuration/cli/trivy_vm.md b/docs/docs/references/configuration/cli/trivy_vm.md
index 2b004b6992e9..3c4d8c06ff7d 100644
--- a/docs/docs/references/configuration/cli/trivy_vm.md
+++ b/docs/docs/references/configuration/cli/trivy_vm.md
@@ -75,6 +75,7 @@ trivy vm [flags] VM_IMAGE
--tf-exclude-downloaded-modules exclude misconfigurations for downloaded terraform modules
--token string for authentication in client/server mode
--token-header string specify a header name for token in client/server mode (default "Trivy-Token")
+ --vex string [EXPERIMENTAL] file path to VEX
--vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])
```
diff --git a/docs/docs/references/troubleshooting.md b/docs/docs/references/troubleshooting.md
index 9fc67f8caf4c..fcdb97bb8a61 100644
--- a/docs/docs/references/troubleshooting.md
+++ b/docs/docs/references/troubleshooting.md
@@ -12,6 +12,61 @@
Your scan may time out. Java takes a particularly long time to scan. Try increasing the value of the ---timeout option such as `--timeout 15m`.
+### Unable to initialize an image scanner
+
+!!! error
+ ```bash
+ $ trivy image ...
+ ...
+ 2024-01-19T08:15:33.288Z FATAL image scan error: scan error: unable to initialize a scanner: unable to initialize an image scanner: 4 errors occurred:
+ * docker error: unable to inspect the image (ContainerImageName): Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
+ * containerd error: containerd socket not found: /run/containerd/containerd.sock
+ * podman error: unable to initialize Podman client: no podman socket found: stat podman/podman.sock: no such file or directory
+ * remote error: GET https://index.docker.io/v2/ContainerImageName: MANIFEST_UNKNOWN: manifest unknown; unknown tag=0.1
+ ```
+
+It means Trivy is unable to find the container image in the following places:
+
+* Docker Engine
+* containerd
+* Podman
+* A remote registry
+
+Please see error messages for details of each error.
+
+Common mistakes include the following, depending on where you are pulling images from:
+
+#### Common
+- Typos in the image name
+ - Common mistake :)
+- Forgetting to specify the registry
+ - By default, it is considered to be Docker Hub ( `index.docker.io` ).
+
+#### Docker Engine
+- Incorrect Docker host
+ - If the Docker daemon's socket path is not `/var/run/docker.sock`, you need to specify the `--docker-host` flag or the `DOCKER_HOST` environment variable.
+ The same applies when using TCP; you must specify the correct host address.
+
+#### containerd
+- Incorrect containerd address
+ - If you are using a non-default path, you need to specify the `CONTAINERD_ADDRESS` environment variable.
+ Please refer to [this documentation](../target/container_image.md#containerd).
+- Incorrect namespace
+ - If you are using a non-default namespace, you need to specify the `CONTAINERD_NAMESPACE` environment variable.
+ Please refer to [this documentation](../target/container_image.md#containerd).
+ -
+#### Podman
+- Podman socket configuration
+ - You need to enable the Podman socket. Please refer to [this documentation](../target/container_image.md#podman).
+
+#### Container Registry
+- Unauthenticated
+ - If you are using a private container registry, you need to authenticate. Please refer to [this documentation](../advanced/private-registries/index.md).
+- Using a proxy
+ - If you are using a proxy within your network, you need to correctly set the `HTTP_PROXY`, `HTTPS_PROXY`, etc., environment variables.
+- Use of a self-signed certificate in the registry
+ - Because certificate verification will fail, you need to either trust that certificate or use the `--insecure` flag (not recommended in production).
+
### Certification
!!! error
diff --git a/docs/docs/supply-chain/attestation/vuln.md b/docs/docs/supply-chain/attestation/vuln.md
index c17164f0f30b..b1484387266a 100644
--- a/docs/docs/supply-chain/attestation/vuln.md
+++ b/docs/docs/supply-chain/attestation/vuln.md
@@ -179,13 +179,14 @@ You can use Cosign to sign without keys by authenticating with an OpenID Connect
```
$ trivy image --format cosign-vuln -o vuln.json
-$ COSIGN_EXPERIMENTAL=1 cosign attest --type vuln --predicate vuln.json
+$ cosign attest --type vuln --predicate vuln.json
```
+This will provide a certificate in the output section.
-You can verify attestations.
+You can verify attestations:
```
-$ COSIGN_EXPERIMENTAL=1 cosign verify-attestation --type vuln
+$ cosign verify-attestation --certificate=path-to-the-certificate --type vuln --certificate-identity Email-used-to-sign --certificate-oidc-issuer='the-issuer-used'
```
[vuln-attest-spec]: https://github.com/sigstore/cosign/blob/95b74db89941e8ec85e768f639efd4d948db06cd/specs/COSIGN_VULN_ATTESTATION_SPEC.md
\ No newline at end of file
diff --git a/docs/docs/supply-chain/sbom.md b/docs/docs/supply-chain/sbom.md
index 7091eb6ed2ba..cb3a68c9d8f3 100644
--- a/docs/docs/supply-chain/sbom.md
+++ b/docs/docs/supply-chain/sbom.md
@@ -217,13 +217,16 @@ $ cat result.json | jq .
"version": 1,
"metadata": {
"timestamp": "2022-02-22T15:11:40.270597Z",
- "tools": [
- {
- "vendor": "aquasecurity",
- "name": "trivy",
- "version": "dev"
- }
- ],
+ "tools": {
+ "components": [
+ {
+ "type": "application",
+ "group": "aquasecurity",
+ "name": "trivy",
+ "version": "dev"
+ }
+ ]
+ },
"component": {
"bom-ref": "pkg:oci/alpine@sha256:21a3deaa0d32a8057914f36584b5288d2e5ecc984380bc0118285c70fa8c9300?repository_url=index.docker.io%2Flibrary%2Falpine&arch=amd64",
"type": "container",
diff --git a/docs/docs/supply-chain/vex.md b/docs/docs/supply-chain/vex.md
index a0b46fbbc1f0..59f3c5b97353 100644
--- a/docs/docs/supply-chain/vex.md
+++ b/docs/docs/supply-chain/vex.md
@@ -4,15 +4,25 @@
This feature might change without preserving backwards compatibility.
Trivy supports filtering detected vulnerabilities using [the Vulnerability Exploitability Exchange (VEX)](https://www.ntia.gov/files/ntia/publications/vex_one-page_summary.pdf), a standardized format for sharing and exchanging information about vulnerabilities.
-By providing VEX alongside the Software Bill of Materials (SBOM) during scanning, it is possible to filter vulnerabilities based on their status.
-Currently, Trivy supports the following two formats:
+By providing VEX during scanning, it is possible to filter vulnerabilities based on their status.
+Currently, Trivy supports the following three formats:
- [CycloneDX](https://cyclonedx.org/capabilities/vex/)
- [OpenVEX](https://github.com/openvex/spec)
+- [CSAF](https://oasis-open.github.io/csaf-documentation/specification.html)
This is still an experimental implementation, with only minimal functionality added.
## CycloneDX
+| Target | Supported |
+|:---------------:|:---------:|
+| Container Image | |
+| Filesystem | |
+| Code Repository | |
+| VM Image | |
+| Kubernetes | |
+| SBOM | ✅ |
+
There are [two VEX formats](https://cyclonedx.org/capabilities/vex/) for CycloneDX:
- Independent BOM and VEX BOM
@@ -27,7 +37,7 @@ The following steps are required:
2. Create a VEX based on the SBOM generated in step 1
3. Provide the VEX when scanning the CycloneDX SBOM
-### Generating the SBOM
+### Generate the SBOM
You can generate a CycloneDX SBOM with Trivy as follows:
```shell
@@ -116,23 +126,24 @@ Total: 1 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 0, CRITICAL: 0)
CVE-2020-8911 is no longer shown as it is filtered out according to the given CycloneDX VEX document.
## OpenVEX
+| Target | Supported |
+|:---------------:|:---------:|
+| Container Image | ✅ |
+| Filesystem | ✅ |
+| Code Repository | ✅ |
+| VM Image | ✅ |
+| Kubernetes | ✅ |
+| SBOM | ✅ |
+
Trivy also supports [OpenVEX][openvex] that is designed to be minimal, compliant, interoperable, and embeddable.
-Since OpenVEX aims to be SBOM format agnostic, both CycloneDX and SPDX formats are available for use as input SBOMs in Trivy.
+OpenVEX can be used in all Trivy targets, unlike CycloneDX VEX.
The following steps are required:
-1. Generate a SBOM (CycloneDX or SPDX)
-2. Create a VEX based on the SBOM generated in step 1
-3. Provide the VEX when scanning the SBOM
+1. Create a VEX document
+2. Provide the VEX when scanning your target
-### Generating the SBOM
-You can generate a CycloneDX or SPDX SBOM with Trivy as follows:
-
-```shell
-$ trivy image --format spdx-json --output debian11.spdx.json debian:11
-```
-
-### Create the VEX
+### Create the VEX document
Please see also [the example](https://github.com/openvex/examples).
In Trivy, [the Package URL (PURL)][purl] is used as the product identifier.
@@ -166,11 +177,11 @@ In the above example, PURLs, located in `packages.externalRefs.referenceLocator`
`pkg:deb/debian/curl@7.50.3-1` in OpenVEX matches `pkg:deb/debian/curl@7.50.3-1?arch=i386`,
while `pkg:deb/debian/curl@7.50.3-1?arch=amd64` does not match `pkg:deb/debian/curl@7.50.3-1?arch=i386`.
-### Scan SBOM with VEX
-Provide the VEX when scanning the SBOM.
+### Scan with VEX
+Provide the VEX when scanning your target.
```
-$ trivy sbom debian11.spdx.json --vex debian11.openvex
+$ trivy image debian:11 --vex debian11.openvex
...
2023-04-26T17:56:05.358+0300 INFO Filtered out the detected vulnerability {"VEX format": "OpenVEX", "vulnerability-id": "CVE-2019-8457", "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path"}
@@ -181,5 +192,187 @@ Total: 80 (UNKNOWN: 0, LOW: 58, MEDIUM: 6, HIGH: 16, CRITICAL: 0)
CVE-2019-8457 is no longer shown as it is filtered out according to the given OpenVEX document.
+
+## CSAF
+| Target | Supported |
+|:---------------:|:---------:|
+| Container Image | ✅ |
+| Filesystem | ✅ |
+| Code Repository | ✅ |
+| VM Image | ✅ |
+| Kubernetes | ✅ |
+| SBOM | ✅ |
+
+Trivy also supports [CSAF][csaf] format for VEX.
+Since CSAF aims to be SBOM format agnostic, both CycloneDX and SPDX formats are available for use as input SBOMs in Trivy.
+
+The following steps are required:
+
+1. Create a CSAF document
+2. Provide the CSAF when scanning your target
+
+
+### Create the CSAF document
+Create a CSAF document in JSON format as follows:
+
+```
+$ cat < debian11.vex.csaf
+{
+ "document": {
+ "category": "csaf_vex",
+ "csaf_version": "2.0",
+ "notes": [
+ {
+ "category": "summary",
+ "text": "Example Company VEX document. Unofficial content for demonstration purposes only.",
+ "title": "Author comment"
+ }
+ ],
+ "publisher": {
+ "category": "vendor",
+ "name": "Example Company ProductCERT",
+ "namespace": "https://psirt.example.com"
+ },
+ "title": "AquaSecurity example VEX document",
+ "tracking": {
+ "current_release_date": "2024-01-01T11:00:00.000Z",
+ "generator": {
+ "date": "2024-01-01T11:00:00.000Z",
+ "engine": {
+ "name": "Secvisogram",
+ "version": "1.11.0"
+ }
+ },
+ "id": "2024-EVD-UC-01-A-001",
+ "initial_release_date": "2024-01-01T11:00:00.000Z",
+ "revision_history": [
+ {
+ "date": "2024-01-01T11:00:00.000Z",
+ "number": "1",
+ "summary": "Initial version."
+ }
+ ],
+ "status": "final",
+ "version": "1"
+ }
+ },
+ "product_tree": {
+ "branches": [
+ {
+ "branches": [
+ {
+ "branches": [
+ {
+ "category": "product_version",
+ "name": "5.3",
+ "product": {
+ "name": "Database Libraries 5.3",
+ "product_id": "LIBDB-5328",
+ "product_identification_helper": {
+ "purl": "pkg:deb/debian/libdb5.3@5.3.28%2Bdfsg1-0.8?arch=amd64\u0026distro=debian-11.8"
+ }
+ }
+ }
+ ],
+ "category": "product_name",
+ "name": "Database Libraries"
+ }
+ ],
+ "category": "vendor",
+ "name": "Debian"
+ }
+ ]
+ },
+ "vulnerabilities": [
+ {
+ "cve": "CVE-2019-8457",
+ "notes": [
+ {
+ "category": "description",
+ "text": "SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.",
+ "title": "CVE description"
+ }
+ ],
+ "product_status": {
+ "known_not_affected": [
+ "LIBDB-5328"
+ ]
+ },
+ "threats": [
+ {
+ "category": "impact",
+ "details": "Vulnerable code not in execute path.",
+ "product_ids": [
+ "LIBDB-5328"
+ ]
+ }
+ ]
+ }
+ ]
+}
+EOF
+```
+
+### Scan with CSAF VEX
+Provide the CSAF document when scanning your target.
+
+```console
+$ trivy image debian:11 --vex debian11.vex.csaf
+...
+2024-01-02T10:28:26.704+0100 INFO Filtered out the detected vulnerability {"VEX format": "CSAF", "vulnerability-id": "CVE-2019-8457", "status": "not_affected"}
+
+debian11.spdx.json (debian 11.6)
+================================
+Total: 80 (UNKNOWN: 0, LOW: 58, MEDIUM: 6, HIGH: 16, CRITICAL: 0)
+```
+
+CVE-2019-8457 is no longer shown as it is filtered out according to the given CSAF document.
+
+## Appendix
+### PURL matching
+In the context of VEX, Package URLs (PURLs) are utilized to identify specific software packages and their versions.
+The PURL matching specification outlines how PURLs are interpreted for vulnerability exception processing, ensuring precise identification and broad coverage of software packages.
+
+!!! note
+ The following PURL matching rules are not formally defined within the current official PURL specification.
+ Instead, they represent [a community consensus][purl-matching] on how to interpret PURLs.
+
+Below are the key aspects of the PURL matching rules:
+
+#### Matching Without Version
+A PURL without a specified version (e.g., `pkg:maven/com.google.guava/guava`) matches all versions of that package.
+This rule simplifies the application of vulnerability exceptions to all versions of a package.
+
+**Example**: `pkg:maven/com.google.guava/guava` matches:
+
+- All versions of `guava`, such as `com.google.guava:guava:24.1.1`, `com.google.guava:guava:30.0`.
+
+#### Matching Without Qualifiers
+A PURL without any qualifiers (e.g., `pkg:maven/com.google.guava/guava@24.1.1`) matches any variation of that package, irrespective of qualifiers.
+This approach ensures broad matching capabilities, covering all architectural or platform-specific variations of a package version.
+
+**Example**: `pkg:maven/com.google.guava/guava@24.1.1` matches:
+
+- `pkg:maven/com.google.guava/guava@24.1.1?classifier=x86`
+- `pkg:maven/com.google.guava/guava@24.1.1?type=pom`
+
+#### Matching With Specific Qualifiers
+A PURL that includes specific qualifiers (e.g., `pkg:maven/com.google.guava/guava@24.1.1?classifier=x86`) matches only those package versions that include the same qualifiers.
+
+**Example**: `pkg:maven/com.google.guava/guava@24.1.1?classifier=x86` matches:
+
+- `pkg:maven/com.google.guava/guava@24.1.1?classifier=x86&type=dll`
+ - Extra qualifiers (e.g., `type=dll`) are ignored.
+
+does not match:
+
+- `pkg:maven/com.google.guava/guava@24.1.1`
+ - `classifier=x86` is missing.
+- `pkg:maven/com.google.guava/guava@24.1.1?classifier=sources`
+ - `classifier` must have the same value.
+
+
+[csaf]: https://oasis-open.github.io/csaf-documentation/specification.html
[openvex]: https://github.com/openvex/spec
-[purl]: https://github.com/package-url/purl-spec
\ No newline at end of file
+[purl]: https://github.com/package-url/purl-spec
+[purl-matching]: https://github.com/openvex/spec/issues/27
diff --git a/docs/ecosystem/security.md b/docs/ecosystem/reporting.md
similarity index 54%
rename from docs/ecosystem/security.md
rename to docs/ecosystem/reporting.md
index e5f99ac63c67..847205a00c34 100644
--- a/docs/ecosystem/security.md
+++ b/docs/ecosystem/reporting.md
@@ -1,4 +1,4 @@
-# Security Management
+# Reporting
## SonarQube (Community)
A Trivy plugin that converts JSON report to SonarQube [generic issues format](https://docs.sonarqube.org/9.6/analyzing-source-code/importing-external-issues/generic-issue-import-format/).
@@ -9,3 +9,13 @@ A Trivy plugin that converts JSON report to SonarQube [generic issues format](ht
DefectDojo can parse Trivy JSON reports. The parser supports deduplication and auto-close features.
👉 Get it at:
+
+## Scan2html (Community)
+A Trivy plugin that scans and outputs the results to an interactive html file.
+
+👉 Get it at:
+
+## Trivy-Streamlit (Community)
+Trivy-Streamlit is a Streamlit application that allows you to quickly parse the results from a Trivy JSON report.
+
+👉 Get it at:
diff --git a/docs/imgs/logo-horizontal.svg b/docs/imgs/logo-horizontal.svg
index fb169f58c8b8..9cdd1b594dd9 100644
--- a/docs/imgs/logo-horizontal.svg
+++ b/docs/imgs/logo-horizontal.svg
@@ -1,32 +1,85 @@
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/docs/imgs/logo-white.svg b/docs/imgs/logo-white.svg
index 4aa8d97280ad..f546d23b3358 100644
--- a/docs/imgs/logo-white.svg
+++ b/docs/imgs/logo-white.svg
@@ -1,42 +1,3124 @@
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+]>
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/docs/imgs/logo.png b/docs/imgs/logo.png
index 3048e8ce67f2..08943b5accaa 100644
Binary files a/docs/imgs/logo.png and b/docs/imgs/logo.png differ
diff --git a/docs/tutorials/kubernetes/kyverno.md b/docs/tutorials/kubernetes/kyverno.md
index 4dc9633212a2..f2e9d12006a7 100644
--- a/docs/tutorials/kubernetes/kyverno.md
+++ b/docs/tutorials/kubernetes/kyverno.md
@@ -7,8 +7,9 @@ This tutorial details
- Verify the container image has an attestation with Kyverno
### Prerequisites
-1. [Attestation of the vulnerability scan uploaded][vuln-attestation]
-2. A running Kubernetes cluster that kubectl is connected to
+1. A running Kubernetes cluster that kubectl is connected to
+2. A Container image signed with Cosign and an attestation generated for a Trivy Vulnerability scan.
+ [Follow this tutorial for more information.][vuln-attestation]
### Kyverno Policy to check attestation
@@ -24,11 +25,12 @@ kind: ClusterPolicy
metadata:
name: check-vulnerabilities
spec:
- validationFailureAction: enforce
- webhookTimeoutSeconds: 10
+ validationFailureAction: Enforce
+ background: false
+ webhookTimeoutSeconds: 30
failurePolicy: Fail
rules:
- - name: not-older-than-one-week
+ - name: checking-vulnerability-scan-not-older-than-one-hour
match:
any:
- resources:
@@ -36,14 +38,23 @@ spec:
- Pod
verifyImages:
- imageReferences:
- - "CONTAINER-REGISTRY/*:*"
+ - "*"
attestations:
- - predicateType: cosign.sigstore.dev/attestation/vuln/v1
+ - type: https://cosign.sigstore.dev/attestation/vuln/v1
conditions:
- all:
- - key: "{{ time_since('','{{metadata.scanFinishedOn}}','') }}"
+ - key: "{{ time_since('','{{ metadata.scanFinishedOn }}', '') }}"
operator: LessThanOrEquals
- value: "168h"
+ value: "1h"
+ attestors:
+ - count: 1
+ entries:
+ - keys:
+ publicKeys: |-
+ -----BEGIN PUBLIC KEY-----
+ abc
+ xyz
+ -----END PUBLIC KEY-----
```
{% endraw %}
@@ -57,38 +68,12 @@ Next, apply the above policy:
kubectl apply -f vuln-attestation.yaml
```
-To ensure that the policy worked, we can deploye an example deployment file with our container image:
+To ensure that the policy worked, we can deploy an example Kubernetes Pod with our container image:
-deployment.yaml
```
-apiVersion: apps/v1
-kind: Deployment
-metadata:
- name: cns-website
- namespace: app
-spec:
- replicas: 2
- selector:
- matchLabels:
- run: cns-website
- template:
- metadata:
- labels:
- run: cns-website
- spec:
- containers:
- - name: cns-website
- image: docker.io/anaisurlichs/cns-website:0.0.6
- ports:
- - containerPort: 80
- imagePullPolicy: Always
- resources:
- limits:
- memory: 512Mi
- cpu: 200m
- securityContext:
- allowPrivilegeEscalation: false
+kubectl run app-signed --image= docker.io/anaisurlichs/signed-example@sha256:c5911ac313e0be82a740bd726dc290e655800a9588424ba4e0558c705d1287fdÂ
```
+Note that the image is based on the [signing tutorial.][vuln-attestation]
Once we apply the deployment, it should pass since our attestation is available:
```
@@ -98,7 +83,7 @@ deployment.apps/cns-website created
However, if we try to deploy any other container image, our deployment will fail. We can verify this by replacing the image referenced in the deployment with `docker.io/anaisurlichs/cns-website:0.0.5` and applying the deployment:
```
-kubectl apply -f deployment-two.yaml
+kubectl run app-unsigned --image=docker.io/anaisurlichs/cns-website:0.1.1Â
Resource: "apps/v1, Resource=deployments", GroupVersionKind: "apps/v1, Kind=Deployment"
Name: "cns-website", Namespace: "app"
diff --git a/docs/tutorials/signing/vuln-attestation.md b/docs/tutorials/signing/vuln-attestation.md
index f0721c9d3223..2e4b487306c6 100644
--- a/docs/tutorials/signing/vuln-attestation.md
+++ b/docs/tutorials/signing/vuln-attestation.md
@@ -1,36 +1,145 @@
# Vulnerability Scan Record Attestation
-This tutorial details
+This tutorial details how to
-- Scan your container image for vulnerabilities
-- Generate an attestation with Cosign
+- Scan container images for vulnerabilities
+- Generate an attestation, using Cosign, with and without generating a separate key pair
#### Prerequisites
-1. Trivy CLI installed
-2. Cosign installed
+1. [Trivy CLI](../../getting-started/installation.md) installed
+2. [Cosign CLI](https://docs.sigstore.dev/system_config/installation/) installed
+3. Ensure that you have access to a container image in a remote container registry that you own/within your account. In this tutorial, we will use DockerHub.
-#### Scan Container Image for vulnerabilities
+## Scan Container Image for vulnerabilities
Scan your container image for vulnerabilities and save the scan result to a scan.json file:
```
-trivy image --ignore-unfixed --format json --output scan.json anaisurlichs/cns-website:0.0.6
+trivy image --ignore-unfixed --format cosign-vuln --output scan.json DockerHubID/imagename:imagetag
```
-* --ignore-unfixed: Ensures that only the vulnerabilities are displayed that have a already a fix available
-* --output scan.json: The scan output is saved to a scan.json file instead of being displayed in the terminal.
+For example:
+```
+trivy image --ignore-unfixed --format cosign-vuln --output scan.json anaisurlichs/signed-example:0.1
+```
-Note: Replace the container image with the container image that you would like to scan.
+* `--ignore-unfixed`: Ensures only the vulnerabilities, which have a already a fix available, are displayed
+* `--output scan.json`: The scan output is saved to a scan.json file instead of being displayed in the terminal.
+
+Note: Replace the container image with the container image that you want to scan.
+
+## Option 1: Signing and Generating an attestation without new key pair
+
+#### Signing
+
+Sign the container image:
+```
+cosign sign DockerHubID/imagename@imageSHA
+```
+
+The `imageSHA` can be obtained through the following docker command:
+```
+docker image ls --digests
+```
+The SHA will be displayed next to the image name and tag.
+
+Note that it is better practice to sign the image SHA rather than the tag as the SHA will remain the same for the particular image that we have signed.
+
+For example:
+```
+cosign sign docker.io/anaisurlichs/signed-example@sha256:c5911ac313e0be82a740bd726dc290e655800a9588424ba4e0558c705d1287fd
+```
-#### Attestation of the vulnerability scan with Cosign
+#### Attestation
-The following command generates an attestation for the vulnerability scan and uploads it to our container image:
+The following command generates an attestation for the vulnerability scan and uploads it to the container image used:
```
-cosign attest --replace --predicate scan.json --type vuln anaisurlichs/cns-website:0.0.6
+cosign attest --predicate scan.json --type vuln docker.io/DockerHubID/imagename:imageSHA
+```
+
+For example:
+```
+cosign attest --predicate scan.json --type vuln docker.io/anaisurlichs/signed-example@sha256:c5911ac313e0be82a740bd726dc290e655800a9588424ba4e0558c705d1287fd
```
Note: Replace the container image with the container image that you would like to scan.
+Next, Sigstore will ask you to verify with an account -- Microsoft, GitHub, or Google.
+
+Once done, the user will be provided with a certificate in the terminal where they ran the command. Example certificate:
+```
+-----BEGIN CERTIFICATE-----
+MIIC1TCCAlygAwIBAgIUfSXI7xTWSLq4nuygd8YPuhPZlEswCgYIKoZIzj0EAwMw
+NzEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MR4wHAYDVQQDExVzaWdzdG9yZS1pbnRl
+cm1lZGlhdGUwHhcNMjQwMTExMTMzODUzWhcNMjQwMTExMTM0ODUzWjAAMFkwEwYH
+KoZIzj0CAQYIKoZIzj0DAQcDQgAETcUNnK76mfo9G3j1c7NN6Vcn6yQPDX5rd3QB
+unkHs1Uk59CWv3qm6sUyRNYaATs9zdHAZqLck8G4P/Pj7+GzCKOCAXswggF3MA4G
+........
+-----END CERTIFICATE-----
+```
+
+
+## Option 2: Signing and Generating an attestation with a new Cosign key pair
+
+To generate an attestation for the container image with a separate key pair, we can use Cosign to generate a new key pair:
+```
+cosign generate-key-pairÂ
+```
+
+This will generate a `cosign.key` and a `cosign.pub` file. The `cosign.key` file is your private key that should be kept confidential as it is used to sign artefacts. However, the `cosign.pub` file contains the information of the corresponding public key. This key can be used by third parties to verify the attestation -- basically that this person who claims to have signed the attestation actually is the one who signed it.
+
+#### Signing
+
+Sign the container image:
+```
+cosign sign --key cosign.key docker.io/anaisurlichs/signed-example@sha256:c5911ac313e0be82a740bd726dc290e655800a9588424ba4e0558c705d1287fd
+```
+
+#### Attestation
+
+To generate the attestation with the specific key pairs, run the following command:
+```
+cosign attest --key cosign.key --type vuln --predicate scan.json docker.io/anaisurlichs/signed-example@sha256:c5911ac313e0be82a740bd726dc290e655800a9588424ba4e0558c705d1287fdÂ
+```
+
+## Verify the attestation
+
+### Option 1 -- No separate key pair
+
+If you have not generated a key pair but received a certificate after the container image was signed, use the following command to verify the attestation:
+
+```
+cosign verify-attestation --type vuln --certificate-identity Email-used-to-sign --certificate-oidc-issuer='the-issuer-used' docker.io/DockerHubID/imagename:imageSHA
+```
+
+For example, the command could be like this:
+```
+cosign verify-attestation --type vuln --certificate-identity urlichsanais@gmail.com --certificate-oidc-issuer='https://github.com/login/oauth' anaisurlichs/signed-example@sha256:c5911ac313e0be82a740bd726dc290e655800a9588424ba4e0558c705d1287fd
+```
+
+### Option 2 -- Separate key pair
+
+If you have used a new cosign key pair, the attestation can be verified through the following command:
+```
+cosign verify-attestation --key cosign.pub --type vuln anaisurlichs/signed-example@sha256:c5911ac313e0be82a740bd726dc290e655800a9588424ba4e0558c705d1287fdÂ
+```
+
+
+Output
+
+The output should look similar to the following:
+```
+Verification for anaisurlichs/signed-example@sha256:c5911ac313e0be82a740bd726dc290e655800a9588424ba4e0558c705d1287fd --
+The following checks were performed on each of these signatures:
+ - The cosign claims were validated
+ - Existence of the claims in the transparency log was verified offline
+ - The signatures were verified against the specified public key
+{"payloadType":"application/vnd.in-toto+json","payload":
+```
+
+
+## More information
+
See [here][vuln-attestation] for more details.
[vuln-attestation]: ../../docs/supply-chain/attestation/vuln.md
\ No newline at end of file
diff --git a/go.mod b/go.mod
index ba284038c23f..e36c08e265dc 100644
--- a/go.mod
+++ b/go.mod
@@ -7,14 +7,14 @@ require (
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.9.0
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.4.0
github.com/BurntSushi/toml v1.3.2
- github.com/CycloneDX/cyclonedx-go v0.7.2
+ github.com/CycloneDX/cyclonedx-go v0.8.0
github.com/GoogleCloudPlatform/docker-credential-gcr v2.0.5+incompatible
github.com/Masterminds/sprig/v3 v3.2.3
github.com/NYTimes/gziphandler v1.1.1
github.com/alicebob/miniredis/v2 v2.31.0
github.com/aquasecurity/bolt-fixtures v0.0.0-20200903104109-d34e7f983986
- github.com/aquasecurity/defsec v0.93.2-0.20231208181342-318642ac6f08
- github.com/aquasecurity/go-dep-parser v0.0.0-20231120074854-8322cc2242bf
+ github.com/aquasecurity/defsec v0.94.1
+ github.com/aquasecurity/go-dep-parser v0.0.0-20240124102329-7be7d210a3d4
github.com/aquasecurity/go-gem-version v0.0.0-20201115065557-8eed6fe000ce
github.com/aquasecurity/go-npm-version v0.0.0-20201110091526-0b796d180798
github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46
@@ -23,24 +23,25 @@ require (
github.com/aquasecurity/table v1.8.0
github.com/aquasecurity/testdocker v0.0.0-20230111101738-e741bda259da
github.com/aquasecurity/tml v0.6.1
- github.com/aquasecurity/trivy-aws v0.5.0
+ github.com/aquasecurity/trivy-aws v0.7.1
github.com/aquasecurity/trivy-db v0.0.0-20231005141211-4fc651f7ac8d
- github.com/aquasecurity/trivy-iac v0.7.1
- github.com/aquasecurity/trivy-java-db v0.0.0-20230209231723-7cddb1406728
- github.com/aquasecurity/trivy-kubernetes v0.5.9-0.20231203080602-50a069120091
- github.com/aquasecurity/trivy-policies v0.6.1-0.20231120231532-f6f2330bf842
+ github.com/aquasecurity/trivy-iac v0.8.0
+ github.com/aquasecurity/trivy-java-db v0.0.0-20240109071736-184bd7481d48
+ github.com/aquasecurity/trivy-kubernetes v0.6.3-0.20240118072219-c433b06f98e1
+ github.com/aquasecurity/trivy-policies v0.8.0
github.com/aws/aws-sdk-go-v2 v1.24.1
- github.com/aws/aws-sdk-go-v2/config v1.25.11
- github.com/aws/aws-sdk-go-v2/credentials v1.16.9
- github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.90
- github.com/aws/aws-sdk-go-v2/service/ec2 v1.134.0
- github.com/aws/aws-sdk-go-v2/service/ecr v1.24.1
- github.com/aws/aws-sdk-go-v2/service/s3 v1.40.2
+ github.com/aws/aws-sdk-go-v2/config v1.26.3
+ github.com/aws/aws-sdk-go-v2/credentials v1.16.14
+ github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.15.11
+ github.com/aws/aws-sdk-go-v2/service/ec2 v1.142.0
+ github.com/aws/aws-sdk-go-v2/service/ecr v1.24.6
+ github.com/aws/aws-sdk-go-v2/service/s3 v1.48.0
github.com/aws/aws-sdk-go-v2/service/sts v1.26.7
- github.com/bmatcuk/doublestar/v4 v4.6.0
+ github.com/bmatcuk/doublestar/v4 v4.6.1
github.com/cenkalti/backoff v2.2.1+incompatible
github.com/cheggaaa/pb/v3 v3.1.4
github.com/containerd/containerd v1.7.11
+ github.com/csaf-poc/csaf_distribution/v3 v3.0.0
github.com/docker/docker v24.0.7+incompatible
github.com/docker/go-connections v0.4.0
github.com/fatih/color v1.15.0
@@ -67,8 +68,8 @@ require (
github.com/magefile/mage v1.15.0
github.com/mailru/easyjson v0.7.7
github.com/masahiro331/go-disk v0.0.0-20220919035250-c8da316f91ac
- github.com/masahiro331/go-ebs-file v0.0.0-20230228042409-005c81d4ae43
- github.com/masahiro331/go-ext4-filesystem v0.0.0-20230612143131-27ccd485b7a1
+ github.com/masahiro331/go-ebs-file v0.0.0-20240112135404-d5fbb1d46323
+ github.com/masahiro331/go-ext4-filesystem v0.0.0-20231208112839-4339555a0cd4
github.com/masahiro331/go-mvn-version v0.0.0-20210429150710-d3157d602a08
github.com/masahiro331/go-vmdk-parser v0.0.0-20221225061455-612096e4bbbd
github.com/masahiro331/go-xfs-filesystem v0.0.0-20230608043311-a335f4599b70
@@ -95,24 +96,24 @@ require (
github.com/spf13/pflag v1.0.5
github.com/spf13/viper v1.16.0
github.com/stretchr/testify v1.8.4
- github.com/testcontainers/testcontainers-go v0.26.0
+ github.com/testcontainers/testcontainers-go v0.27.0
github.com/testcontainers/testcontainers-go/modules/localstack v0.26.0
github.com/tetratelabs/wazero v1.2.1
github.com/twitchtv/twirp v8.1.2+incompatible
github.com/xeipuuv/gojsonschema v1.2.0
github.com/xlab/treeprint v1.2.0
- go.etcd.io/bbolt v1.3.7
+ go.etcd.io/bbolt v1.3.8
go.uber.org/zap v1.26.0
- golang.org/x/exp v0.0.0-20230522175609-2e198f4a06a1
+ golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa
golang.org/x/mod v0.14.0
- golang.org/x/sync v0.4.0
- golang.org/x/term v0.15.0
+ golang.org/x/sync v0.6.0
+ golang.org/x/term v0.16.0
golang.org/x/text v0.14.0
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2
google.golang.org/protobuf v1.32.0
gopkg.in/yaml.v3 v3.0.1
- k8s.io/api v0.28.4
- k8s.io/utils v0.0.0-20230406110748-d93618cff8a2
+ k8s.io/api v0.29.0
+ k8s.io/utils v0.0.0-20231127182322-b307cd553661
modernc.org/sqlite v1.28.0
)
@@ -131,11 +132,13 @@ require (
github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
github.com/Azure/go-autorest v14.2.0+incompatible // indirect
github.com/Azure/go-autorest/autorest v0.11.29 // indirect
- github.com/Azure/go-autorest/autorest/adal v0.9.22 // indirect
+ github.com/Azure/go-autorest/autorest/adal v0.9.23 // indirect
github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
github.com/Azure/go-autorest/logger v0.2.1 // indirect
github.com/Azure/go-autorest/tracing v0.6.0 // indirect
github.com/AzureAD/microsoft-authentication-library-for-go v1.1.1 // indirect
+ github.com/Intevation/gval v1.3.0 // indirect
+ github.com/Intevation/jsonpath v0.2.1 // indirect
github.com/MakeNowJust/heredoc v1.0.0 // indirect
github.com/Masterminds/goutils v1.1.1 // indirect
github.com/Masterminds/semver v1.5.0 // indirect
@@ -144,7 +147,7 @@ require (
github.com/Microsoft/go-winio v0.6.1 // indirect
github.com/Microsoft/hcsshim v0.11.4 // indirect
github.com/OneOfOne/xxhash v1.2.8 // indirect
- github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371 // indirect
+ github.com/ProtonMail/go-crypto v0.0.0-20230923063757-afb1ddc0824c // indirect
github.com/VividCortex/ewma v1.2.0 // indirect
github.com/agext/levenshtein v1.2.3 // indirect
github.com/agnivade/levenshtein v1.1.1 // indirect
@@ -155,52 +158,52 @@ require (
github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
- github.com/aws/aws-sdk-go v1.48.4 // indirect
- github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.14 // indirect
- github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.9 // indirect
+ github.com/aws/aws-sdk-go v1.49.21 // indirect
+ github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.5.4 // indirect
+ github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.10 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.10 // indirect
- github.com/aws/aws-sdk-go-v2/internal/ini v1.7.1 // indirect
- github.com/aws/aws-sdk-go-v2/internal/v4a v1.1.6 // indirect
- github.com/aws/aws-sdk-go-v2/service/accessanalyzer v1.21.1 // indirect
- github.com/aws/aws-sdk-go-v2/service/apigateway v1.18.0 // indirect
- github.com/aws/aws-sdk-go-v2/service/apigatewayv2 v1.14.5 // indirect
- github.com/aws/aws-sdk-go-v2/service/athena v1.31.6 // indirect
- github.com/aws/aws-sdk-go-v2/service/cloudfront v1.28.5 // indirect
- github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.29.1 // indirect
- github.com/aws/aws-sdk-go-v2/service/cloudwatch v1.27.7 // indirect
- github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.23.5 // indirect
- github.com/aws/aws-sdk-go-v2/service/codebuild v1.22.0 // indirect
- github.com/aws/aws-sdk-go-v2/service/docdb v1.23.5 // indirect
- github.com/aws/aws-sdk-go-v2/service/dynamodb v1.21.5 // indirect
- github.com/aws/aws-sdk-go-v2/service/ebs v1.18.1 // indirect
- github.com/aws/aws-sdk-go-v2/service/ecs v1.30.1 // indirect
- github.com/aws/aws-sdk-go-v2/service/efs v1.21.6 // indirect
- github.com/aws/aws-sdk-go-v2/service/eks v1.29.5 // indirect
- github.com/aws/aws-sdk-go-v2/service/elasticache v1.29.3 // indirect
- github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.21.3 // indirect
- github.com/aws/aws-sdk-go-v2/service/elasticsearchservice v1.20.6 // indirect
- github.com/aws/aws-sdk-go-v2/service/emr v1.28.7 // indirect
- github.com/aws/aws-sdk-go-v2/service/iam v1.22.5 // indirect
+ github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2 // indirect
+ github.com/aws/aws-sdk-go-v2/internal/v4a v1.2.10 // indirect
+ github.com/aws/aws-sdk-go-v2/service/accessanalyzer v1.26.7 // indirect
+ github.com/aws/aws-sdk-go-v2/service/apigateway v1.21.6 // indirect
+ github.com/aws/aws-sdk-go-v2/service/apigatewayv2 v1.18.6 // indirect
+ github.com/aws/aws-sdk-go-v2/service/athena v1.37.3 // indirect
+ github.com/aws/aws-sdk-go-v2/service/cloudfront v1.32.5 // indirect
+ github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.35.6 // indirect
+ github.com/aws/aws-sdk-go-v2/service/cloudwatch v1.32.2 // indirect
+ github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.30.1 // indirect
+ github.com/aws/aws-sdk-go-v2/service/codebuild v1.26.5 // indirect
+ github.com/aws/aws-sdk-go-v2/service/docdb v1.29.6 // indirect
+ github.com/aws/aws-sdk-go-v2/service/dynamodb v1.26.8 // indirect
+ github.com/aws/aws-sdk-go-v2/service/ebs v1.21.7 // indirect
+ github.com/aws/aws-sdk-go-v2/service/ecs v1.35.6 // indirect
+ github.com/aws/aws-sdk-go-v2/service/efs v1.26.5 // indirect
+ github.com/aws/aws-sdk-go-v2/service/eks v1.37.0 // indirect
+ github.com/aws/aws-sdk-go-v2/service/elasticache v1.34.6 // indirect
+ github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.26.6 // indirect
+ github.com/aws/aws-sdk-go-v2/service/elasticsearchservice v1.25.0 // indirect
+ github.com/aws/aws-sdk-go-v2/service/emr v1.36.0 // indirect
+ github.com/aws/aws-sdk-go-v2/service/iam v1.28.7 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4 // indirect
- github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.38 // indirect
- github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.7.35 // indirect
+ github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.2.10 // indirect
+ github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.8.11 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.10 // indirect
- github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.15.6 // indirect
- github.com/aws/aws-sdk-go-v2/service/kafka v1.22.6 // indirect
- github.com/aws/aws-sdk-go-v2/service/kinesis v1.18.5 // indirect
- github.com/aws/aws-sdk-go-v2/service/kms v1.24.5 // indirect
- github.com/aws/aws-sdk-go-v2/service/lambda v1.39.5 // indirect
- github.com/aws/aws-sdk-go-v2/service/mq v1.16.5 // indirect
- github.com/aws/aws-sdk-go-v2/service/neptune v1.21.5 // indirect
- github.com/aws/aws-sdk-go-v2/service/rds v1.54.0 // indirect
- github.com/aws/aws-sdk-go-v2/service/redshift v1.29.5 // indirect
- github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.21.3 // indirect
- github.com/aws/aws-sdk-go-v2/service/sns v1.21.5 // indirect
- github.com/aws/aws-sdk-go-v2/service/sqs v1.24.5 // indirect
- github.com/aws/aws-sdk-go-v2/service/sso v1.18.2 // indirect
- github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.2 // indirect
- github.com/aws/aws-sdk-go-v2/service/workspaces v1.31.1 // indirect
+ github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.16.10 // indirect
+ github.com/aws/aws-sdk-go-v2/service/kafka v1.28.5 // indirect
+ github.com/aws/aws-sdk-go-v2/service/kinesis v1.24.6 // indirect
+ github.com/aws/aws-sdk-go-v2/service/kms v1.27.7 // indirect
+ github.com/aws/aws-sdk-go-v2/service/lambda v1.49.6 // indirect
+ github.com/aws/aws-sdk-go-v2/service/mq v1.20.6 // indirect
+ github.com/aws/aws-sdk-go-v2/service/neptune v1.28.1 // indirect
+ github.com/aws/aws-sdk-go-v2/service/rds v1.66.1 // indirect
+ github.com/aws/aws-sdk-go-v2/service/redshift v1.39.7 // indirect
+ github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.26.0 // indirect
+ github.com/aws/aws-sdk-go-v2/service/sns v1.26.6 // indirect
+ github.com/aws/aws-sdk-go-v2/service/sqs v1.29.6 // indirect
+ github.com/aws/aws-sdk-go-v2/service/sso v1.18.6 // indirect
+ github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.6 // indirect
+ github.com/aws/aws-sdk-go-v2/service/workspaces v1.35.6 // indirect
github.com/aws/smithy-go v1.19.0 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
@@ -208,7 +211,7 @@ require (
github.com/cenkalti/backoff/v4 v4.2.1 // indirect
github.com/cespare/xxhash/v2 v2.2.0 // indirect
github.com/chai2010/gettext-go v1.0.2 // indirect
- github.com/cloudflare/circl v1.3.3 // indirect
+ github.com/cloudflare/circl v1.3.7 // indirect
github.com/containerd/cgroups v1.1.0 // indirect
github.com/containerd/continuity v0.4.2 // indirect
github.com/containerd/fifo v1.1.0 // indirect
@@ -223,7 +226,7 @@ require (
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
github.com/dlclark/regexp2 v1.4.0 // indirect
- github.com/docker/cli v24.0.5+incompatible // indirect
+ github.com/docker/cli v24.0.6+incompatible // indirect
github.com/docker/distribution v2.8.2+incompatible // indirect
github.com/docker/docker-credential-helpers v0.7.0 // indirect
github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
@@ -231,9 +234,9 @@ require (
github.com/docker/go-units v0.5.0 // indirect
github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect
github.com/dustin/go-humanize v1.0.1 // indirect
- github.com/emicklei/go-restful/v3 v3.10.1 // indirect
+ github.com/emicklei/go-restful/v3 v3.11.0 // indirect
github.com/emirpasic/gods v1.18.1 // indirect
- github.com/evanphx/json-patch v5.6.0+incompatible // indirect
+ github.com/evanphx/json-patch v5.7.0+incompatible // indirect
github.com/exponent-io/jsonpath v0.0.0-20151013193312-d6023ce2651d // indirect
github.com/felixge/httpsnoop v1.0.4 // indirect
github.com/fsnotify/fsnotify v1.7.0 // indirect
@@ -242,7 +245,7 @@ require (
github.com/go-git/go-billy/v5 v5.5.0 // indirect
github.com/go-gorp/gorp/v3 v3.1.0 // indirect
github.com/go-ini/ini v1.67.0 // indirect
- github.com/go-logr/logr v1.3.0 // indirect
+ github.com/go-logr/logr v1.4.1 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-openapi/analysis v0.21.4 // indirect
github.com/go-openapi/errors v0.20.4 // indirect
@@ -252,29 +255,35 @@ require (
github.com/go-openapi/spec v0.20.9 // indirect
github.com/go-openapi/swag v0.22.4 // indirect
github.com/go-openapi/validate v0.22.1 // indirect
+ github.com/go-sql-driver/mysql v1.7.1 // indirect
+ github.com/go-test/deep v1.1.0 // indirect
github.com/gobwas/glob v0.2.3 // indirect
- github.com/goccy/go-yaml v1.8.1 // indirect
+ github.com/goccy/go-yaml v1.9.5 // indirect
github.com/gofrs/uuid v4.3.1+incompatible // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
github.com/golang-jwt/jwt/v5 v5.0.0 // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
github.com/google/btree v1.1.2 // indirect
+ github.com/google/flatbuffers v2.0.8+incompatible // indirect
github.com/google/gnostic-models v0.6.8 // indirect
github.com/google/go-cmp v0.6.0 // indirect
github.com/google/gofuzz v1.2.0 // indirect
+ github.com/google/pprof v0.0.0-20230406165453-00490a63f317 // indirect
github.com/google/s2a-go v0.1.5 // indirect
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.2.5 // indirect
github.com/googleapis/gax-go/v2 v2.12.0 // indirect
github.com/gorilla/mux v1.8.1 // indirect
+ github.com/gorilla/websocket v1.5.0 // indirect
github.com/gosuri/uitable v0.0.4 // indirect
- github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7 // indirect
+ github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
github.com/hashicorp/errwrap v1.1.0 // indirect
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
github.com/hashicorp/go-safetemp v1.0.0 // indirect
github.com/hashicorp/go-uuid v1.0.3 // indirect
github.com/hashicorp/go-version v1.6.0 // indirect
+ github.com/hashicorp/golang-lru v0.6.0 // indirect
github.com/hashicorp/hcl v1.0.0 // indirect
github.com/hashicorp/hcl/v2 v2.19.1 // indirect
github.com/huandu/xstrings v1.4.0 // indirect
@@ -302,7 +311,7 @@ require (
github.com/mattn/go-runewidth v0.0.14 // indirect
github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
github.com/microsoft/go-rustaudit v0.0.0-20220808201409-204dfee52032 // indirect
- github.com/miekg/dns v1.1.50 // indirect
+ github.com/miekg/dns v1.1.53 // indirect
github.com/mitchellh/copystructure v1.2.0 // indirect
github.com/mitchellh/go-homedir v1.1.0 // indirect
github.com/mitchellh/go-testing-interface v1.14.1 // indirect
@@ -320,6 +329,7 @@ require (
github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
github.com/morikuni/aec v1.0.0 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+ github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
github.com/oklog/ulid v1.3.1 // indirect
github.com/olekukonko/tablewriter v0.0.5 // indirect
github.com/opencontainers/runc v1.1.5 // indirect
@@ -342,6 +352,7 @@ require (
github.com/rivo/uniseg v0.2.0 // indirect
github.com/rubenv/sql-migrate v1.5.2 // indirect
github.com/russross/blackfriday/v2 v2.1.0 // indirect
+ github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 // indirect
github.com/sergi/go-diff v1.3.1 // indirect
github.com/shibumi/go-pathspec v1.3.0 // indirect
github.com/shopspring/decimal v1.3.1 // indirect
@@ -370,12 +381,12 @@ require (
go.starlark.net v0.0.0-20230525235612-a134d8f9ddca // indirect
go.uber.org/goleak v1.3.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
- golang.org/x/crypto v0.17.0 // indirect
- golang.org/x/net v0.19.0 // indirect
+ golang.org/x/crypto v0.18.0 // indirect
+ golang.org/x/net v0.20.0 // indirect
golang.org/x/oauth2 v0.13.0 // indirect
- golang.org/x/sys v0.15.0 // indirect
+ golang.org/x/sys v0.16.0 // indirect
golang.org/x/time v0.5.0 // indirect
- golang.org/x/tools v0.13.0 // indirect
+ golang.org/x/tools v0.15.0 // indirect
google.golang.org/api v0.138.0 // indirect
google.golang.org/appengine v1.6.8 // indirect
google.golang.org/genproto v0.0.0-20231002182017-d307bd883b97 // indirect
@@ -387,16 +398,16 @@ require (
gopkg.in/ini.v1 v1.67.0 // indirect
gopkg.in/warnings.v0 v0.1.2 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
- helm.sh/helm/v3 v3.13.0 // indirect
- k8s.io/apiextensions-apiserver v0.28.2 // indirect
- k8s.io/apimachinery v0.28.4 // indirect
- k8s.io/apiserver v0.28.2 // indirect
- k8s.io/cli-runtime v0.28.4 // indirect
- k8s.io/client-go v0.28.4 // indirect
- k8s.io/component-base v0.28.3 // indirect
- k8s.io/klog/v2 v2.110.1 // indirect
- k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 // indirect
- k8s.io/kubectl v0.28.3 // indirect
+ helm.sh/helm/v3 v3.14.0 // indirect
+ k8s.io/apiextensions-apiserver v0.29.0 // indirect
+ k8s.io/apimachinery v0.29.0 // indirect
+ k8s.io/apiserver v0.29.0 // indirect
+ k8s.io/cli-runtime v0.29.0 // indirect
+ k8s.io/client-go v0.29.0 // indirect
+ k8s.io/component-base v0.29.0 // indirect
+ k8s.io/klog/v2 v2.120.0 // indirect
+ k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect
+ k8s.io/kubectl v0.29.0 // indirect
lukechampine.com/uint128 v1.2.0 // indirect
modernc.org/cc/v3 v3.40.0 // indirect
modernc.org/ccgo/v3 v3.16.13 // indirect
@@ -405,12 +416,12 @@ require (
modernc.org/memory v1.7.2 // indirect
modernc.org/opt v0.1.3 // indirect
modernc.org/strutil v1.1.3 // indirect
- modernc.org/token v1.0.1 // indirect
- oras.land/oras-go v1.2.3 // indirect
+ modernc.org/token v1.1.0 // indirect
+ oras.land/oras-go v1.2.4 // indirect
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
sigs.k8s.io/kustomize/api v0.13.5-0.20230601165947-6ce0bf390ce3 // indirect
sigs.k8s.io/kustomize/kyaml v0.14.3-0.20230601165947-6ce0bf390ce3 // indirect
- sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
+ sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
sigs.k8s.io/yaml v1.4.0 // indirect
)
diff --git a/go.sum b/go.sum
index aeba5c1a5a92..362a05d16330 100644
--- a/go.sum
+++ b/go.sum
@@ -216,8 +216,9 @@ github.com/Azure/go-autorest/autorest v0.11.29 h1:I4+HL/JDvErx2LjyzaVxllw2lRDB5/
github.com/Azure/go-autorest/autorest v0.11.29/go.mod h1:ZtEzC4Jy2JDrZLxvWs8LrBWEBycl1hbT1eknI8MtfAs=
github.com/Azure/go-autorest/autorest/adal v0.9.0/go.mod h1:/c022QCutn2P7uY+/oQWWNcK9YU+MH96NgK+jErpbcg=
github.com/Azure/go-autorest/autorest/adal v0.9.5/go.mod h1:B7KF7jKIeC9Mct5spmyCB/A8CG/sEz1vwIRGv/bbw7A=
-github.com/Azure/go-autorest/autorest/adal v0.9.22 h1:/GblQdIudfEM3AWWZ0mrYJQSd7JS4S/Mbzh6F0ov0Xc=
github.com/Azure/go-autorest/autorest/adal v0.9.22/go.mod h1:XuAbAEUv2Tta//+voMI038TrJBqjKam0me7qR+L8Cmk=
+github.com/Azure/go-autorest/autorest/adal v0.9.23 h1:Yepx8CvFxwNKpH6ja7RZ+sKX+DWYNldbLiALMC3BTz8=
+github.com/Azure/go-autorest/autorest/adal v0.9.23/go.mod h1:5pcMqFkdPhviJdlEy3kC/v1ZLnQl0MH6XA5YCcMhy4c=
github.com/Azure/go-autorest/autorest/date v0.3.0 h1:7gUk1U5M/CQbp9WoqinNzJar+8KY+LPI6wiWrP/myHw=
github.com/Azure/go-autorest/autorest/date v0.3.0/go.mod h1:BI0uouVdmngYNUzGWeSYnokU+TrmwEsOqdt8Y6sso74=
github.com/Azure/go-autorest/autorest/mocks v0.4.0/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
@@ -236,13 +237,17 @@ github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbi
github.com/BurntSushi/toml v1.3.2 h1:o7IhLm0Msx3BaB+n3Ag7L8EVlByGnpq14C4YWiu/gL8=
github.com/BurntSushi/toml v1.3.2/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/CycloneDX/cyclonedx-go v0.7.2 h1:kKQ0t1dPOlugSIYVOMiMtFqeXI2wp/f5DBIdfux8gnQ=
-github.com/CycloneDX/cyclonedx-go v0.7.2/go.mod h1:K2bA+324+Og0X84fA8HhN2X066K7Bxz4rpMQ4ZhjtSk=
+github.com/CycloneDX/cyclonedx-go v0.8.0 h1:FyWVj6x6hoJrui5uRQdYZcSievw3Z32Z88uYzG/0D6M=
+github.com/CycloneDX/cyclonedx-go v0.8.0/go.mod h1:K2bA+324+Og0X84fA8HhN2X066K7Bxz4rpMQ4ZhjtSk=
github.com/DATA-DOG/go-sqlmock v1.5.0 h1:Shsta01QNfFxHCfpW6YH2STWB0MudeXXEWMr20OEh60=
github.com/DATA-DOG/go-sqlmock v1.5.0/go.mod h1:f/Ixk793poVmq4qj/V1dPUg2JEAKC73Q5eFN3EC/SaM=
github.com/DmitriyVTitov/size v1.5.0/go.mod h1:le6rNI4CoLQV1b9gzp1+3d7hMAD/uu2QcJ+aYbNgiU0=
github.com/GoogleCloudPlatform/docker-credential-gcr v2.0.5+incompatible h1:juIaKLLVhqzP55d8x4cSVgwyQv76Z55/fRv/UBr2KkQ=
github.com/GoogleCloudPlatform/docker-credential-gcr v2.0.5+incompatible/go.mod h1:BB1eHdMLYEFuFdBlRMb0N7YGVdM5s6Pt0njxgvfbGGs=
+github.com/Intevation/gval v1.3.0 h1:+Ze5sft5MmGbZrHj06NVUbcxCb67l9RaPTLMNr37mjw=
+github.com/Intevation/gval v1.3.0/go.mod h1:xmGyGpP5be12EL0P12h+dqiYG8qn2j3PJxIgkoOHO5o=
+github.com/Intevation/jsonpath v0.2.1 h1:rINNQJ0Pts5XTFEG+zamtdL7l9uuE1z0FBA+r55Sw+A=
+github.com/Intevation/jsonpath v0.2.1/go.mod h1:WnZ8weMmwAx/fAO3SutjYFU+v7DFreNYnibV7CiaYIw=
github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ4pzQ=
github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6lCpQ4fNJ8LE=
github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
@@ -285,8 +290,8 @@ github.com/NYTimes/gziphandler v1.1.1/go.mod h1:n/CVRwUEOgIxrgPvAQhUUr9oeUtvrhMo
github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
github.com/OneOfOne/xxhash v1.2.8 h1:31czK/TI9sNkxIKfaUfGlU47BAxQ0ztGgd9vPyqimf8=
github.com/OneOfOne/xxhash v1.2.8/go.mod h1:eZbhyaAYD41SGSSsnmcpxVoRiQ/MPUTjUdIIOT9Um7Q=
-github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371 h1:kkhsdkhsCvIsutKu5zLMgWtgh9YxGCNAw8Ad8hjwfYg=
-github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
+github.com/ProtonMail/go-crypto v0.0.0-20230923063757-afb1ddc0824c h1:kMFnB0vCcX7IL/m9Y5LO+KQYv+t1CQOiFe6+SV2J7bE=
+github.com/ProtonMail/go-crypto v0.0.0-20230923063757-afb1ddc0824c/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d h1:UrqY+r/OJnIp5u0s1SbQ8dVfLCZJsnvazdBP5hS4iRs=
@@ -321,14 +326,14 @@ github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew
github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
github.com/aquasecurity/bolt-fixtures v0.0.0-20200903104109-d34e7f983986 h1:2a30xLN2sUZcMXl50hg+PJCIDdJgIvIbVcKqLJ/ZrtM=
github.com/aquasecurity/bolt-fixtures v0.0.0-20200903104109-d34e7f983986/go.mod h1:NT+jyeCzXk6vXR5MTkdn4z64TgGfE5HMLC8qfj5unl8=
-github.com/aquasecurity/defsec v0.93.2-0.20231208181342-318642ac6f08 h1:mjQvKTiKYXWGxHU5pw37q1n6deky0KcJq5JJwtuVrF4=
-github.com/aquasecurity/defsec v0.93.2-0.20231208181342-318642ac6f08/go.mod h1:NBF6hvbQSc4s/WCHdKV5sNNxLl258M2OiIFoUfgEn/k=
-github.com/aquasecurity/go-dep-parser v0.0.0-20231120074854-8322cc2242bf h1:kweQrNMfarPfjZGI1537GtuujhpzhsuT/MvmW2FwaBE=
-github.com/aquasecurity/go-dep-parser v0.0.0-20231120074854-8322cc2242bf/go.mod h1:7+xrs6AWD5+onpmX8f7qIkAhUgkPP0mhUdBjxJBcfas=
+github.com/aquasecurity/defsec v0.94.1 h1:lk44bfUltm0f0Dw4DbO3Ka9d/bf3N8cWclSdHXMyKF4=
+github.com/aquasecurity/defsec v0.94.1/go.mod h1:wiX9BX0SOG0ZWjVIPYGPl46fyO3Gu8lJnk4rmhFR7IA=
+github.com/aquasecurity/go-dep-parser v0.0.0-20240124102329-7be7d210a3d4 h1:Ex+YahhZPTu0WF9IKngLr/oRWgW5TN9ed0n4Twsq2Hw=
+github.com/aquasecurity/go-dep-parser v0.0.0-20240124102329-7be7d210a3d4/go.mod h1:P0PmelcN1ABKJrDzRbPnn6hK7RvgI+xmjiV/9uPaNnY=
github.com/aquasecurity/go-gem-version v0.0.0-20201115065557-8eed6fe000ce h1:QgBRgJvtEOBtUXilDb1MLi1p1MWoyFDXAu5DEUl5nwM=
github.com/aquasecurity/go-gem-version v0.0.0-20201115065557-8eed6fe000ce/go.mod h1:HXgVzOPvXhVGLJs4ZKO817idqr/xhwsTcj17CLYY74s=
-github.com/aquasecurity/go-mock-aws v0.0.0-20230810212901-d6feebd39060 h1:V7nC90NpRDEubNpNEgRDtTfLH3RKQlZeY9/HSqxEze8=
-github.com/aquasecurity/go-mock-aws v0.0.0-20230810212901-d6feebd39060/go.mod h1:QAMVTITMGE8AY3qkAIhYCNuQV2tTxzdmt7ZOP0SZwZs=
+github.com/aquasecurity/go-mock-aws v0.0.0-20240109054747-49e4b5da33cb h1:dNxUB2bSbiLGNYcXkbBKrrfuY96+dXhA9FahEFZ4THQ=
+github.com/aquasecurity/go-mock-aws v0.0.0-20240109054747-49e4b5da33cb/go.mod h1:iytBd25FZt3N6g+vGnNPO7BfgkV7HCEfIHyg8K/ldUw=
github.com/aquasecurity/go-npm-version v0.0.0-20201110091526-0b796d180798 h1:eveqE9ivrt30CJ7dOajOfBavhZ4zPqHcZe/4tKp0alc=
github.com/aquasecurity/go-npm-version v0.0.0-20201110091526-0b796d180798/go.mod h1:hxbJZtKlO4P8sZ9nztizR6XLoE33O+BkPmuYQ4ACyz0=
github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46 h1:vmXNl+HDfqqXgr0uY1UgK1GAhps8nbAAtqHNBcgyf+4=
@@ -344,18 +349,18 @@ github.com/aquasecurity/testdocker v0.0.0-20230111101738-e741bda259da h1:pj/adfN
github.com/aquasecurity/testdocker v0.0.0-20230111101738-e741bda259da/go.mod h1:852lbQLpK2nCwlR4ZLYIccxYCfoQao6q9Nl6tjz54v8=
github.com/aquasecurity/tml v0.6.1 h1:y2ZlGSfrhnn7t4ZJ/0rotuH+v5Jgv6BDDO5jB6A9gwo=
github.com/aquasecurity/tml v0.6.1/go.mod h1:OnYMWY5lvI9ejU7yH9LCberWaaTBW7hBFsITiIMY2yY=
-github.com/aquasecurity/trivy-aws v0.5.0 h1:6RJrw+QHeVn2MH7bI7bsVIiqRyhDCPvdEqkNn54Ui4I=
-github.com/aquasecurity/trivy-aws v0.5.0/go.mod h1:dPx0xRElmFrVXBxeYqEAl5NejJ2kHb51ybFPzBMxWow=
+github.com/aquasecurity/trivy-aws v0.7.1 h1:XElKZsP9Hqe2JVekQgGCIkFtgRgVlP+80wKL2JWBctk=
+github.com/aquasecurity/trivy-aws v0.7.1/go.mod h1:bJT7pzsqo9q5yi3arJSt789bAH0eDb7c+niFYMBNcMQ=
github.com/aquasecurity/trivy-db v0.0.0-20231005141211-4fc651f7ac8d h1:fjI9mkoTUAkbGqpzt9nJsO24RAdfG+ZSiLFj0G2jO8c=
github.com/aquasecurity/trivy-db v0.0.0-20231005141211-4fc651f7ac8d/go.mod h1:cj9/QmD9N3OZnKQMp+/DvdV+ym3HyIkd4e+F0ZM3ZGs=
-github.com/aquasecurity/trivy-iac v0.7.1 h1:YqA0B1P/5uJy2YOrT+QtoB8Z/DCqMxApsMkvmyd5Lsg=
-github.com/aquasecurity/trivy-iac v0.7.1/go.mod h1:SK5XaVwGh5M17QV81139BSPXNlm3bIGp+YmAYs7slRw=
-github.com/aquasecurity/trivy-java-db v0.0.0-20230209231723-7cddb1406728 h1:0eS+V7SXHgqoT99tV1mtMW6HL4HdoB9qGLMCb1fZp8A=
-github.com/aquasecurity/trivy-java-db v0.0.0-20230209231723-7cddb1406728/go.mod h1:Ldya37FLi0e/5Cjq2T5Bty7cFkzUDwTcPeQua+2M8i8=
-github.com/aquasecurity/trivy-kubernetes v0.5.9-0.20231203080602-50a069120091 h1:OTJMSbvKQYxbQ2NQ8Nht2NSL1bL36YfBCrlsGGxHPlI=
-github.com/aquasecurity/trivy-kubernetes v0.5.9-0.20231203080602-50a069120091/go.mod h1:Yh+tmpPtbqVWYONrAuapImHfD1ghZgnZHLlMBA6Ukfg=
-github.com/aquasecurity/trivy-policies v0.6.1-0.20231120231532-f6f2330bf842 h1:RnxM3eTcwPlA/WBwnmaEpeEk3WOCDcnz7yTIFxVL7us=
-github.com/aquasecurity/trivy-policies v0.6.1-0.20231120231532-f6f2330bf842/go.mod h1:BmEeSFgmBjo3avCli71736sy0veGcSUzGATupp1MCgA=
+github.com/aquasecurity/trivy-iac v0.8.0 h1:NKFhk/BTwQ0jIh4t74V8+6UIGUvPlaxO9HPlSMQi3fo=
+github.com/aquasecurity/trivy-iac v0.8.0/go.mod h1:ARiMeNqcaVWOXJmp8hmtMnNm/Jd836IOmDBUW5r4KEk=
+github.com/aquasecurity/trivy-java-db v0.0.0-20240109071736-184bd7481d48 h1:JVgBIuIYbwG+ekC5lUHUpGJboPYiCcxiz06RCtz8neI=
+github.com/aquasecurity/trivy-java-db v0.0.0-20240109071736-184bd7481d48/go.mod h1:Ldya37FLi0e/5Cjq2T5Bty7cFkzUDwTcPeQua+2M8i8=
+github.com/aquasecurity/trivy-kubernetes v0.6.3-0.20240118072219-c433b06f98e1 h1:/LsIHMQJ4SOxZeib/bvLP7S3YDTXJVIsQyS4kIIP0GQ=
+github.com/aquasecurity/trivy-kubernetes v0.6.3-0.20240118072219-c433b06f98e1/go.mod h1:v6B8SO2ep718ccGbbjhpzMn6p27IijS+dMb+MeYz3jQ=
+github.com/aquasecurity/trivy-policies v0.8.0 h1:LvmIdw/DfTF72Lc8L+CKLYzfb5BFYzLBGFFR95PKC74=
+github.com/aquasecurity/trivy-policies v0.8.0/go.mod h1:qF/t59pgK/0JTV6tXaeA3Iw3opzoMgzGCDcTDBmqb30=
github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0 h1:jfIu9sQUG6Ig+0+Ap1h4unLjW6YQJpKZVmUzxsD4E/Q=
github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0/go.mod h1:t2tdKJDJF9BV14lnkjHmOQgcvEKgtqs5a1N3LNdJhGE=
github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
@@ -370,141 +375,114 @@ github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3d
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
github.com/aws/aws-sdk-go v1.15.11/go.mod h1:mFuSZ37Z9YOHbQEwBWztmVzqXrEkub65tZoCYDt7FT0=
github.com/aws/aws-sdk-go v1.44.122/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
-github.com/aws/aws-sdk-go v1.48.4 h1:HS2L7ynVhkcRrQRro9CLJZ/xLRb4UOzDEfPzgevZwXM=
-github.com/aws/aws-sdk-go v1.48.4/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
-github.com/aws/aws-sdk-go-v2 v1.20.0/go.mod h1:uWOr0m0jDsiWw8nnXiqZ+YG6LdvAlGYDLLf2NmHZoy4=
-github.com/aws/aws-sdk-go-v2 v1.21.0/go.mod h1:/RfNgGmRxI+iFOB1OeJUyxiU+9s88k3pfHvDagGEp0M=
-github.com/aws/aws-sdk-go-v2 v1.21.1/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
-github.com/aws/aws-sdk-go-v2 v1.21.2/go.mod h1:ErQhvNuEMhJjweavOYhxVkn2RUx7kQXVATHrjKtxIpM=
+github.com/aws/aws-sdk-go v1.49.21 h1:Rl8KW6HqkwzhATwvXhyr7vD4JFUMi7oXGAw9SrxxIFY=
+github.com/aws/aws-sdk-go v1.49.21/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
github.com/aws/aws-sdk-go-v2 v1.24.1 h1:xAojnj+ktS95YZlDf0zxWBkbFtymPeDP+rvUQIH3uAU=
github.com/aws/aws-sdk-go-v2 v1.24.1/go.mod h1:LNh45Br1YAkEKaAqvmE1m8FUx6a5b/V0oAKV7of29b4=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.13/go.mod h1:gpAbvyDGQFozTEmlTFO8XcQKHzubdq0LzRyJpG6MiXM=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.14 h1:Sc82v7tDQ/vdU1WtuSyzZ1I7y/68j//HJ6uozND1IDs=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.4.14/go.mod h1:9NCTOURS8OpxvoAVHq79LK81/zC78hfRWFn+aL0SPcY=
-github.com/aws/aws-sdk-go-v2/config v1.18.45/go.mod h1:ZwDUgFnQgsazQTnWfeLWk5GjeqTQTL8lMkoE1UXzxdE=
-github.com/aws/aws-sdk-go-v2/config v1.25.11 h1:RWzp7jhPRliIcACefGkKp03L0Yofmd2p8M25kbiyvno=
-github.com/aws/aws-sdk-go-v2/config v1.25.11/go.mod h1:BVUs0chMdygHsQtvaMyEOpW2GIW+ubrxJLgIz/JU29s=
-github.com/aws/aws-sdk-go-v2/credentials v1.13.43/go.mod h1:zWJBz1Yf1ZtX5NGax9ZdNjhhI4rgjfgsyk6vTY1yfVg=
-github.com/aws/aws-sdk-go-v2/credentials v1.16.9 h1:LQo3MUIOzod9JdUK+wxmSdgzLVYUbII3jXn3S/HJZU0=
-github.com/aws/aws-sdk-go-v2/credentials v1.16.9/go.mod h1:R7mDuIJoCjH6TxGUc/cylE7Lp/o0bhKVoxdBThsjqCM=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.13.13/go.mod h1:f/Ib/qYjhV2/qdsf79H3QP/eRE4AkVyEf6sk7XfZ1tg=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.9 h1:FZVFahMyZle6WcogZCOxo6D/lkDA2lqKIn4/ueUmVXw=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.9/go.mod h1:kjq7REMIkxdtcEC9/4BVXjOsNY5isz6jQbEgk6osRTU=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.90 h1:mtJRt80k1oGw7QQPluAx8AZ6u16MyCA2di/lMhagZ7I=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.11.90/go.mod h1:lYwZTkeMQWPvNU+u7oYArdNhQ8EKiSGU76jVv0w2GH4=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.37/go.mod h1:Pdn4j43v49Kk6+82spO3Tu5gSeQXRsxo56ePPQAvFiA=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.41/go.mod h1:CrObHAuPneJBlfEJ5T3szXOUkLEThaGfvnhTf33buas=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.42/go.mod h1:oDfgXoBBmj+kXnqxDDnIDnC56QBosglKp8ftRCTxR+0=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.1.43/go.mod h1:auo+PiyLl0n1l8A0e8RIeR8tOzYPfZZH/JNlrJ8igTQ=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.5.4 h1:OCs21ST2LrepDfD3lwlQiOqIGp6JiEUqG84GzTDoyJs=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.5.4/go.mod h1:usURWEKSNNAcAZuzRn/9ZYPT8aZQkR7xcCtunK/LkJo=
+github.com/aws/aws-sdk-go-v2/config v1.26.3 h1:dKuc2jdp10y13dEEvPqWxqLoc0vF3Z9FC45MvuQSxOA=
+github.com/aws/aws-sdk-go-v2/config v1.26.3/go.mod h1:Bxgi+DeeswYofcYO0XyGClwlrq3DZEXli0kLf4hkGA0=
+github.com/aws/aws-sdk-go-v2/credentials v1.16.14 h1:mMDTwwYO9A0/JbOCOG7EOZHtYM+o7OfGWfu0toa23VE=
+github.com/aws/aws-sdk-go-v2/credentials v1.16.14/go.mod h1:cniAUh3ErQPHtCQGPT5ouvSAQ0od8caTO9OOuufZOAE=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11 h1:c5I5iH+DZcH3xOIMlz3/tCKJDaHFwYEmxvlh2fAcFo8=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11/go.mod h1:cRrYDYAMUohBJUtUnOhydaMHtiK/1NZ0Otc9lIb6O0Y=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.15.11 h1:I6lAa3wBWfCz/cKkOpAcumsETRkFAl70sWi8ItcMEsM=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.15.11/go.mod h1:be1NIO30kJA23ORBLqPo1LttEM6tPNSEcjkd1eKzNW0=
github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.10 h1:vF+Zgd9s+H4vOXd5BMaPWykta2a6Ih0AKLq/X6NYKn4=
github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.10/go.mod h1:6BkRjejp/GR4411UGqkX8+wFMbFbqsUIimfK4XjOKR4=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.31/go.mod h1:fTJDMe8LOFYtqiFFFeHA+SVMAwqLhoq0kcInYoLa9Js=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.35/go.mod h1:SJC1nEVVva1g3pHAIdCp7QsRIkMmLAgoDquQ9Rr8kYw=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.36/go.mod h1:rwr4WnmFi3RJO0M4dxbJtgi9BPLMpVBMX1nUte5ha9U=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.4.37/go.mod h1:Qe+2KtKml+FEsQF/DHmDV+xjtche/hwoF75EG4UlHW8=
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.10 h1:nYPe006ktcqUji8S2mqXf9c/7NdiKriOwMvWQHgYztw=
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.10/go.mod h1:6UV4SZkVvmODfXKql4LCbaZUpF7HO2BX38FgBf9ZOLw=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.3.45/go.mod h1:lD5M20o09/LCuQ2mE62Mb/iSdSlCNuj6H5ci7tW7OsE=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.7.1 h1:uR9lXYjdPX0xY+NhvaJ4dD8rpSRz5VY81ccIIoNG+lw=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.7.1/go.mod h1:6fQQgfuGmw8Al/3M2IgIllycxV7ZW7WCdVSqfBeUiCY=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.1.6 h1:wmGLw2i8ZTlHLw7a9ULGfQbuccw8uIiNr6sol5bFzc8=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.1.6/go.mod h1:Q0Hq2X/NuL7z8b1Dww8rmOFl+jzusKEcyvkKspwdpyc=
-github.com/aws/aws-sdk-go-v2/service/accessanalyzer v1.21.1 h1:3fWAJsw4dLG4eYKHL9lygUWbE0lD+/gkqQC1zmmdAig=
-github.com/aws/aws-sdk-go-v2/service/accessanalyzer v1.21.1/go.mod h1:thg9BfQH96QsZg9BMe30WS2av72ZAo7/lTfvUJqjK4s=
-github.com/aws/aws-sdk-go-v2/service/apigateway v1.18.0 h1:rByriM7T0xvKy7eDiNUhFyVgnGupZ7DIifReKDzfk5E=
-github.com/aws/aws-sdk-go-v2/service/apigateway v1.18.0/go.mod h1:OJmEdRP/gDTqY71Cc/eJ/anpvvGHNgf62FyNuah3X48=
-github.com/aws/aws-sdk-go-v2/service/apigatewayv2 v1.14.5 h1:pLmOgMUiwXOi3oKx2J3feVb9JGVgwJ78RYnOV9UR0BM=
-github.com/aws/aws-sdk-go-v2/service/apigatewayv2 v1.14.5/go.mod h1:4eIs6K6ag6ymoUMOFfjm9dmP9KbuKgC7K5eIqlIBsbY=
-github.com/aws/aws-sdk-go-v2/service/athena v1.31.6 h1:EFaTu1rBt+KQglDeYRpP1PHot/6xlYzvouxm2aRmrG8=
-github.com/aws/aws-sdk-go-v2/service/athena v1.31.6/go.mod h1:DHafyhR8x70ANJZ2RkJx8oeJsfEBqaGwZ591vlihVFQ=
-github.com/aws/aws-sdk-go-v2/service/cloudfront v1.28.5 h1:Skw91L/Y1HkdYhCbdM0eiWOjrHKnpB/VNBHpg8e/8qo=
-github.com/aws/aws-sdk-go-v2/service/cloudfront v1.28.5/go.mod h1:s+OI3YtisOCVORf07RWL2xjwrWgeYwvScNp7ZA2YGwI=
-github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.29.1 h1:+aOn02ynxbYNcKynX+WrSCfeV9tHA/fNcEiTuGrUw9c=
-github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.29.1/go.mod h1:0+M+TMNyLPNzvLwJz1Y+RSZO2VTvcSivlHf6hwYJj68=
-github.com/aws/aws-sdk-go-v2/service/cloudwatch v1.27.7 h1:qULF+ElcvjjSEO1+z5x+TmKE9d4yTej7PfpJQPVvexY=
-github.com/aws/aws-sdk-go-v2/service/cloudwatch v1.27.7/go.mod h1:1HKxVrj5wsKy/wb2v07vzTSd+YPV1sDsWxferwPK7PA=
-github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.23.5 h1:/rXnxd9VGnTc5fLuSFKkWCy+kDP6CxXAIMvfJQEfx8U=
-github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.23.5/go.mod h1:5v2ZNXCSwG73rx0k3sCuB1Ju8sbEbG0iUlxCA7D8sV8=
-github.com/aws/aws-sdk-go-v2/service/codebuild v1.22.0 h1:S/R9Wt8ICyPFV9B3f2DhcBPPSr1gIbFd4iR6E/kkyos=
-github.com/aws/aws-sdk-go-v2/service/codebuild v1.22.0/go.mod h1:a0ghZ8nA7qvVSQ69JRKUxIMqVFgXp7pEF8sGYx1ibO0=
-github.com/aws/aws-sdk-go-v2/service/docdb v1.23.5 h1:UcFHE3wNm7hOsVolGFJyKGNiv+vzk4DiP3kgmG/2V7k=
-github.com/aws/aws-sdk-go-v2/service/docdb v1.23.5/go.mod h1:2koFrNxz/jYwXiaAVw37p37KveilCeL+jKoeoecCMjk=
-github.com/aws/aws-sdk-go-v2/service/dynamodb v1.21.5 h1:EeNQ3bDA6hlx3vifHf7LT/l9dh9w7D2XgCdaD11TRU4=
-github.com/aws/aws-sdk-go-v2/service/dynamodb v1.21.5/go.mod h1:X3ThW5RPV19hi7bnQ0RMAiBjZbzxj4rZlj+qdctbMWY=
-github.com/aws/aws-sdk-go-v2/service/ebs v1.18.1 h1:iUgGXA8fg41B4Of0F+BS766SRQ7c8rr5jtka8RgaocQ=
-github.com/aws/aws-sdk-go-v2/service/ebs v1.18.1/go.mod h1:9n0SC5yHomD8IjsR37+/txpdfNdpGSgV1RzmsTHrbWg=
-github.com/aws/aws-sdk-go-v2/service/ec2 v1.134.0 h1:ZozGfw2s79TxoqisrkALGCpXokhMkfZRQxPkd8+MK+Y=
-github.com/aws/aws-sdk-go-v2/service/ec2 v1.134.0/go.mod h1:xYJZQIo/YZxEbeBxUYRQJTCJ924EuKtDfrhVx76yzOE=
-github.com/aws/aws-sdk-go-v2/service/ecr v1.24.1 h1:zqXEIhuR7RcHob2gxB/Xf1X4XuMS0vapn7xr+wCPrpg=
-github.com/aws/aws-sdk-go-v2/service/ecr v1.24.1/go.mod h1:+rWYJfms9p+D/wUN599tx3FtWvxoXCP25b8Porlrxcc=
-github.com/aws/aws-sdk-go-v2/service/ecs v1.30.1 h1:bOS7hAfvd8+glVAG88WnvRITe5N1vopGFHh10ORe/BI=
-github.com/aws/aws-sdk-go-v2/service/ecs v1.30.1/go.mod h1:cxbA26Kf4UlTb40f5FON22ZPNMyEVmMS82KUJZC1E1w=
-github.com/aws/aws-sdk-go-v2/service/efs v1.21.6 h1:Hk/hIxTQ2OcLqG/rThJSwawnXwNftGUyYMNq3Dmrl0E=
-github.com/aws/aws-sdk-go-v2/service/efs v1.21.6/go.mod h1:cws4IYv3vkLS4pZzStRQH6AcBISp5JlI+dgBA/seDbA=
-github.com/aws/aws-sdk-go-v2/service/eks v1.29.5 h1:6eSpTHOsDixcFIvPdiAAVdyCru3k2jIVRPdIQfGzfc8=
-github.com/aws/aws-sdk-go-v2/service/eks v1.29.5/go.mod h1:TwqefcyPlF31NTF+fH34tJ2VwMMR6c74IbiiUgA6kVY=
-github.com/aws/aws-sdk-go-v2/service/elasticache v1.29.3 h1:VT1Yq9MPp/sQhrfeHkC0SQf8mKGrb0epAYTExGipChg=
-github.com/aws/aws-sdk-go-v2/service/elasticache v1.29.3/go.mod h1:WTAOgZesN8YgaTo0aNJPB4ufoN/QpxAHeC2HRxKay+M=
-github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.21.3 h1:CAWMcMnRYCBaeMnycTwZs+0BcuepIMfyP3F0r1VfgPc=
-github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.21.3/go.mod h1:CbJHS0jJJNd2dZOakkG5TBbT8OHz+T0UBzR1ClIdezI=
-github.com/aws/aws-sdk-go-v2/service/elasticsearchservice v1.20.6 h1:5n5h2hr9zdB9RdbO0vaWKur97g7153I1/RmrwZC9IcA=
-github.com/aws/aws-sdk-go-v2/service/elasticsearchservice v1.20.6/go.mod h1:L9XcF8QdOpGUDPccs9VZPlNhrpfPEKFDl/vb3C+iZbs=
-github.com/aws/aws-sdk-go-v2/service/emr v1.28.7 h1:rwQcpb3VcILVKL2G/ZAbfgSa0+dD3zw8zmSdrI2vbc0=
-github.com/aws/aws-sdk-go-v2/service/emr v1.28.7/go.mod h1:NjDlvuvjuHi3uh3r4mXnSvn0UHQACj7i5y8zwIyHs6w=
-github.com/aws/aws-sdk-go-v2/service/iam v1.22.5 h1:qGv+oW4uV1T3kbE9uSYEfdZbo38OqxgRxxfStfDr4BU=
-github.com/aws/aws-sdk-go-v2/service/iam v1.22.5/go.mod h1:8lyPrjQczmx72ac9s82zTjf9xLqs7uuFMG9TVEZ07XU=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.14/go.mod h1:dDilntgHy9WnHXsh7dDtUPgHKEfTJIBUTHM8OWm0f/0=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.9.15/go.mod h1:26SQUPcTNgV1Tapwdt4a1rOsYRsnBsJHLMPoxK2b0d8=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2 h1:GrSw8s0Gs/5zZ0SX+gX4zQjRnRsMJDJ2sLur1gRBhEM=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.7.2/go.mod h1:6fQQgfuGmw8Al/3M2IgIllycxV7ZW7WCdVSqfBeUiCY=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.2.10 h1:5oE2WzJE56/mVveuDZPJESKlg/00AaS2pY2QZcnxg4M=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.2.10/go.mod h1:FHbKWQtRBYUz4vO5WBWjzMD2by126ny5y/1EoaWoLfI=
+github.com/aws/aws-sdk-go-v2/service/accessanalyzer v1.26.7 h1:rLdKcienXrk+JFX1+DZg160ebG8lIF2nFvnEZL7dnII=
+github.com/aws/aws-sdk-go-v2/service/accessanalyzer v1.26.7/go.mod h1:cwqaWBOZXu8pqEE1ZC4Sw2ycZLjwKrRP5tOAJFgCbYc=
+github.com/aws/aws-sdk-go-v2/service/apigateway v1.21.6 h1:ePPaOVn92r5n8Neecdpy93hDmR0PBH6H6b7VQCE5vKE=
+github.com/aws/aws-sdk-go-v2/service/apigateway v1.21.6/go.mod h1:P/zwE9uiC6eK/kL3CS60lxTTVC2zAvaS4iW31io41V4=
+github.com/aws/aws-sdk-go-v2/service/apigatewayv2 v1.18.6 h1:bCdxKjM8DpkNJXnOLVx+Hnav0eM4yJK8kof56VvIjMc=
+github.com/aws/aws-sdk-go-v2/service/apigatewayv2 v1.18.6/go.mod h1:zQ6tOYz7oGI7MbLRDBXfo63puDoTroVcVNXWfmRDA1E=
+github.com/aws/aws-sdk-go-v2/service/athena v1.37.3 h1:qNLkDi/rOaauOuh33a4MNZjyfxvwIgC5qsDiHPvjDk0=
+github.com/aws/aws-sdk-go-v2/service/athena v1.37.3/go.mod h1:MlpC6swcjh1Il80u6XoeY2BTHIZRZWvoXOfaq3rfh8I=
+github.com/aws/aws-sdk-go-v2/service/cloudfront v1.32.5 h1:synDXYpTr5FA80g8twNr49Dd7iAKnxerp93l/kNm/cQ=
+github.com/aws/aws-sdk-go-v2/service/cloudfront v1.32.5/go.mod h1:Dil6nVeCPyPc1gF5EeCrVUTtXexn80MpfqhgSp/Zb64=
+github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.35.6 h1:Yc+avPLGARzp4A9Oi9VRxvlcGqI+0MYIg4tPSupKv2U=
+github.com/aws/aws-sdk-go-v2/service/cloudtrail v1.35.6/go.mod h1:zrqdG1b+4AGoTwTMVFzvzY7ARB3GPo4gKRuK8WPEo8w=
+github.com/aws/aws-sdk-go-v2/service/cloudwatch v1.32.2 h1:vQfCIHSDouEvbE4EuDrlCGKcrtABEqF3cMt61nGEV4g=
+github.com/aws/aws-sdk-go-v2/service/cloudwatch v1.32.2/go.mod h1:3ToKMEhVj+Q+HzZ8Hqin6LdAKtsi3zVXVNUPpQMd+Xk=
+github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.30.1 h1:ZMgx58Tqyr8kTSR9zLzX+W933ujDYleOtFedvn0xHg8=
+github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.30.1/go.mod h1:4Oeb7n2r/ApBIHphQkprve380p/RpPWBotumd44EDGg=
+github.com/aws/aws-sdk-go-v2/service/codebuild v1.26.5 h1:EPnlDd4V2EXywlOPAw/pMUW4PHUgSulKm4zXFU6bixE=
+github.com/aws/aws-sdk-go-v2/service/codebuild v1.26.5/go.mod h1:G2JUWf01sbb5/A8qGcM4dqy4nbl4y4IGWmaCDWAvA2Y=
+github.com/aws/aws-sdk-go-v2/service/docdb v1.29.6 h1:OBNxHKQMlsQplVc+4CeNLTsknaUnMTMnMdsvUr1yqhA=
+github.com/aws/aws-sdk-go-v2/service/docdb v1.29.6/go.mod h1:8d1RpdlgxFU6VO2aWru1ckR0Vsm4EgqCZgOamw5OHpw=
+github.com/aws/aws-sdk-go-v2/service/dynamodb v1.26.8 h1:XKO0BswTDeZMLDBd/b5pCEZGttNXrzRUVtFvp2Ak/Vo=
+github.com/aws/aws-sdk-go-v2/service/dynamodb v1.26.8/go.mod h1:N5tqZcYMM0N1PN7UQYJNWuGyO886OfnMhf/3MAbqMcI=
+github.com/aws/aws-sdk-go-v2/service/ebs v1.21.7 h1:CRzzXjmgx9p362yO39D6hbZULdMI23gaKqSxijJCXHM=
+github.com/aws/aws-sdk-go-v2/service/ebs v1.21.7/go.mod h1:wnsHqpi3RgDwklS5SPHUgjcUUpontGPKJ+GJYOdV7pY=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.142.0 h1:VrFC1uEZjX4ghkm/et8ATVGb1mT75Iv8aPKPjUE+F8A=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.142.0/go.mod h1:qjhtI9zjpUHRc6khtrIM9fb48+ii6+UikL3/b+MKYn0=
+github.com/aws/aws-sdk-go-v2/service/ecr v1.24.6 h1:cT7h+GWP2k0hJSsPmppKgxl4C9R6gCC5/oF4oHnmpK4=
+github.com/aws/aws-sdk-go-v2/service/ecr v1.24.6/go.mod h1:AOHmGMoPtSY9Zm2zBuwUJQBisIvYAZeA1n7b6f4e880=
+github.com/aws/aws-sdk-go-v2/service/ecs v1.35.6 h1:Sc2mLjyA1R8z2l705AN7Wr7QOlnUxVnGPJeDIVyUSrs=
+github.com/aws/aws-sdk-go-v2/service/ecs v1.35.6/go.mod h1:LzHcyOEvaLjbc5e+fP/KmPWBr+h/Ef+EHvnf1Pzo368=
+github.com/aws/aws-sdk-go-v2/service/efs v1.26.5 h1:N1ezZV2yy7NV2w/bA4s4I/+0n2xpL4DzlmroEg5qFsg=
+github.com/aws/aws-sdk-go-v2/service/efs v1.26.5/go.mod h1:PJHqaboMcF/eLy1F/Y9hyls4CQGP5+T5f0iRq6CPXu4=
+github.com/aws/aws-sdk-go-v2/service/eks v1.37.0 h1:tCIkZ/ZdJMGZ1MOwdcioYhOUkkD4F58KFvQTgR3ZIlc=
+github.com/aws/aws-sdk-go-v2/service/eks v1.37.0/go.mod h1:L1uv3UgQlAkdM9v0gpec7nnfUiQkCnGMjBE7MJArfWQ=
+github.com/aws/aws-sdk-go-v2/service/elasticache v1.34.6 h1:Y/5eE9Sc+OBID9pZ4EVFzyQviv1d1RbqB17HRur9ySg=
+github.com/aws/aws-sdk-go-v2/service/elasticache v1.34.6/go.mod h1:iPx2i26hgUULkNh1Jk4QzYzzQKd2nXl/rD9Fm5hQ2uk=
+github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.26.6 h1:twI2uRmpbm0KBog3Ay61IqOtNp6+QxKfSA78zftME/o=
+github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.26.6/go.mod h1:Tpt4kC8x1HfYuh2rG/6yXZrxjABETERrUl9IdA/IS98=
+github.com/aws/aws-sdk-go-v2/service/elasticsearchservice v1.25.0 h1:LPEsYRsC6r3edPHO8KlZJNW0xxyfLHMXJ466MdHuBbQ=
+github.com/aws/aws-sdk-go-v2/service/elasticsearchservice v1.25.0/go.mod h1:CAXUsQvYQVzsXO36npqK3aUlxx2xMSM1Dun3O9jnaEE=
+github.com/aws/aws-sdk-go-v2/service/emr v1.36.0 h1:FdeZ7AYOvyL09KH250Ncz4LF4SB1Vo9l7KZzn/LIrgQ=
+github.com/aws/aws-sdk-go-v2/service/emr v1.36.0/go.mod h1:Drh6y2qLaw/wnDKTIcdqM2m358MIRXsZ2Bj2tjhVLq0=
+github.com/aws/aws-sdk-go-v2/service/iam v1.28.7 h1:FKPRDYZOO0Eur19vWUL1B40Op0j89KQj3kARjrszMK8=
+github.com/aws/aws-sdk-go-v2/service/iam v1.28.7/go.mod h1:YzMYyQ7S4twfYzLjwP24G1RAxypozVZeNaG1r2jxRms=
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4 h1:/b31bi3YVNlkzkBrm9LfpaKoaYZUxIAj4sHfOTmLfqw=
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4/go.mod h1:2aGXHFmbInwgP9ZfpmdIfOELL79zhdNYNmReK8qDfdQ=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.38 h1:skaFGzv+3kA+v2BPKhuekeb1Hbb105+44r8ASC+q5SE=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.1.38/go.mod h1:epIZoRSSbRIwLPJU5F+OldHhwZPBdpDeQkRdCeY3+00=
-github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.7.35 h1:UKjpIDLVF90RfV88XurdduMoTxPqtGHZMIDYZQM7RO4=
-github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.7.35/go.mod h1:B3dUg0V6eJesUTi+m27NUkj7n8hdDKYUpxj8f4+TqaQ=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.35/go.mod h1:QGF2Rs33W5MaN9gYdEQOBBFPLwTZkEhRwI33f7KIG0o=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.9.37/go.mod h1:vBmDnwWXWxNPFRMmG2m/3MKOe+xEcMDo1tanpaWCcck=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.2.10 h1:L0ai8WICYHozIKK+OtPzVJBugL7culcuM4E4JOpIEm8=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.2.10/go.mod h1:byqfyxJBshFk0fF9YmK0M0ugIO8OWjzH2T3bPG4eGuA=
+github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.8.11 h1:e9AVb17H4x5FTE5KWIP5M1Du+9M86pS+Hw0lBUdN8EY=
+github.com/aws/aws-sdk-go-v2/service/internal/endpoint-discovery v1.8.11/go.mod h1:B90ZQJa36xo0ph9HsoteI1+r8owgQH/U1QNfqZQkj1Q=
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.10 h1:DBYTXwIGQSGs9w4jKm60F5dmCQ3EEruxdc0MFh+3EY4=
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.10/go.mod h1:wohMUQiFdzo0NtxbBg0mSRGZ4vL3n0dKjLTINdcIino=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.15.6 h1:9ulSU5ClouoPIYhDQdg9tpl83d5Yb91PXTKK+17q+ow=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.15.6/go.mod h1:lnc2taBsR9nTlz9meD+lhFZZ9EWY712QHrRflWpTcOA=
-github.com/aws/aws-sdk-go-v2/service/kafka v1.22.6 h1:DyJVI9uQB+mO4IuKEE4AloqOvo9XFg7olhZkwWZJ7wc=
-github.com/aws/aws-sdk-go-v2/service/kafka v1.22.6/go.mod h1:uXijjFwDzFVyGUwtXqqEPV/SxxLPrh0LqJxe64Csr7E=
-github.com/aws/aws-sdk-go-v2/service/kinesis v1.18.5 h1:naSZmQiFjoTLxNjfDy/KgEnWdG3odkR6gIEgTx21YOM=
-github.com/aws/aws-sdk-go-v2/service/kinesis v1.18.5/go.mod h1:0h3hOcyFXyjvI3wGt8C8vk2+II9XxHwFM7zH2KvLHmA=
-github.com/aws/aws-sdk-go-v2/service/kms v1.24.5 h1:VNEw+EdYDUdkICYAVQ6n9WoAq8ZuZr7dXKjyaOw94/Q=
-github.com/aws/aws-sdk-go-v2/service/kms v1.24.5/go.mod h1:NZEhPgq+vvmM6L9w+xl78Vf7YxqUcpVULqFdrUhHg8I=
-github.com/aws/aws-sdk-go-v2/service/lambda v1.39.5 h1:uMvxJFS92hNW6BRX0Ou+5zb9DskgrJQHZ+5yT8FXK5Y=
-github.com/aws/aws-sdk-go-v2/service/lambda v1.39.5/go.mod h1:ByLHcf0zbHpyLTOy1iPVRPJWmAUPCiJv5k81dt52ID8=
-github.com/aws/aws-sdk-go-v2/service/mq v1.16.5 h1:xlziZnBjo10pGC+Uol5j8JNSzQksYOgHzAmF5sKnE/s=
-github.com/aws/aws-sdk-go-v2/service/mq v1.16.5/go.mod h1:kxETQ9R0dWsvWyL+5Vp/pNsEYejv76B+RvHr3S0jjhI=
-github.com/aws/aws-sdk-go-v2/service/neptune v1.21.5 h1:qPTVGmBtdPGmXVZ914ZthB2UmIBw9UGMOw6OaSuv8QE=
-github.com/aws/aws-sdk-go-v2/service/neptune v1.21.5/go.mod h1:uH/l4gGqbqoS1FQ/gmkt5TNM3LAeu+H20/tcuhU6j80=
-github.com/aws/aws-sdk-go-v2/service/rds v1.54.0 h1:FmExQnV6PXPAwP2DT3nXlWyKtCJ30gCEQIu4MUOuESo=
-github.com/aws/aws-sdk-go-v2/service/rds v1.54.0/go.mod h1:UNv1vk1fU1NJefzteykVpVLA88w4WxB05g3vp2kQhYM=
-github.com/aws/aws-sdk-go-v2/service/redshift v1.29.5 h1:ufl4QI+6Vuxg6E8UOFVy+CeCtXS+gBMb00oTh2qSPco=
-github.com/aws/aws-sdk-go-v2/service/redshift v1.29.5/go.mod h1:U8V+thdAH44/2weiprIA0JyDWa2XBov58TtdjCTTpc8=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.40.2 h1:Ll5/YVCOzRB+gxPqs2uD0R7/MyATC0w85626glSKmp4=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.40.2/go.mod h1:Zjfqt7KhQK+PO1bbOsFNzKgaq7TcxzmEoDWN8lM0qzQ=
-github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.21.3 h1:H6ZipEknzu7RkJW3w2PP75zd8XOdR35AEY5D57YrJtA=
-github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.21.3/go.mod h1:5W2cYXDPabUmwULErlC92ffLhtTuyv4ai+5HhdbhfNo=
-github.com/aws/aws-sdk-go-v2/service/sns v1.21.5 h1:KI6xffjUcP3KgpJEtKefQL8B7AXFqyAXkVw8SyvT/o8=
-github.com/aws/aws-sdk-go-v2/service/sns v1.21.5/go.mod h1:eEjNDG7Y1BH7Ci9qKVH2L02se84z5GPCqXKcqEUpnXg=
-github.com/aws/aws-sdk-go-v2/service/sqs v1.24.5 h1:RyDpTOMEJO6ycxw1vU/6s0KLFaH3M0z/z9gXHSndPTk=
-github.com/aws/aws-sdk-go-v2/service/sqs v1.24.5/go.mod h1:RZBu4jmYz3Nikzpu/VuVvRnTEJ5a+kf36WT2fcl5Q+Q=
-github.com/aws/aws-sdk-go-v2/service/sso v1.15.2/go.mod h1:gsL4keucRCgW+xA85ALBpRFfdSLH4kHOVSnLMSuBECo=
-github.com/aws/aws-sdk-go-v2/service/sso v1.18.2 h1:xJPydhNm0Hiqct5TVKEuHG7weC0+sOs4MUnd7A5n5F4=
-github.com/aws/aws-sdk-go-v2/service/sso v1.18.2/go.mod h1:zxk6y1X2KXThESWMS5CrKRvISD8mbIMab6nZrCGxDG0=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.17.3/go.mod h1:a7bHA82fyUXOm+ZSWKU6PIoBxrjSprdLoM8xPYvzYVg=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.2 h1:8dU9zqA77C5egbU6yd4hFLaiIdPv3rU+6cp7sz5FjCU=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.2/go.mod h1:7Lt5mjQ8x5rVdKqg+sKKDeuwoszDJIIPmkd8BVsEdS0=
-github.com/aws/aws-sdk-go-v2/service/sts v1.23.2/go.mod h1:Eows6e1uQEsc4ZaHANmsPRzAKcVDrcmjjWiih2+HUUQ=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.16.10 h1:KOxnQeWy5sXyS37fdKEvAsGHOr9fa/qvwxfJurR/BzE=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.16.10/go.mod h1:jMx5INQFYFYB3lQD9W0D8Ohgq6Wnl7NYOJ2TQndbulI=
+github.com/aws/aws-sdk-go-v2/service/kafka v1.28.5 h1:yCkyZDGahaCaAkdpVx8Te05t6eW2FarBLunVC8S23nU=
+github.com/aws/aws-sdk-go-v2/service/kafka v1.28.5/go.mod h1:/KmX+vXMPJGAB56reo95tnsXa6QPNx6qli4L1AmYb7E=
+github.com/aws/aws-sdk-go-v2/service/kinesis v1.24.6 h1:FO/aIHk86VePDUh/3Q/A5pnvu45miO1GZB8rIq2BUlA=
+github.com/aws/aws-sdk-go-v2/service/kinesis v1.24.6/go.mod h1:Sj7qc+P/GOGOPMDn8+B7Cs+WPq1Gk+R6CXRXVhZtWcA=
+github.com/aws/aws-sdk-go-v2/service/kms v1.27.7 h1:wN7AN7iOiAgT9HmdifZNSvbr6S7gSpLjSSOQHIaGmFc=
+github.com/aws/aws-sdk-go-v2/service/kms v1.27.7/go.mod h1:D9FVDkZjkZnnFHymJ3fPVz0zOUlNSd0xcIIVmmrAac8=
+github.com/aws/aws-sdk-go-v2/service/lambda v1.49.6 h1:w8lI9zlVwRTL9f4KB9fRThddhRivv+EQQzv2nU8JDQo=
+github.com/aws/aws-sdk-go-v2/service/lambda v1.49.6/go.mod h1:0V5z1X/8NA9eQ5cZSz5ZaHU8xA/hId2ZAlsHeO7Jrdk=
+github.com/aws/aws-sdk-go-v2/service/mq v1.20.6 h1:n86T5yw0kS6a5nbpkEpDzLPCBXXb35lx3iDkmQWlizA=
+github.com/aws/aws-sdk-go-v2/service/mq v1.20.6/go.mod h1:phfKOOpMQhlBv2KE8gF17P82zLcSedA9b7fMSGTLBdQ=
+github.com/aws/aws-sdk-go-v2/service/neptune v1.28.1 h1:e+DGEARs5GfHuzDwztENiomdLa0sjs55ub27juoFdt0=
+github.com/aws/aws-sdk-go-v2/service/neptune v1.28.1/go.mod h1:jHUFaho5cVpplTDO6bctuLbvnm8F+Xd27RGIJvVTlYI=
+github.com/aws/aws-sdk-go-v2/service/rds v1.66.1 h1:TafjIpDW/+l7s+f3EIONaFsNvNfwVH21NkWYrE0hbEE=
+github.com/aws/aws-sdk-go-v2/service/rds v1.66.1/go.mod h1:MYzRMSdY70kcS8AFg0aHmk/xj6VAe0UfaCCoLrBWPow=
+github.com/aws/aws-sdk-go-v2/service/redshift v1.39.7 h1:k4WaqQ7LHSGrSftCRXTRLv7WaozXu+fZ1jdisQSR2eU=
+github.com/aws/aws-sdk-go-v2/service/redshift v1.39.7/go.mod h1:8hU0Ax6q6QA+jrMcWTE0A4YH594MQoWP3EzGO3GH5Dw=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.48.0 h1:PJTdBMsyvra6FtED7JZtDpQrIAflYDHFoZAu/sKYkwU=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.48.0/go.mod h1:4qXHrG1Ne3VGIMZPCB8OjH/pLFO94sKABIusjh0KWPU=
+github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.26.0 h1:dPCRgAL4WD9tSMaDglRNGOiAtSTjkwNiUW5GDpWFfHA=
+github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.26.0/go.mod h1:4Ae1NCLK6ghmjzd45Tc33GgCKhUWD2ORAlULtMO1Cbs=
+github.com/aws/aws-sdk-go-v2/service/sns v1.26.6 h1:w2YwF8889ardGU3Y0qZbJ4Zzh+Q/QqKZ4kwkK7JFvnI=
+github.com/aws/aws-sdk-go-v2/service/sns v1.26.6/go.mod h1:IrcbquqMupzndZ20BXxDxjM7XenTRhbwBOetk4+Z5oc=
+github.com/aws/aws-sdk-go-v2/service/sqs v1.29.6 h1:UdbDTllc7cmusTTMy1dcTrYKRl4utDEsmKh9ZjvhJCc=
+github.com/aws/aws-sdk-go-v2/service/sqs v1.29.6/go.mod h1:mCUv04gd/7g+/HNzDB4X6dzJuygji0ckvB3Lg/TdG5Y=
+github.com/aws/aws-sdk-go-v2/service/sso v1.18.6 h1:dGrs+Q/WzhsiUKh82SfTVN66QzyulXuMDTV/G8ZxOac=
+github.com/aws/aws-sdk-go-v2/service/sso v1.18.6/go.mod h1:+mJNDdF+qiUlNKNC3fxn74WWNN+sOiGOEImje+3ScPM=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.6 h1:Yf2MIo9x+0tyv76GljxzqA3WtC5mw7NmazD2chwjxE4=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.6/go.mod h1:ykf3COxYI0UJmxcfcxcVuz7b6uADi1FkiUz6Eb7AgM8=
github.com/aws/aws-sdk-go-v2/service/sts v1.26.7 h1:NzO4Vrau795RkUdSHKEwiR01FaGzGOH1EETJ+5QHnm0=
github.com/aws/aws-sdk-go-v2/service/sts v1.26.7/go.mod h1:6h2YuIoxaMSCFf5fi1EgZAwdfkGMgDY+DVfa61uLe4U=
-github.com/aws/aws-sdk-go-v2/service/workspaces v1.31.1 h1:+gN/oR6jT53ggl+jd/7wO4A7u9r1GLCpMiRiatD79WQ=
-github.com/aws/aws-sdk-go-v2/service/workspaces v1.31.1/go.mod h1:56TIMTOeThR8Ep+O82yxpTuGzCOzZuo3XmsJXxukgUo=
-github.com/aws/smithy-go v1.14.0/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
-github.com/aws/smithy-go v1.14.2/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
-github.com/aws/smithy-go v1.15.0/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
+github.com/aws/aws-sdk-go-v2/service/workspaces v1.35.6 h1:RrpjQ5xJN/AW0PCO7EGhhVsKq7BeNqkx5+h6p3QOeTU=
+github.com/aws/aws-sdk-go-v2/service/workspaces v1.35.6/go.mod h1:vkYsJdF9sZl/o1eoK8tSSjzAT+R87QjswOGSTZfyO0Y=
github.com/aws/smithy-go v1.19.0 h1:KWFKQV80DpP3vJrrA9sVAHQ5gc2z8i4EzrLhLlWXcBM=
github.com/aws/smithy-go v1.19.0/go.mod h1:NukqUGpCZIILqqiV0NIjeFh24kd/FAa4beRb6nbIUPE=
github.com/beorn7/perks v0.0.0-20160804104726-4c0e84591b9a/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
@@ -521,8 +499,8 @@ github.com/bitnami/go-version v0.0.0-20231130084017-bb00604d650c/go.mod h1:9iglf
github.com/bketelsen/crypt v0.0.4/go.mod h1:aI6NrJ0pMGgvZKL1iVgXLnfIFJtfV+bKCoqOes/6LfM=
github.com/blang/semver v3.1.0+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
-github.com/bmatcuk/doublestar/v4 v4.6.0 h1:HTuxyug8GyFbRkrffIpzNCSK4luc0TY3wzXvzIZhEXc=
-github.com/bmatcuk/doublestar/v4 v4.6.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
+github.com/bmatcuk/doublestar/v4 v4.6.1 h1:FH9SifrbvJhnlQpztAx++wlkk70QBf0iBWDwNy7PA4I=
+github.com/bmatcuk/doublestar/v4 v4.6.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
github.com/bradleyjkemp/cupaloy/v2 v2.8.0 h1:any4BmKE+jGIaMpnU8YgH/I2LPiLBufr6oMMlVBbn9M=
github.com/bradleyjkemp/cupaloy/v2 v2.8.0/go.mod h1:bm7JXdkRd4BHJk9HpwqAI8BoAY1lps46Enkdqw6aRX0=
@@ -567,8 +545,9 @@ github.com/cilium/ebpf v0.2.0/go.mod h1:To2CFviqOWL/M0gIMsvSMlqe7em/l1ALkX1PyjrX
github.com/cilium/ebpf v0.4.0/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=
github.com/cilium/ebpf v0.7.0/go.mod h1:/oI2+1shJiTGAMgl6/RgJr36Eo1jzrRcAWbcXO2usCA=
github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cloudflare/circl v1.3.3 h1:fE/Qz0QdIGqeWfnwq0RE0R7MI51s0M2E4Ga9kq5AEMs=
github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
+github.com/cloudflare/circl v1.3.7 h1:qlCDlTPz2n9fu58M0Nh1J/JzcFpfgkFHHX3O35r5vcU=
+github.com/cloudflare/circl v1.3.7/go.mod h1:sRTcRWXGLrKw6yIGJ+l7amYJFfAXbZG0kBSc8r4zxgA=
github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
@@ -707,6 +686,8 @@ github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7Do
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
+github.com/csaf-poc/csaf_distribution/v3 v3.0.0 h1:ob9+Fmpff0YWgTP3dYaw7G2hKQ9cegh9l3zksc+q3sM=
+github.com/csaf-poc/csaf_distribution/v3 v3.0.0/go.mod h1:uilCTiNKivq+6zrDvjtZaUeLk70oe21iwKivo6ILwlQ=
github.com/cyphar/filepath-securejoin v0.2.2/go.mod h1:FpkQEhXnPnOthhzymB7CGsFk2G9VLXONKD9G7QGMM+4=
github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg=
@@ -738,8 +719,8 @@ github.com/dnaeon/go-vcr v1.0.1/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyG
github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI=
github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
github.com/docker/cli v20.10.7+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/cli v24.0.5+incompatible h1:WeBimjvS0eKdH4Ygx+ihVq1Q++xg36M/rMi4aXAvodc=
-github.com/docker/cli v24.0.5+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v24.0.6+incompatible h1:fF+XCQCgJjjQNIMjzaSmiKJSCcfcXb3TWTcc7GAneOY=
+github.com/docker/cli v24.0.6+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
github.com/docker/distribution v0.0.0-20190905152932-14b96e55d84c/go.mod h1:0+TTO4EOBfRPhZXAeF1Vu+W3hHZ8eLp8PgKVZlcvtFY=
github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
@@ -777,8 +758,8 @@ github.com/elazarl/goproxy v0.0.0-20230808193330-2592e75ae04a h1:mATvB/9r/3gvcej
github.com/elazarl/goproxy v0.0.0-20230808193330-2592e75ae04a/go.mod h1:Ro8st/ElPeALwNFlcTpWmkr6IoMFfkjXAvTHpevnDsM=
github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
github.com/emicklei/go-restful v2.9.5+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
-github.com/emicklei/go-restful/v3 v3.10.1 h1:rc42Y5YTp7Am7CS630D7JmhRjq4UlEUuEKfrDac4bSQ=
-github.com/emicklei/go-restful/v3 v3.10.1/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
+github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
@@ -792,12 +773,13 @@ github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.
github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1/go.mod h1:KJwIaB5Mv44NWtYuAOFCVOjcI94vtpEz2JU/D2v6IjE=
github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
github.com/evanphx/json-patch v4.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
-github.com/evanphx/json-patch v5.6.0+incompatible h1:jBYDEEiFBPxA0v50tFdvOzQQTCvpL6mnFh5mB2/l16U=
-github.com/evanphx/json-patch v5.6.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/evanphx/json-patch v5.7.0+incompatible h1:vgGkfT/9f8zE6tvSCe74nfpAVDQ2tG6yudJd8LBksgI=
+github.com/evanphx/json-patch v5.7.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
github.com/exponent-io/jsonpath v0.0.0-20151013193312-d6023ce2651d h1:105gxyaGwCFad8crR9dcMQWvV9Hvulu6hwUh4tWPJnM=
github.com/exponent-io/jsonpath v0.0.0-20151013193312-d6023ce2651d/go.mod h1:ZZMPRZwes7CROmyNKgQzC3XPs6L/G2EJLHddWejkmf4=
github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
+github.com/fatih/color v1.10.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
github.com/fatih/color v1.15.0 h1:kOqh6YHBtK8aywxGerMG2Eq3H6Qgoqeo13Bk2Mv/nBs=
github.com/fatih/color v1.15.0/go.mod h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBDUSsw=
github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
@@ -815,6 +797,8 @@ github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4
github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa/go.mod h1:KnogPXtdwXqoenmZCw6S+25EAm2MkxbG0deNDu4cbSA=
+github.com/gabriel-vasile/mimetype v1.4.2 h1:w5qFW6JKBz9Y393Y4q372O9A7cUSequkh1Q7OhCmWKU=
+github.com/gabriel-vasile/mimetype v1.4.2/go.mod h1:zApsH/mKG4w07erKIaJPFiX0Tsq9BFQgN3qGY5GnNgA=
github.com/garyburd/redigo v0.0.0-20150301180006-535138d7bcd7/go.mod h1:NR3MbYisc3/PwhQ00EMzDiPmrwpPxAn5GI05/YaO1SY=
github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
@@ -847,8 +831,8 @@ github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V
github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
-github.com/go-logr/logr v1.3.0 h1:2y3SDp0ZXuc6/cjLSZ+Q3ir+QB9T/iG5yYRXqsagWSY=
-github.com/go-logr/logr v1.3.0/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
+github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
github.com/go-openapi/analysis v0.21.2/go.mod h1:HZwRk4RRisyG8vx2Oe6aqeSQcoxRp47Xkp3+K6q+LdY=
@@ -894,21 +878,26 @@ github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogB
github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
github.com/go-openapi/validate v0.22.1 h1:G+c2ub6q47kfX1sOBLwIQwzBVt8qmOAARyo/9Fqs9NU=
github.com/go-openapi/validate v0.22.1/go.mod h1:rjnrwK57VJ7A8xqfpAOEKRH8yQSGUriMu5/zuPSQ1hg=
+github.com/go-playground/assert/v2 v2.0.1/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
github.com/go-playground/locales v0.13.0/go.mod h1:taPMhCMXrRLJO55olJkUXHZBHCxTMfnGwq/HNwmWNS8=
github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
github.com/go-playground/universal-translator v0.17.0/go.mod h1:UkSxE5sNxxRwHyU+Scu5vgOQjsIJAF8j9muTVoKLVtA=
github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
+github.com/go-playground/validator/v10 v10.4.1/go.mod h1:nlOn6nFhuKACm19sB/8EGNn9GlaMV7XkbRSipzJ0Ii4=
+github.com/go-playground/validator/v10 v10.14.1 h1:9c50NUPC30zyuKprjL3vNZ0m5oG+jU0zvx4AqHGnv4k=
+github.com/go-playground/validator/v10 v10.14.1/go.mod h1:9iXMNT7sEkjXb0I+enO7QXmzG6QCsPWY4zveKFVRSyU=
github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC0oI=
github.com/go-redis/redis/v8 v8.11.5/go.mod h1:gREzHqY1hg6oD9ngVRbLStwAWKhA0FEgq8Jd4h5lpwo=
-github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
+github.com/go-sql-driver/mysql v1.7.1 h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrtU8EI=
+github.com/go-sql-driver/mysql v1.7.1/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
-github.com/go-test/deep v1.0.3 h1:ZrJSEWsXzPOxaZnFteGEfooLba+ju3FYIbOrS+rQd68=
-github.com/go-test/deep v1.0.3/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
+github.com/go-test/deep v1.1.0 h1:WOcxcdHcvdgThNXjw0t76K42FXTU7HpNQWHpA2HHNlg=
+github.com/go-test/deep v1.1.0/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
github.com/gobuffalo/attrs v0.0.0-20190224210810-a9411de4debd/go.mod h1:4duuawTqi2wkkpB4ePgWMaai6/Kc6WEz83bhFwpHzj0=
github.com/gobuffalo/depgen v0.0.0-20190329151759-d478694a28d3/go.mod h1:3STtPUQYuzV0gBVOY3vy6CfMm/ljR4pABfrTeHNLHUY=
github.com/gobuffalo/depgen v0.1.0/go.mod h1:+ifsuy7fhi15RWncXQQKjWS9JPkdah5sZvtHc2RXGlg=
@@ -941,8 +930,9 @@ github.com/gobuffalo/packr/v2 v2.8.3/go.mod h1:0SahksCVcx4IMnigTjiFuyldmTrdTctXs
github.com/gobuffalo/syncx v0.0.0-20190224160051-33c29581e754/go.mod h1:HhnNqWY95UYwwW3uSASeV7vtgYkT2t16hJgV3AEPUpw=
github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
-github.com/goccy/go-yaml v1.8.1 h1:JuZRFlqLM5cWF6A+waL8AKVuCcqvKOuhJtUQI+L3ez0=
github.com/goccy/go-yaml v1.8.1/go.mod h1:wS4gNoLalDSJxo/SpngzPQ2BN4uuZVLCmbM4S3vd4+Y=
+github.com/goccy/go-yaml v1.9.5 h1:Eh/+3uk9kLxG4koCX6lRMAPS1OaMSAi+FJcya0INdB0=
+github.com/goccy/go-yaml v1.9.5/go.mod h1:U/jl18uSupI5rdI2jmuCswEA2htH9eXfferR3KfscvA=
github.com/godbus/dbus v0.0.0-20151105175453-c7fdd8b5cd55/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
github.com/godbus/dbus v0.0.0-20180201030542-885f9cc04c9c/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
github.com/godbus/dbus v0.0.0-20190422162347-ade71ed3457e/go.mod h1:bBOAhwG1umN6/6ZUMtDFBMQR8jRg9O75tm9K00oMsK4=
@@ -1017,8 +1007,8 @@ github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Z
github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
github.com/google/btree v1.1.2 h1:xf4v41cLI2Z6FxbKm+8Bu+m8ifhj15JuZ9sa0jZCMUU=
github.com/google/btree v1.1.2/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
-github.com/google/flatbuffers v1.12.1 h1:MVlul7pQNoDzWRLTw5imwYsl+usrS1TXG2H4jg6ImGw=
-github.com/google/flatbuffers v1.12.1/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
+github.com/google/flatbuffers v2.0.8+incompatible h1:ivUb1cGomAB101ZM1T0nOiWz9pSrTMoa9+EiY7igmkM=
+github.com/google/flatbuffers v2.0.8+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
@@ -1069,8 +1059,8 @@ github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLe
github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26 h1:Xim43kblpZXfIBQsbuBVKCudVG457BR2GZFIz3uw3hQ=
-github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26/go.mod h1:dDKJzRmX4S37WGHujM7tX//fmj1uioxKzKxz3lo4HJo=
+github.com/google/pprof v0.0.0-20230406165453-00490a63f317 h1:hFhpt7CTmR3DX+b4R19ydQFtofxT0Sv3QsKNMVQYTMQ=
+github.com/google/pprof v0.0.0-20230406165453-00490a63f317/go.mod h1:79YE0hCXdHag9sBkw2o+N/YnZtTkXi0UT9Nnixa5eYk=
github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
github.com/google/s2a-go v0.1.5 h1:8IYp3w9nysqv3JH+NJgXJzGbDHzLOTj43BmSkp+O7qg=
github.com/google/s2a-go v0.1.5/go.mod h1:Ej+mSEMGRnqRzjc7VtF+jdBwYG5fuJfiZ8ELkjEwM0A=
@@ -1117,10 +1107,13 @@ github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWS
github.com/gorilla/websocket v0.0.0-20170926233335-4201258b820c/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc=
+github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
github.com/gosuri/uitable v0.0.4 h1:IG2xLKRvErL3uhY6e1BylFzG+aJiwQviDDTfOKeKTpY=
github.com/gosuri/uitable v0.0.4/go.mod h1:tKR86bXuXPZazfOTG1FIzvjIdXzd0mo4Vtn16vt0PJo=
-github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7 h1:pdN6V1QBWetyv/0+wjACpqVH+eVULgEjkurDLq3goeM=
github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
+github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA=
+github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
github.com/grpc-ecosystem/go-grpc-middleware v1.0.1-0.20190118093823-f849b5445de4/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
@@ -1163,8 +1156,8 @@ github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09
github.com/hashicorp/go.net v0.0.1/go.mod h1:hjKkEWcCURg++eb33jQU7oqQcI9XDCnUzHA0oac0k90=
github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
-github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
+github.com/hashicorp/golang-lru v0.6.0 h1:uL2shRDx7RTrOrTCUZEGP/wJUFiUI8QT6E7z5o8jga4=
+github.com/hashicorp/golang-lru v0.6.0/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
github.com/hashicorp/golang-lru/v2 v2.0.6 h1:3xi/Cafd1NaoEnS/yDssIiuVeDVywU0QdFGl3aQaQHM=
github.com/hashicorp/golang-lru/v2 v2.0.6/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
@@ -1306,10 +1299,10 @@ github.com/markbates/safe v1.0.1/go.mod h1:nAqgmRi7cY2nqMc92/bSEeQA+R4OheNU2T1kN
github.com/marstr/guid v1.1.0/go.mod h1:74gB1z2wpxxInTG6yaqA7KrtM0NZ+RbrcqDvYHefzho=
github.com/masahiro331/go-disk v0.0.0-20220919035250-c8da316f91ac h1:QyRucnGOLHJag1eB9CtuZwZk+/LpvTSYr5mnFLLFlgA=
github.com/masahiro331/go-disk v0.0.0-20220919035250-c8da316f91ac/go.mod h1:J7Vb0sf0JzOhT0uHTeCqO6dqP/ELVcQvQ6yQ/56ZRGw=
-github.com/masahiro331/go-ebs-file v0.0.0-20230228042409-005c81d4ae43 h1:umYrurEClKuDjU29DKNNPmnWJNt4mnR0fWLOpWsDg0M=
-github.com/masahiro331/go-ebs-file v0.0.0-20230228042409-005c81d4ae43/go.mod h1:5NOkqebMwu8UiOTSjwqam1Ykdr7fci52TVE2xDQnIiM=
-github.com/masahiro331/go-ext4-filesystem v0.0.0-20230612143131-27ccd485b7a1 h1:jQ0px48V+wp35FSimlg9e/bB8XSrBz0SxPLbnYCq6/4=
-github.com/masahiro331/go-ext4-filesystem v0.0.0-20230612143131-27ccd485b7a1/go.mod h1:3XMMY1M486mWGTD13WPItg6FsgflQR72ZMAkd+gsyoQ=
+github.com/masahiro331/go-ebs-file v0.0.0-20240112135404-d5fbb1d46323 h1:uQubA711SeYStvStohMLrdvRTTohdPHrEPFzerLcY9I=
+github.com/masahiro331/go-ebs-file v0.0.0-20240112135404-d5fbb1d46323/go.mod h1:OdtzwqTtu49Gh5RFkNEU1SbcihIuVTtUipwHflqxckE=
+github.com/masahiro331/go-ext4-filesystem v0.0.0-20231208112839-4339555a0cd4 h1:uHO44vOunB0oEtk+r8ifBbFOD0mr6+fmoyFNCgLE66k=
+github.com/masahiro331/go-ext4-filesystem v0.0.0-20231208112839-4339555a0cd4/go.mod h1:3XMMY1M486mWGTD13WPItg6FsgflQR72ZMAkd+gsyoQ=
github.com/masahiro331/go-mvn-version v0.0.0-20210429150710-d3157d602a08 h1:AevUBW4cc99rAF8q8vmddIP8qd/0J5s/UyltGbp66dg=
github.com/masahiro331/go-mvn-version v0.0.0-20210429150710-d3157d602a08/go.mod h1:JOkBRrE1HvgTyjk6diFtNGgr8XJMtIfiBzkL5krqzVk=
github.com/masahiro331/go-vmdk-parser v0.0.0-20221225061455-612096e4bbbd h1:Y30EzvuoVp97b0unb/GOFXzBUKRXZXUN2e0wYmvC+ic=
@@ -1319,6 +1312,7 @@ github.com/masahiro331/go-xfs-filesystem v0.0.0-20230608043311-a335f4599b70/go.m
github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
github.com/mattn/go-colorable v0.1.7/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
@@ -1348,8 +1342,8 @@ github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfr
github.com/microsoft/go-rustaudit v0.0.0-20220808201409-204dfee52032 h1:TLygBUBxikNJJfLwgm+Qwdgq1FtfV8Uh7bcxRyTzK8s=
github.com/microsoft/go-rustaudit v0.0.0-20220808201409-204dfee52032/go.mod h1:vYT9HE7WCvL64iVeZylKmCsWKfE+JZ8105iuh2Trk8g=
github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
-github.com/miekg/dns v1.1.50 h1:DQUfb9uc6smULcREF09Uc+/Gd46YWqJd5DbpPE9xkcA=
-github.com/miekg/dns v1.1.50/go.mod h1:e3IlAVfNqAllflbibAZEWOXOQ+Ynzk/dDozDxY7XnME=
+github.com/miekg/dns v1.1.53 h1:ZBkuHr5dxHtB1caEOlZTLPo7D3L3TWckgUUs/RHfDxw=
+github.com/miekg/dns v1.1.53/go.mod h1:uInx36IzPl7FYnDcMeVWxj9byh7DutNykX4G9Sj60FY=
github.com/miekg/pkcs11 v1.0.3/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
github.com/mistifyio/go-zfs v2.1.2-0.20190413222219-f784269be439+incompatible/go.mod h1:8AuVvqP/mXw1px98n46wfvcGfQ4ci2FwoAjKYxuo3Z4=
github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
@@ -1416,6 +1410,7 @@ github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8m
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
github.com/ncw/swift v1.0.47/go.mod h1:23YIA4yWVnGwv2dQlN4bB7egfYX6YLn0Yo/S6zZO/ZM=
github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
@@ -1436,15 +1431,15 @@ github.com/onsi/ginkgo v1.11.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+
github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
-github.com/onsi/ginkgo/v2 v2.9.4 h1:xR7vG4IXt5RWx6FfIjyAtsoMAtnc3C/rFXBBd2AjZwE=
-github.com/onsi/ginkgo/v2 v2.9.4/go.mod h1:gCQYp2Q+kSoIj7ykSVb9nskRSsR6PUj4AiLywzIhbKM=
+github.com/onsi/ginkgo/v2 v2.13.0 h1:0jY9lJquiL8fcf3M4LAXN5aMlS/b2BV86HFFPCPMgE4=
+github.com/onsi/ginkgo/v2 v2.13.0/go.mod h1:TE309ZR8s5FsKKpuB1YAQYBzCaAfUgatB/xlT/ETL/o=
github.com/onsi/gomega v0.0.0-20151007035656-2152b45fa28a/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
github.com/onsi/gomega v1.10.3/go.mod h1:V9xEwhxec5O8UDM77eCW8vLymOMltsqPVYWrpDsH8xc=
-github.com/onsi/gomega v1.27.10 h1:naR28SdDFlqrG6kScpT8VWpu1xWY5nJRCF3XaYyBjhI=
-github.com/onsi/gomega v1.27.10/go.mod h1:RsS8tutOdbdgzbPtzzATp12yT7kM5I5aElG3evPbQ0M=
+github.com/onsi/gomega v1.29.0 h1:KIA/t2t5UBzoirT4H9tsML45GEbo3ouUnBHsCfD2tVg=
+github.com/onsi/gomega v1.29.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ=
github.com/open-policy-agent/opa v0.60.0 h1:ZPoPt4yeNs5UXCpd/P/btpSyR8CR0wfhVoh9BOwgJNs=
github.com/open-policy-agent/opa v0.60.0/go.mod h1:aD5IK6AiLNYBjNXn7E02++yC8l4Z+bRDvgM6Ss0bBzA=
github.com/opencontainers/go-digest v0.0.0-20170106003457-a6d0ee40d420/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
@@ -1578,6 +1573,8 @@ github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb
github.com/safchain/ethtool v0.0.0-20190326074333-42ed695e3de8/go.mod h1:Z0q5wiBQGYcxhMZ6gUqHn6pYNLypFAvaL3UvgZLR0U4=
github.com/samber/lo v1.39.0 h1:4gTz1wUhNYLhFSKl6O+8peW0v2F4BCY034GRpU9WnuA=
github.com/samber/lo v1.39.0/go.mod h1:+m/ZKRl6ClXCE2Lgf3MsQlWfh4bn1bz6CXEOxnEXnEA=
+github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 h1:lZUw3E0/J3roVtGQ+SCrUrg3ON6NgVqpn3+iol9aGu4=
+github.com/santhosh-tekuri/jsonschema/v5 v5.3.1/go.mod h1:uToXkOrWAZ6/Oc07xWQrPOhJotwFIyu2bBVN41fcDUY=
github.com/saracen/walker v0.1.3 h1:YtcKKmpRPy6XJTHJ75J2QYXXZYWnZNQxPCVqZSHVV/g=
github.com/saracen/walker v0.1.3/go.mod h1:FU+7qU8DeQQgSZDmmThMJi93kPkLFgy0oVAcLxurjIk=
github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
@@ -1667,6 +1664,7 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
@@ -1760,8 +1758,8 @@ github.com/zclconf/go-cty-yaml v1.0.3/go.mod h1:9YLUH4g7lOhVWqUbctnVlZ5KLpg7JApr
go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
go.etcd.io/bbolt v1.3.3/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
-go.etcd.io/bbolt v1.3.7 h1:j+zJOnnEjF/kyHlDDgGnVL/AIqIJPq8UoB2GSNfkUfQ=
-go.etcd.io/bbolt v1.3.7/go.mod h1:N9Mkw9X8x5fupy0IKsmuqVtoGDyxsaDlbk4Rd05IAQw=
+go.etcd.io/bbolt v1.3.8 h1:xs88BrvEv273UsB79e0hcVrlUWmS0a8upikMFhSyAtA=
+go.etcd.io/bbolt v1.3.8/go.mod h1:N9Mkw9X8x5fupy0IKsmuqVtoGDyxsaDlbk4Rd05IAQw=
go.etcd.io/etcd v0.5.0-alpha.5.0.20200910180754-dd1b699fc489/go.mod h1:yVHk9ub3CSBatqGNg7GRmsnfLWtoW60w4eDYfh7vHDg=
go.etcd.io/etcd/api/v3 v3.5.0/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs=
go.etcd.io/etcd/client/pkg/v3 v3.5.0/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g=
@@ -1840,8 +1838,8 @@ golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4
golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
-golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
+golang.org/x/crypto v0.18.0 h1:PGVlW0xEltQnzFZ55hkuX5+KLyrMYhHld1YHO4AKcdc=
+golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -1852,8 +1850,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20230522175609-2e198f4a06a1 h1:k/i9J1pBpvlfR+9QsetwPyERsqu1GIbi967PQMq3Ivc=
-golang.org/x/exp v0.0.0-20230522175609-2e198f4a06a1/go.mod h1:V1LtkGg67GoY2N1AnLN78QLrzxkLyJw7RJb1gzOOz9w=
+golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa h1:FRnLl4eNAQl8hwxVVC17teOw8kdjVDVAiFMtgUdTSRQ=
+golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa/go.mod h1:zk2irFbV9DP96SEBUUAy67IdHUaZuSnrz1n472HUCLE=
golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -1934,7 +1932,6 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b
golang.org/x/net v0.0.0-20210421230115-4e50805a0758/go.mod h1:72T/g9IO56b78aLF+1Kcs5dz7/ng1VjMUvfKvpfy+jM=
golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.0.0-20210726213435-c6fcb2dbf985/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
@@ -1951,8 +1948,8 @@ golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco=
golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c=
-golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U=
+golang.org/x/net v0.20.0 h1:aCL9BSgETF1k+blQaYUBx9hJ9LOGP3gAVemcZlf1Kpo=
+golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1997,8 +1994,8 @@ golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f/go.mod h1:RxMgew5VJxzue5/jJ
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.4.0 h1:zxkM55ReGkDlKSM+Fu41A+zmbZuaPVbGMzvvdUPznYQ=
-golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
+golang.org/x/sync v0.6.0 h1:5BMeUDZ7vkXGfEr1x9B4bRcTH4lpkTkpdh0T/J+qjbQ=
+golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -2125,8 +2122,8 @@ golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
-golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.16.0 h1:xWw16ngr6ZMtmxDyKyIgsE93KNKz5HKmMa3b8ALHidU=
+golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
golang.org/x/term v0.0.0-20220526004731-065cf7ba2467/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -2134,8 +2131,8 @@ golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4=
-golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
+golang.org/x/term v0.16.0 h1:m+B6fahuftsE9qjo0VWp2FW0mB3MTJvR0BaMQrq0pmE=
+golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -2223,11 +2220,10 @@ golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.1.6-0.20210726203631-07bc1bf47fb2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.13.0 h1:Iey4qkscZuv0VvIt8E0neZjtPVQFSc870HQ448QgEmQ=
-golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
+golang.org/x/tools v0.15.0 h1:zdAyfUGbYmuVokhzVmghFl2ZJh5QhcfebBgmVPFYA+8=
+golang.org/x/tools v0.15.0/go.mod h1:hpksKq4dtpQWS1uQ61JkdqWM3LscIS6Slf+VVkm+wQk=
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -2487,7 +2483,6 @@ gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
gopkg.in/gemnasium/logrus-airbrake-hook.v2 v2.1.2/go.mod h1:Xk6kEKp8OKb+X14hQBKWaSkCsqBpgog8nAV2xsGOxlo=
gopkg.in/go-playground/assert.v1 v1.2.1/go.mod h1:9RXL0bg/zibRAgZUYszZSwO/z8Y/a8bDuhia5mkpMnE=
-gopkg.in/go-playground/validator.v9 v9.30.0 h1:Wk0Z37oBmKj9/n+tPyBHZmeL19LaCoK3Qq48VwYENss=
gopkg.in/go-playground/validator.v9 v9.30.0/go.mod h1:+c9/zcJMFNgbLvly1L1V+PpxWdVbfP1avr/N00E2vyQ=
gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
@@ -2525,8 +2520,8 @@ gotest.tools/v3 v3.0.2/go.mod h1:3SzNCllyD9/Y+b5r9JIKQ474KzkZyqLqEfYqMsX94Bk=
gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=
gotest.tools/v3 v3.5.0 h1:Ljk6PdHdOhAb5aDMWXjDLMMhph+BpztA4v1QdqEW2eY=
gotest.tools/v3 v3.5.0/go.mod h1:isy3WKz7GK6uNw/sbHzfKBLvlvXwUyV06n6brMxxopU=
-helm.sh/helm/v3 v3.13.0 h1:XPJKIU30K4JTQ6VX/6e0hFAmEIonYa8E7wx5aqv4xOc=
-helm.sh/helm/v3 v3.13.0/go.mod h1:2PBEKsMWKLVZTojUOqMS3Eadv5mP43FBWrRgLNkNm9Y=
+helm.sh/helm/v3 v3.14.0 h1:TaZIH6uOchn7L27ptwnnuHJiFrT/BsD4dFdp/HLT2nM=
+helm.sh/helm/v3 v3.14.0/go.mod h1:2itvvDv2WSZXTllknfQo6j7u3VVgMAvm8POCDgYH424=
honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
@@ -2537,32 +2532,32 @@ honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9
k8s.io/api v0.20.1/go.mod h1:KqwcCVogGxQY3nBlRpwt+wpAMF/KjaCc7RpywacvqUo=
k8s.io/api v0.20.4/go.mod h1:++lNL1AJMkDymriNniQsWRkMDzRaX2Y/POTUi8yvqYQ=
k8s.io/api v0.20.6/go.mod h1:X9e8Qag6JV/bL5G6bU8sdVRltWKmdHsFUGS3eVndqE8=
-k8s.io/api v0.28.4 h1:8ZBrLjwosLl/NYgv1P7EQLqoO8MGQApnbgH8tu3BMzY=
-k8s.io/api v0.28.4/go.mod h1:axWTGrY88s/5YE+JSt4uUi6NMM+gur1en2REMR7IRj0=
-k8s.io/apiextensions-apiserver v0.28.2 h1:J6/QRWIKV2/HwBhHRVITMLYoypCoPY1ftigDM0Kn+QU=
-k8s.io/apiextensions-apiserver v0.28.2/go.mod h1:5tnkxLGa9nefefYzWuAlWZ7RZYuN/765Au8cWLA6SRg=
+k8s.io/api v0.29.0 h1:NiCdQMY1QOp1H8lfRyeEf8eOwV6+0xA6XEE44ohDX2A=
+k8s.io/api v0.29.0/go.mod h1:sdVmXoz2Bo/cb77Pxi71IPTSErEW32xa4aXwKH7gfBA=
+k8s.io/apiextensions-apiserver v0.29.0 h1:0VuspFG7Hj+SxyF/Z/2T0uFbI5gb5LRgEyUVE3Q4lV0=
+k8s.io/apiextensions-apiserver v0.29.0/go.mod h1:TKmpy3bTS0mr9pylH0nOt/QzQRrW7/h7yLdRForMZwc=
k8s.io/apimachinery v0.20.1/go.mod h1:WlLqWAHZGg07AeltaI0MV5uk1Omp8xaN0JGLY6gkRpU=
k8s.io/apimachinery v0.20.4/go.mod h1:WlLqWAHZGg07AeltaI0MV5uk1Omp8xaN0JGLY6gkRpU=
k8s.io/apimachinery v0.20.6/go.mod h1:ejZXtW1Ra6V1O5H8xPBGz+T3+4gfkTCeExAHKU57MAc=
-k8s.io/apimachinery v0.28.4 h1:zOSJe1mc+GxuMnFzD4Z/U1wst50X28ZNsn5bhgIIao8=
-k8s.io/apimachinery v0.28.4/go.mod h1:wI37ncBvfAoswfq626yPTe6Bz1c22L7uaJ8dho83mgg=
+k8s.io/apimachinery v0.29.0 h1:+ACVktwyicPz0oc6MTMLwa2Pw3ouLAfAon1wPLtG48o=
+k8s.io/apimachinery v0.29.0/go.mod h1:eVBxQ/cwiJxH58eK/jd/vAk4mrxmVlnpBH5J2GbMeis=
k8s.io/apiserver v0.20.1/go.mod h1:ro5QHeQkgMS7ZGpvf4tSMx6bBOgPfE+f52KwvXfScaU=
k8s.io/apiserver v0.20.4/go.mod h1:Mc80thBKOyy7tbvFtB4kJv1kbdD0eIH8k8vianJcbFM=
k8s.io/apiserver v0.20.6/go.mod h1:QIJXNt6i6JB+0YQRNcS0hdRHJlMhflFmsBDeSgT1r8Q=
-k8s.io/apiserver v0.28.2 h1:rBeYkLvF94Nku9XfXyUIirsVzCzJBs6jMn3NWeHieyI=
-k8s.io/apiserver v0.28.2/go.mod h1:f7D5e8wH8MWcKD7azq6Csw9UN+CjdtXIVQUyUhrtb+E=
-k8s.io/cli-runtime v0.28.4 h1:IW3aqSNFXiGDllJF4KVYM90YX4cXPGxuCxCVqCD8X+Q=
-k8s.io/cli-runtime v0.28.4/go.mod h1:MLGRB7LWTIYyYR3d/DOgtUC8ihsAPA3P8K8FDNIqJ0k=
+k8s.io/apiserver v0.29.0 h1:Y1xEMjJkP+BIi0GSEv1BBrf1jLU9UPfAnnGGbbDdp7o=
+k8s.io/apiserver v0.29.0/go.mod h1:31n78PsRKPmfpee7/l9NYEv67u6hOL6AfcE761HapDM=
+k8s.io/cli-runtime v0.29.0 h1:q2kC3cex4rOBLfPOnMSzV2BIrrQlx97gxHJs21KxKS4=
+k8s.io/cli-runtime v0.29.0/go.mod h1:VKudXp3X7wR45L+nER85YUzOQIru28HQpXr0mTdeCrk=
k8s.io/client-go v0.20.1/go.mod h1:/zcHdt1TeWSd5HoUe6elJmHSQ6uLLgp4bIJHVEuy+/Y=
k8s.io/client-go v0.20.4/go.mod h1:LiMv25ND1gLUdBeYxBIwKpkSC5IsozMMmOOeSJboP+k=
k8s.io/client-go v0.20.6/go.mod h1:nNQMnOvEUEsOzRRFIIkdmYOjAZrC8bgq0ExboWSU1I0=
-k8s.io/client-go v0.28.4 h1:Np5ocjlZcTrkyRJ3+T3PkXDpe4UpatQxj85+xjaD2wY=
-k8s.io/client-go v0.28.4/go.mod h1:0VDZFpgoZfelyP5Wqu0/r/TRYcLYuJ2U1KEeoaPa1N4=
+k8s.io/client-go v0.29.0 h1:KmlDtFcrdUzOYrBhXHgKw5ycWzc3ryPX5mQe0SkG3y8=
+k8s.io/client-go v0.29.0/go.mod h1:yLkXH4HKMAywcrD82KMSmfYg2DlE8mepPR4JGSo5n38=
k8s.io/component-base v0.20.1/go.mod h1:guxkoJnNoh8LNrbtiQOlyp2Y2XFCZQmrcg2n/DeYNLk=
k8s.io/component-base v0.20.4/go.mod h1:t4p9EdiagbVCJKrQ1RsA5/V4rFQNDfRlevJajlGwgjI=
k8s.io/component-base v0.20.6/go.mod h1:6f1MPBAeI+mvuts3sIdtpjljHWBQ2cIy38oBIWMYnrM=
-k8s.io/component-base v0.28.3 h1:rDy68eHKxq/80RiMb2Ld/tbH8uAE75JdCqJyi6lXMzI=
-k8s.io/component-base v0.28.3/go.mod h1:fDJ6vpVNSk6cRo5wmDa6eKIG7UlIQkaFmZN2fYgIUD8=
+k8s.io/component-base v0.29.0 h1:T7rjd5wvLnPBV1vC4zWd/iWRbV8Mdxs+nGaoaFzGw3s=
+k8s.io/component-base v0.29.0/go.mod h1:sADonFTQ9Zc9yFLghpDpmNXEdHyQmFIGbiuZbqAXQ1M=
k8s.io/cri-api v0.17.3/go.mod h1:X1sbHmuXhwaHs9xxYffLqJogVsnI+f6cPRcgPel7ywM=
k8s.io/cri-api v0.20.1/go.mod h1:2JRbKt+BFLTjtrILYVqQK5jqhI+XNdF6UiGMgczeBCI=
k8s.io/cri-api v0.20.4/go.mod h1:2JRbKt+BFLTjtrILYVqQK5jqhI+XNdF6UiGMgczeBCI=
@@ -2570,17 +2565,17 @@ k8s.io/cri-api v0.20.6/go.mod h1:ew44AjNXwyn1s0U4xCKGodU7J1HzBeZ1MpGrpa5r8Yc=
k8s.io/gengo v0.0.0-20200413195148-3a45101e95ac/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE=
k8s.io/klog/v2 v2.4.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
-k8s.io/klog/v2 v2.110.1 h1:U/Af64HJf7FcwMcXyKm2RPM22WZzyR7OSpYj5tg3cL0=
-k8s.io/klog/v2 v2.110.1/go.mod h1:YGtd1984u+GgbuZ7e08/yBuAfKLSO0+uR1Fhi6ExXjo=
+k8s.io/klog/v2 v2.120.0 h1:z+q5mfovBj1fKFxiRzsa2DsJLPIVMk/KFL81LMOfK+8=
+k8s.io/klog/v2 v2.120.0/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
k8s.io/kube-openapi v0.0.0-20201113171705-d219536bb9fd/go.mod h1:WOJ3KddDSol4tAGcJo0Tvi+dK12EcqSLqcWsryKMpfM=
-k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 h1:LyMgNKD2P8Wn1iAwQU5OhxCKlKJy0sHc+PcDwFB24dQ=
-k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9/go.mod h1:wZK2AVp1uHCp4VamDVgBP2COHZjqD1T68Rf0CM3YjSM=
-k8s.io/kubectl v0.28.3 h1:H1Peu1O3EbN9zHkJCcvhiJ4NUj6lb88sGPO5wrWIM6k=
-k8s.io/kubectl v0.28.3/go.mod h1:RDAudrth/2wQ3Sg46fbKKl4/g+XImzvbsSRZdP2RiyE=
+k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 h1:aVUu9fTY98ivBPKR9Y5w/AuzbMm96cd3YHRTU83I780=
+k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00/go.mod h1:AsvuZPBlUDVuCdzJ87iajxtXuR9oktsTctW/R9wwouA=
+k8s.io/kubectl v0.29.0 h1:Oqi48gXjikDhrBF67AYuZRTcJV4lg2l42GmvsP7FmYI=
+k8s.io/kubectl v0.29.0/go.mod h1:0jMjGWIcMIQzmUaMgAzhSELv5WtHo2a8pq67DtviAJs=
k8s.io/kubernetes v1.13.0/go.mod h1:ocZa8+6APFNC2tX1DZASIbocyYT5jHzqFVsY5aoB7Jk=
k8s.io/utils v0.0.0-20201110183641-67b214c5f920/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
-k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 h1:qY1Ad8PODbnymg2pRbkyMT/ylpTrCM8P2RJ0yroCyIk=
-k8s.io/utils v0.0.0-20230406110748-d93618cff8a2/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/utils v0.0.0-20231127182322-b307cd553661 h1:FepOBzJ0GXm8t0su67ln2wAZjbQ6RxQGZDnzuLcrUTI=
+k8s.io/utils v0.0.0-20231127182322-b307cd553661/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
lukechampine.com/uint128 v1.2.0 h1:mBi/5l91vocEN8otkC5bDLhi2KdCticRiwbdB0O+rjI=
lukechampine.com/uint128 v1.2.0/go.mod h1:c4eWIwlEGaxC/+H1VguhU4PHXNWDCDMUlWdIWl2j1gk=
modernc.org/cc/v3 v3.40.0 h1:P3g79IUS/93SYhtoeaHW+kRCIrYaxJ27MFPv+7kaTOw=
@@ -2605,8 +2600,8 @@ modernc.org/strutil v1.1.3 h1:fNMm+oJklMGYfU9Ylcywl0CO5O6nTfaowNsh2wpPjzY=
modernc.org/strutil v1.1.3/go.mod h1:MEHNA7PdEnEwLvspRMtWTNnp2nnyvMfkimT1NKNAGbw=
modernc.org/tcl v1.15.2 h1:C4ybAYCGJw968e+Me18oW55kD/FexcHbqH2xak1ROSY=
modernc.org/tcl v1.15.2/go.mod h1:3+k/ZaEbKrC8ePv8zJWPtBSW0V7Gg9g8rkmhI1Kfs3c=
-modernc.org/token v1.0.1 h1:A3qvTqOwexpfZZeyI0FeGPDlSWX5pjZu9hF4lU+EKWg=
-modernc.org/token v1.0.1/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
+modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
+modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
modernc.org/z v1.7.3 h1:zDJf6iHjrnB+WRD88stbXokugjyc0/pB91ri1gO6LZY=
modernc.org/z v1.7.3/go.mod h1:Ipv4tsdxZRbQyLq9Q1M6gdbkxYzdlrciF2Hi/lS7nWE=
oras.land/oras-go v1.2.4-0.20230801060855-932dd06d38af h1:FX1C64cT+tNHJpuaHqbu48DEUp8gqtu6eBXtoP7CPyM=
@@ -2624,8 +2619,8 @@ sigs.k8s.io/kustomize/kyaml v0.14.3-0.20230601165947-6ce0bf390ce3 h1:W6cLQc5pnqM
sigs.k8s.io/kustomize/kyaml v0.14.3-0.20230601165947-6ce0bf390ce3/go.mod h1:JWP1Fj0VWGHyw3YUPjXSQnRnrwezrZSrApfX5S0nIag=
sigs.k8s.io/structured-merge-diff/v4 v4.0.2/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
sigs.k8s.io/structured-merge-diff/v4 v4.0.3/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
-sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE=
-sigs.k8s.io/structured-merge-diff/v4 v4.2.3/go.mod h1:qjx8mGObPmV2aSZepjQjbmb2ihdVs8cGKBraizNC69E=
+sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4=
+sigs.k8s.io/structured-merge-diff/v4 v4.4.1/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08=
sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
diff --git a/integration/testdata/alpine-310.sarif.golden b/integration/testdata/alpine-310.sarif.golden
index cf7b55af852a..535bd2d09f71 100644
--- a/integration/testdata/alpine-310.sarif.golden
+++ b/integration/testdata/alpine-310.sarif.golden
@@ -23,8 +23,8 @@
},
"helpUri": "https://avd.aquasec.com/nvd/cve-2019-1549",
"help": {
- "text": "Vulnerability CVE-2019-1549\\nSeverity: MEDIUM\\nPackage: libssl1.1\\nFixed Version: 1.1.1d-r0\\nLink: [CVE-2019-1549](https://avd.aquasec.com/nvd/cve-2019-1549)\\nOpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).",
- "markdown": "**Vulnerability CVE-2019-1549**\\n| Severity | Package | Fixed Version | Link |\\n| --- | --- | --- | --- |\\n|MEDIUM|libssl1.1|1.1.1d-r0|[CVE-2019-1549](https://avd.aquasec.com/nvd/cve-2019-1549)|\\n\\nOpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c)."
+ "text": "Vulnerability CVE-2019-1549\nSeverity: MEDIUM\nPackage: libssl1.1\nFixed Version: 1.1.1d-r0\nLink: [CVE-2019-1549](https://avd.aquasec.com/nvd/cve-2019-1549)\nOpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c).",
+ "markdown": "**Vulnerability CVE-2019-1549**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|MEDIUM|libssl1.1|1.1.1d-r0|[CVE-2019-1549](https://avd.aquasec.com/nvd/cve-2019-1549)|\n\nOpenSSL 1.1.1 introduced a rewritten random number generator (RNG). This was intended to include protection in the event of a fork() system call in order to ensure that the parent and child processes did not share the same RNG state. However this protection was not being used in the default case. A partial mitigation for this issue is that the output from a high precision timer is mixed into the RNG state so the likelihood of a parent and child process sharing state is significantly reduced. If an application already calls OPENSSL_init_crypto() explicitly using OPENSSL_INIT_ATFORK then this problem does not occur at all. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c)."
},
"properties": {
"precision": "very-high",
@@ -50,8 +50,8 @@
},
"helpUri": "https://avd.aquasec.com/nvd/cve-2019-1551",
"help": {
- "text": "Vulnerability CVE-2019-1551\\nSeverity: MEDIUM\\nPackage: libssl1.1\\nFixed Version: 1.1.1d-r2\\nLink: [CVE-2019-1551](https://avd.aquasec.com/nvd/cve-2019-1551)\\nThere is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).",
- "markdown": "**Vulnerability CVE-2019-1551**\\n| Severity | Package | Fixed Version | Link |\\n| --- | --- | --- | --- |\\n|MEDIUM|libssl1.1|1.1.1d-r2|[CVE-2019-1551](https://avd.aquasec.com/nvd/cve-2019-1551)|\\n\\nThere is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t)."
+ "text": "Vulnerability CVE-2019-1551\nSeverity: MEDIUM\nPackage: libssl1.1\nFixed Version: 1.1.1d-r2\nLink: [CVE-2019-1551](https://avd.aquasec.com/nvd/cve-2019-1551)\nThere is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t).",
+ "markdown": "**Vulnerability CVE-2019-1551**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|MEDIUM|libssl1.1|1.1.1d-r2|[CVE-2019-1551](https://avd.aquasec.com/nvd/cve-2019-1551)|\n\nThere is an overflow bug in the x64_64 Montgomery squaring procedure used in exponentiation with 512-bit moduli. No EC algorithms are affected. Analysis suggests that attacks against 2-prime RSA1024, 3-prime RSA1536, and DSA1024 as a result of this defect would be very difficult to perform and are not believed likely. Attacks against DH512 are considered just feasible. However, for an attack the target would have to re-use the DH512 private key, which is not recommended anyway. Also applications directly using the low level API BN_mod_exp may be affected if they use BN_FLG_CONSTTIME. Fixed in OpenSSL 1.1.1e (Affected 1.1.1-1.1.1d). Fixed in OpenSSL 1.0.2u (Affected 1.0.2-1.0.2t)."
},
"properties": {
"precision": "very-high",
@@ -73,7 +73,7 @@
"ruleIndex": 0,
"level": "warning",
"message": {
- "text": "Package: libcrypto1.1\\nInstalled Version: 1.1.1c-r0\\nVulnerability CVE-2019-1549\\nSeverity: MEDIUM\\nFixed Version: 1.1.1d-r0\\nLink: [CVE-2019-1549](https://avd.aquasec.com/nvd/cve-2019-1549)"
+ "text": "Package: libcrypto1.1\nInstalled Version: 1.1.1c-r0\nVulnerability CVE-2019-1549\nSeverity: MEDIUM\nFixed Version: 1.1.1d-r0\nLink: [CVE-2019-1549](https://avd.aquasec.com/nvd/cve-2019-1549)"
},
"locations": [
{
@@ -100,7 +100,7 @@
"ruleIndex": 1,
"level": "warning",
"message": {
- "text": "Package: libcrypto1.1\\nInstalled Version: 1.1.1c-r0\\nVulnerability CVE-2019-1551\\nSeverity: MEDIUM\\nFixed Version: 1.1.1d-r2\\nLink: [CVE-2019-1551](https://avd.aquasec.com/nvd/cve-2019-1551)"
+ "text": "Package: libcrypto1.1\nInstalled Version: 1.1.1c-r0\nVulnerability CVE-2019-1551\nSeverity: MEDIUM\nFixed Version: 1.1.1d-r2\nLink: [CVE-2019-1551](https://avd.aquasec.com/nvd/cve-2019-1551)"
},
"locations": [
{
@@ -127,7 +127,7 @@
"ruleIndex": 0,
"level": "warning",
"message": {
- "text": "Package: libssl1.1\\nInstalled Version: 1.1.1c-r0\\nVulnerability CVE-2019-1549\\nSeverity: MEDIUM\\nFixed Version: 1.1.1d-r0\\nLink: [CVE-2019-1549](https://avd.aquasec.com/nvd/cve-2019-1549)"
+ "text": "Package: libssl1.1\nInstalled Version: 1.1.1c-r0\nVulnerability CVE-2019-1549\nSeverity: MEDIUM\nFixed Version: 1.1.1d-r0\nLink: [CVE-2019-1549](https://avd.aquasec.com/nvd/cve-2019-1549)"
},
"locations": [
{
@@ -154,7 +154,7 @@
"ruleIndex": 1,
"level": "warning",
"message": {
- "text": "Package: libssl1.1\\nInstalled Version: 1.1.1c-r0\\nVulnerability CVE-2019-1551\\nSeverity: MEDIUM\\nFixed Version: 1.1.1d-r2\\nLink: [CVE-2019-1551](https://avd.aquasec.com/nvd/cve-2019-1551)"
+ "text": "Package: libssl1.1\nInstalled Version: 1.1.1c-r0\nVulnerability CVE-2019-1551\nSeverity: MEDIUM\nFixed Version: 1.1.1d-r2\nLink: [CVE-2019-1551](https://avd.aquasec.com/nvd/cve-2019-1551)"
},
"locations": [
{
diff --git a/integration/testdata/conda-cyclonedx.json.golden b/integration/testdata/conda-cyclonedx.json.golden
index e449defa008a..30e0321b52a5 100644
--- a/integration/testdata/conda-cyclonedx.json.golden
+++ b/integration/testdata/conda-cyclonedx.json.golden
@@ -6,13 +6,16 @@
"version": 1,
"metadata": {
"timestamp": "2021-08-25T12:20:30+00:00",
- "tools": [
- {
- "vendor": "aquasecurity",
- "name": "trivy",
- "version": "dev"
- }
- ],
+ "tools": {
+ "components": [
+ {
+ "type": "application",
+ "group": "aquasecurity",
+ "name": "trivy",
+ "version": "dev"
+ }
+ ]
+ },
"component": {
"bom-ref": "3ff14136-e09f-4df9-80ea-000000000002",
"type": "application",
diff --git a/integration/testdata/conda-spdx.json.golden b/integration/testdata/conda-spdx.json.golden
index a201662a7736..be1146b285c4 100644
--- a/integration/testdata/conda-spdx.json.golden
+++ b/integration/testdata/conda-spdx.json.golden
@@ -22,7 +22,7 @@
},
{
"name": "openssl",
- "SPDXID": "SPDXRef-Package-38e5db7a21fc70a8",
+ "SPDXID": "SPDXRef-Package-20b95c21bfbf9fc4",
"versionInfo": "1.1.1q",
"supplier": "NOASSERTION",
"downloadLocation": "NONE",
@@ -43,7 +43,7 @@
},
{
"name": "pip",
- "SPDXID": "SPDXRef-Package-f9844c873ead5dbe",
+ "SPDXID": "SPDXRef-Package-11a429ec3bd01d80",
"versionInfo": "22.2.2",
"supplier": "NOASSERTION",
"downloadLocation": "NONE",
@@ -110,21 +110,21 @@
},
{
"spdxElementId": "SPDXRef-Application-ee5ef1aa4ac89125",
- "relatedSpdxElement": "SPDXRef-Package-38e5db7a21fc70a8",
+ "relatedSpdxElement": "SPDXRef-Package-20b95c21bfbf9fc4",
"relationshipType": "CONTAINS"
},
{
- "spdxElementId": "SPDXRef-Package-38e5db7a21fc70a8",
+ "spdxElementId": "SPDXRef-Package-20b95c21bfbf9fc4",
"relatedSpdxElement": "SPDXRef-File-600e5e0110a84891",
"relationshipType": "CONTAINS"
},
{
"spdxElementId": "SPDXRef-Application-ee5ef1aa4ac89125",
- "relatedSpdxElement": "SPDXRef-Package-f9844c873ead5dbe",
+ "relatedSpdxElement": "SPDXRef-Package-11a429ec3bd01d80",
"relationshipType": "CONTAINS"
},
{
- "spdxElementId": "SPDXRef-Package-f9844c873ead5dbe",
+ "spdxElementId": "SPDXRef-Package-11a429ec3bd01d80",
"relatedSpdxElement": "SPDXRef-File-7eb62e2a3edddc0a",
"relationshipType": "CONTAINS"
}
diff --git a/integration/testdata/fluentd-multiple-lockfiles.cdx.json.golden b/integration/testdata/fluentd-multiple-lockfiles.cdx.json.golden
index c3e5903d5b79..aab59a6cf47f 100644
--- a/integration/testdata/fluentd-multiple-lockfiles.cdx.json.golden
+++ b/integration/testdata/fluentd-multiple-lockfiles.cdx.json.golden
@@ -6,13 +6,16 @@
"version": 1,
"metadata": {
"timestamp": "2021-08-25T12:20:30+00:00",
- "tools": [
- {
- "vendor": "aquasecurity",
- "name": "trivy",
- "version": "dev"
- }
- ],
+ "tools": {
+ "components": [
+ {
+ "type": "application",
+ "group": "aquasecurity",
+ "name": "trivy",
+ "version": "dev"
+ }
+ ]
+ },
"component": {
"bom-ref": "3ff14136-e09f-4df9-80ea-000000000002",
"type": "container",
diff --git a/integration/testdata/helm.json.golden b/integration/testdata/helm.json.golden
index 5899f2a52bc4..df4705b12115 100644
--- a/integration/testdata/helm.json.golden
+++ b/integration/testdata/helm.json.golden
@@ -21,8 +21,8 @@
"Class": "config",
"Type": "helm",
"MisconfSummary": {
- "Successes": 141,
- "Failures": 15,
+ "Successes": 125,
+ "Failures": 14,
"Exceptions": 0
},
"Misconfigurations": [
@@ -312,7 +312,7 @@
"Namespace": "builtin.kubernetes.KSV014",
"Query": "data.builtin.kubernetes.KSV014.deny",
"Resolution": "Change 'containers[].securityContext.readOnlyRootFilesystem' to 'true'.",
- "Severity": "LOW",
+ "Severity": "HIGH",
"PrimaryURL": "https://avd.aquasec.com/misconfig/ksv014",
"References": [
"https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/",
@@ -880,32 +880,6 @@
}
}
},
- {
- "Type": "Helm Security Check",
- "ID": "KSV116",
- "AVDID": "AVD-KSV-0116",
- "Title": "Runs with a root primary or supplementary GID",
- "Description": "According to pod security standard 'Non-root groups', containers should be forbidden from running with a root primary or supplementary GID.",
- "Message": "deployment nginx-deployment in default namespace should set spec.securityContext.runAsGroup, spec.securityContext.supplementalGroups[*] and spec.securityContext.fsGroup to integer greater than 0",
- "Namespace": "builtin.kubernetes.KSV116",
- "Query": "data.builtin.kubernetes.KSV116.deny",
- "Resolution": "Set 'containers[].securityContext.runAsGroup' to a non-zero integer or leave undefined.",
- "Severity": "LOW",
- "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv116",
- "References": [
- "https://kubesec.io/basics/containers-securitycontext-runasuser/",
- "https://avd.aquasec.com/misconfig/ksv116"
- ],
- "Status": "FAIL",
- "Layer": {},
- "CauseMetadata": {
- "Provider": "Kubernetes",
- "Service": "general",
- "Code": {
- "Lines": null
- }
- }
- },
{
"Type": "Helm Security Check",
"ID": "KSV117",
diff --git a/integration/testdata/helm_testchart.json.golden b/integration/testdata/helm_testchart.json.golden
index 58bce82835f9..7b78e3f38620 100644
--- a/integration/testdata/helm_testchart.json.golden
+++ b/integration/testdata/helm_testchart.json.golden
@@ -21,8 +21,8 @@
"Class": "config",
"Type": "helm",
"MisconfSummary": {
- "Successes": 151,
- "Failures": 5,
+ "Successes": 135,
+ "Failures": 4,
"Exceptions": 0
},
"Misconfigurations": [
@@ -308,32 +308,6 @@
}
}
},
- {
- "Type": "Helm Security Check",
- "ID": "KSV116",
- "AVDID": "AVD-KSV-0116",
- "Title": "Runs with a root primary or supplementary GID",
- "Description": "According to pod security standard 'Non-root groups', containers should be forbidden from running with a root primary or supplementary GID.",
- "Message": "deployment testchart in default namespace should set spec.securityContext.runAsGroup, spec.securityContext.supplementalGroups[*] and spec.securityContext.fsGroup to integer greater than 0",
- "Namespace": "builtin.kubernetes.KSV116",
- "Query": "data.builtin.kubernetes.KSV116.deny",
- "Resolution": "Set 'containers[].securityContext.runAsGroup' to a non-zero integer or leave undefined.",
- "Severity": "LOW",
- "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv116",
- "References": [
- "https://kubesec.io/basics/containers-securitycontext-runasuser/",
- "https://avd.aquasec.com/misconfig/ksv116"
- ],
- "Status": "FAIL",
- "Layer": {},
- "CauseMetadata": {
- "Provider": "Kubernetes",
- "Service": "general",
- "Code": {
- "Lines": null
- }
- }
- },
{
"Type": "Helm Security Check",
"ID": "KSV117",
@@ -367,76 +341,20 @@
"Class": "config",
"Type": "helm",
"MisconfSummary": {
- "Successes": 155,
- "Failures": 1,
+ "Successes": 106,
+ "Failures": 0,
"Exceptions": 0
- },
- "Misconfigurations": [
- {
- "Type": "Helm Security Check",
- "ID": "KSV116",
- "AVDID": "AVD-KSV-0116",
- "Title": "Runs with a root primary or supplementary GID",
- "Description": "According to pod security standard 'Non-root groups', containers should be forbidden from running with a root primary or supplementary GID.",
- "Message": "service testchart in default namespace should set spec.securityContext.runAsGroup, spec.securityContext.supplementalGroups[*] and spec.securityContext.fsGroup to integer greater than 0",
- "Namespace": "builtin.kubernetes.KSV116",
- "Query": "data.builtin.kubernetes.KSV116.deny",
- "Resolution": "Set 'containers[].securityContext.runAsGroup' to a non-zero integer or leave undefined.",
- "Severity": "LOW",
- "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv116",
- "References": [
- "https://kubesec.io/basics/containers-securitycontext-runasuser/",
- "https://avd.aquasec.com/misconfig/ksv116"
- ],
- "Status": "FAIL",
- "Layer": {},
- "CauseMetadata": {
- "Provider": "Kubernetes",
- "Service": "general",
- "Code": {
- "Lines": null
- }
- }
- }
- ]
+ }
},
{
"Target": "templates/serviceaccount.yaml",
"Class": "config",
"Type": "helm",
"MisconfSummary": {
- "Successes": 155,
- "Failures": 1,
+ "Successes": 105,
+ "Failures": 0,
"Exceptions": 0
- },
- "Misconfigurations": [
- {
- "Type": "Helm Security Check",
- "ID": "KSV116",
- "AVDID": "AVD-KSV-0116",
- "Title": "Runs with a root primary or supplementary GID",
- "Description": "According to pod security standard 'Non-root groups', containers should be forbidden from running with a root primary or supplementary GID.",
- "Message": "serviceaccount testchart in default namespace should set spec.securityContext.runAsGroup, spec.securityContext.supplementalGroups[*] and spec.securityContext.fsGroup to integer greater than 0",
- "Namespace": "builtin.kubernetes.KSV116",
- "Query": "data.builtin.kubernetes.KSV116.deny",
- "Resolution": "Set 'containers[].securityContext.runAsGroup' to a non-zero integer or leave undefined.",
- "Severity": "LOW",
- "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv116",
- "References": [
- "https://kubesec.io/basics/containers-securitycontext-runasuser/",
- "https://avd.aquasec.com/misconfig/ksv116"
- ],
- "Status": "FAIL",
- "Layer": {},
- "CauseMetadata": {
- "Provider": "Kubernetes",
- "Service": "general",
- "Code": {
- "Lines": null
- }
- }
- }
- ]
+ }
}
]
}
diff --git a/integration/testdata/helm_testchart.overridden.json.golden b/integration/testdata/helm_testchart.overridden.json.golden
index 62d914c2b024..55725f96a6e3 100644
--- a/integration/testdata/helm_testchart.overridden.json.golden
+++ b/integration/testdata/helm_testchart.overridden.json.golden
@@ -21,8 +21,8 @@
"Class": "config",
"Type": "helm",
"MisconfSummary": {
- "Successes": 149,
- "Failures": 7,
+ "Successes": 133,
+ "Failures": 6,
"Exceptions": 0
},
"Misconfigurations": [
@@ -535,32 +535,6 @@
}
}
},
- {
- "Type": "Helm Security Check",
- "ID": "KSV116",
- "AVDID": "AVD-KSV-0116",
- "Title": "Runs with a root primary or supplementary GID",
- "Description": "According to pod security standard 'Non-root groups', containers should be forbidden from running with a root primary or supplementary GID.",
- "Message": "deployment testchart in default namespace should set spec.securityContext.runAsGroup, spec.securityContext.supplementalGroups[*] and spec.securityContext.fsGroup to integer greater than 0",
- "Namespace": "builtin.kubernetes.KSV116",
- "Query": "data.builtin.kubernetes.KSV116.deny",
- "Resolution": "Set 'containers[].securityContext.runAsGroup' to a non-zero integer or leave undefined.",
- "Severity": "LOW",
- "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv116",
- "References": [
- "https://kubesec.io/basics/containers-securitycontext-runasuser/",
- "https://avd.aquasec.com/misconfig/ksv116"
- ],
- "Status": "FAIL",
- "Layer": {},
- "CauseMetadata": {
- "Provider": "Kubernetes",
- "Service": "general",
- "Code": {
- "Lines": null
- }
- }
- },
{
"Type": "Helm Security Check",
"ID": "KSV117",
@@ -594,76 +568,20 @@
"Class": "config",
"Type": "helm",
"MisconfSummary": {
- "Successes": 155,
- "Failures": 1,
+ "Successes": 106,
+ "Failures": 0,
"Exceptions": 0
- },
- "Misconfigurations": [
- {
- "Type": "Helm Security Check",
- "ID": "KSV116",
- "AVDID": "AVD-KSV-0116",
- "Title": "Runs with a root primary or supplementary GID",
- "Description": "According to pod security standard 'Non-root groups', containers should be forbidden from running with a root primary or supplementary GID.",
- "Message": "service testchart in default namespace should set spec.securityContext.runAsGroup, spec.securityContext.supplementalGroups[*] and spec.securityContext.fsGroup to integer greater than 0",
- "Namespace": "builtin.kubernetes.KSV116",
- "Query": "data.builtin.kubernetes.KSV116.deny",
- "Resolution": "Set 'containers[].securityContext.runAsGroup' to a non-zero integer or leave undefined.",
- "Severity": "LOW",
- "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv116",
- "References": [
- "https://kubesec.io/basics/containers-securitycontext-runasuser/",
- "https://avd.aquasec.com/misconfig/ksv116"
- ],
- "Status": "FAIL",
- "Layer": {},
- "CauseMetadata": {
- "Provider": "Kubernetes",
- "Service": "general",
- "Code": {
- "Lines": null
- }
- }
- }
- ]
+ }
},
{
"Target": "templates/serviceaccount.yaml",
"Class": "config",
"Type": "helm",
"MisconfSummary": {
- "Successes": 155,
- "Failures": 1,
+ "Successes": 105,
+ "Failures": 0,
"Exceptions": 0
- },
- "Misconfigurations": [
- {
- "Type": "Helm Security Check",
- "ID": "KSV116",
- "AVDID": "AVD-KSV-0116",
- "Title": "Runs with a root primary or supplementary GID",
- "Description": "According to pod security standard 'Non-root groups', containers should be forbidden from running with a root primary or supplementary GID.",
- "Message": "serviceaccount testchart in default namespace should set spec.securityContext.runAsGroup, spec.securityContext.supplementalGroups[*] and spec.securityContext.fsGroup to integer greater than 0",
- "Namespace": "builtin.kubernetes.KSV116",
- "Query": "data.builtin.kubernetes.KSV116.deny",
- "Resolution": "Set 'containers[].securityContext.runAsGroup' to a non-zero integer or leave undefined.",
- "Severity": "LOW",
- "PrimaryURL": "https://avd.aquasec.com/misconfig/ksv116",
- "References": [
- "https://kubesec.io/basics/containers-securitycontext-runasuser/",
- "https://avd.aquasec.com/misconfig/ksv116"
- ],
- "Status": "FAIL",
- "Layer": {},
- "CauseMetadata": {
- "Provider": "Kubernetes",
- "Service": "general",
- "Code": {
- "Lines": null
- }
- }
- }
- ]
+ }
}
]
}
diff --git a/integration/testdata/pom-cyclonedx.json.golden b/integration/testdata/pom-cyclonedx.json.golden
index ac245de144ce..5487c239e2da 100644
--- a/integration/testdata/pom-cyclonedx.json.golden
+++ b/integration/testdata/pom-cyclonedx.json.golden
@@ -6,13 +6,16 @@
"version": 1,
"metadata": {
"timestamp": "2021-08-25T12:20:30+00:00",
- "tools": [
- {
- "vendor": "aquasecurity",
- "name": "trivy",
- "version": "dev"
- }
- ],
+ "tools": {
+ "components": [
+ {
+ "type": "application",
+ "group": "aquasecurity",
+ "name": "trivy",
+ "version": "dev"
+ }
+ ]
+ },
"component": {
"bom-ref": "3ff14136-e09f-4df9-80ea-000000000002",
"type": "application",
@@ -44,7 +47,8 @@
{
"bom-ref": "pkg:maven/com.example/log4shell@1.0-SNAPSHOT",
"type": "library",
- "name": "com.example:log4shell",
+ "group": "com.example",
+ "name": "log4shell",
"version": "1.0-SNAPSHOT",
"purl": "pkg:maven/com.example/log4shell@1.0-SNAPSHOT",
"properties": [
@@ -61,7 +65,8 @@
{
"bom-ref": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1",
"type": "library",
- "name": "com.fasterxml.jackson.core:jackson-databind",
+ "group": "com.fasterxml.jackson.core",
+ "name": "jackson-databind",
"version": "2.9.1",
"purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1",
"properties": [
diff --git a/integration/testdata/secrets.asff.golden b/integration/testdata/secrets.asff.golden
index 818ad20f8237..b3a7c45fadac 100644
--- a/integration/testdata/secrets.asff.golden
+++ b/integration/testdata/secrets.asff.golden
@@ -2,7 +2,7 @@
"Findings": [{
"SchemaVersion": "2018-10-08",
"Id": "deploy.sh",
- "ProductArn": "arn:aws:securityhub:::product/aquasecurity/aquasecurity",
+ "ProductArn": "arn:aws:securityhub:test-region::product/aquasecurity/aquasecurity",
"GeneratorId": "Trivy",
"AwsAccountId": "123456789012",
"Types": [ "Sensitive Data Identifications" ],
@@ -19,7 +19,7 @@
"Type": "Other",
"Id": "deploy.sh",
"Partition": "aws",
- "Region": "",
+ "Region": "test-region",
"Details": {
"Other": {
"Filename": "deploy.sh"
@@ -31,7 +31,7 @@
},{
"SchemaVersion": "2018-10-08",
"Id": "deploy.sh",
- "ProductArn": "arn:aws:securityhub:::product/aquasecurity/aquasecurity",
+ "ProductArn": "arn:aws:securityhub:test-region::product/aquasecurity/aquasecurity",
"GeneratorId": "Trivy",
"AwsAccountId": "123456789012",
"Types": [ "Sensitive Data Identifications" ],
@@ -48,7 +48,7 @@
"Type": "Other",
"Id": "deploy.sh",
"Partition": "aws",
- "Region": "",
+ "Region": "test-region",
"Details": {
"Other": {
"Filename": "deploy.sh"
diff --git a/mkdocs.yml b/mkdocs.yml
index 59ad99752b37..4e7bf1ee633a 100644
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -176,7 +176,7 @@ nav:
- CI/CD: ecosystem/cicd.md
- IDE and Dev tools: ecosystem/ide.md
- Production and Clouds: ecosystem/prod.md
- - Security Management: ecosystem/security.md
+ - Reporting: ecosystem/reporting.md
- Contributing:
- How to contribute:
- Issues: community/contribute/issue.md
diff --git a/pkg/detector/ospkg/alpine/alpine.go b/pkg/detector/ospkg/alpine/alpine.go
index 4602df844727..4be5cf128431 100644
--- a/pkg/detector/ospkg/alpine/alpine.go
+++ b/pkg/detector/ospkg/alpine/alpine.go
@@ -46,6 +46,7 @@ var (
"3.16": time.Date(2024, 5, 23, 23, 59, 59, 0, time.UTC),
"3.17": time.Date(2024, 11, 22, 23, 59, 59, 0, time.UTC),
"3.18": time.Date(2025, 5, 9, 23, 59, 59, 0, time.UTC),
+ "3.19": time.Date(2025, 11, 1, 23, 59, 59, 0, time.UTC),
"edge": time.Date(9999, 1, 1, 0, 0, 0, 0, time.UTC),
}
)
diff --git a/pkg/fanal/analyzer/imgconf/dockerfile/dockerfile.go b/pkg/fanal/analyzer/imgconf/dockerfile/dockerfile.go
index 269a6aa86733..8c433499aca7 100644
--- a/pkg/fanal/analyzer/imgconf/dockerfile/dockerfile.go
+++ b/pkg/fanal/analyzer/imgconf/dockerfile/dockerfile.go
@@ -52,6 +52,15 @@ func (a *historyAnalyzer) Analyze(ctx context.Context, input analyzer.ConfigAnal
case strings.HasPrefix(h.CreatedBy, "/bin/sh -c"):
// RUN instruction
createdBy = strings.ReplaceAll(h.CreatedBy, "/bin/sh -c", "RUN")
+ case strings.HasSuffix(h.CreatedBy, "# buildkit"):
+ // buildkit instructions
+ // COPY ./foo /foo # buildkit
+ // ADD ./foo.txt /foo.txt # buildkit
+ // RUN /bin/sh -c ls -hl /foo # buildkit
+ createdBy = strings.TrimSuffix(h.CreatedBy, "# buildkit")
+ if strings.HasPrefix(h.CreatedBy, "RUN /bin/sh -c") {
+ createdBy = strings.ReplaceAll(createdBy, "RUN /bin/sh -c", "RUN")
+ }
case strings.HasPrefix(h.CreatedBy, "USER"):
// USER instruction
createdBy = h.CreatedBy
diff --git a/pkg/fanal/analyzer/imgconf/dockerfile/dockerfile_test.go b/pkg/fanal/analyzer/imgconf/dockerfile/dockerfile_test.go
index 2c822ab1ae77..dc165ff39f43 100644
--- a/pkg/fanal/analyzer/imgconf/dockerfile/dockerfile_test.go
+++ b/pkg/fanal/analyzer/imgconf/dockerfile/dockerfile_test.go
@@ -94,6 +94,92 @@ func Test_historyAnalyzer_Analyze(t *testing.T) {
},
},
},
+ {
+ name: "happy path with buildkit instructions",
+ input: analyzer.ConfigAnalysisInput{
+ Config: &v1.ConfigFile{
+ Config: v1.Config{
+ Healthcheck: &v1.HealthConfig{
+ Test: []string{"CMD-SHELL", "curl --fail http://localhost:3000 || exit 1"},
+ Interval: time.Second * 10,
+ Timeout: time.Second * 3,
+ },
+ },
+ History: []v1.History{
+ {
+ CreatedBy: "/bin/sh -c #(nop) ADD file:289c2fac17119508ced527225d445747cd177111b4a0018a6b04948ecb3b5e29 in / ",
+ EmptyLayer: false,
+ },
+ {
+ CreatedBy: "/bin/sh -c #(nop) CMD [\"/bin/sh\"]",
+ EmptyLayer: true,
+ },
+ {
+ CreatedBy: "ADD ./foo.txt /foo.txt # buildkit",
+ EmptyLayer: false,
+ },
+ {
+ CreatedBy: "COPY ./foo /foo # buildkit",
+ EmptyLayer: false,
+ },
+ {
+ CreatedBy: "RUN /bin/sh -c ls -hl /foo # buildkit",
+ EmptyLayer: false,
+ },
+ {
+ CreatedBy: "USER foo",
+ EmptyLayer: true,
+ },
+ {
+ CreatedBy: `HEALTHCHECK &{["CMD-SHELL" "curl -sS 127.0.0.1 || exit 1"] "10s" "3s" "0s" '\x00'}`,
+ EmptyLayer: true,
+ },
+ },
+ },
+ },
+ want: &analyzer.ConfigAnalysisResult{
+ Misconfiguration: &types.Misconfiguration{
+ FileType: "dockerfile",
+ FilePath: "Dockerfile",
+ Failures: types.MisconfResults{
+ types.MisconfResult{
+ Namespace: "builtin.dockerfile.DS005",
+ Query: "data.builtin.dockerfile.DS005.deny",
+ Message: "Consider using 'COPY ./foo.txt /foo.txt' command instead of 'ADD ./foo.txt /foo.txt'",
+ PolicyMetadata: types.PolicyMetadata{
+ ID: "DS005",
+ AVDID: "AVD-DS-0005",
+ Type: "Dockerfile Security Check",
+ Title: "ADD instead of COPY",
+ Description: "You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files.",
+ Severity: "LOW",
+ RecommendedActions: "Use COPY instead of ADD",
+ References: []string{"https://docs.docker.com/engine/reference/builder/#add"},
+ },
+ CauseMetadata: types.CauseMetadata{
+ Provider: "Dockerfile",
+ Service: "general",
+ StartLine: 1,
+ EndLine: 1,
+ Code: types.Code{
+ Lines: []types.Line{
+ {
+ Number: 1,
+ Content: "ADD ./foo.txt /foo.txt",
+ IsCause: true,
+ Truncated: false,
+ Highlighted: "\x1b[38;5;64mADD\x1b[0m ./foo.txt /foo.txt",
+ FirstCause: true,
+ LastCause: true,
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
{
name: "happy path. Base layer is found",
input: analyzer.ConfigAnalysisInput{
diff --git a/pkg/fanal/analyzer/language/java/pom/pom_test.go b/pkg/fanal/analyzer/language/java/pom/pom_test.go
index 9a5214e806e5..10cec453b863 100644
--- a/pkg/fanal/analyzer/language/java/pom/pom_test.go
+++ b/pkg/fanal/analyzer/language/java/pom/pom_test.go
@@ -29,11 +29,25 @@ func Test_pomAnalyzer_Analyze(t *testing.T) {
Type: types.Pom,
FilePath: "testdata/happy/pom.xml",
Libraries: types.Packages{
+ {
+ ID: "com.example:example-api:2.0.0",
+ Name: "com.example:example-api",
+ Version: "2.0.0",
+ Locations: []types.Location{
+ {
+ StartLine: 28,
+ EndLine: 32,
+ },
+ },
+ },
{
ID: "com.example:example:1.0.0",
Name: "com.example:example",
Version: "1.0.0",
Licenses: []string{"Apache-2.0"},
+ DependsOn: []string{
+ "com.example:example-api:2.0.0",
+ },
},
},
},
@@ -50,11 +64,25 @@ func Test_pomAnalyzer_Analyze(t *testing.T) {
Type: types.Pom,
FilePath: "pom.xml",
Libraries: types.Packages{
+ {
+ ID: "com.example:example-api:2.0.0",
+ Name: "com.example:example-api",
+ Version: "2.0.0",
+ Locations: []types.Location{
+ {
+ StartLine: 28,
+ EndLine: 32,
+ },
+ },
+ },
{
ID: "com.example:example:1.0.0",
Name: "com.example:example",
Version: "1.0.0",
Licenses: []string{"Apache-2.0"},
+ DependsOn: []string{
+ "com.example:example-api:2.0.0",
+ },
},
},
},
@@ -104,6 +132,9 @@ func Test_pomAnalyzer_Analyze(t *testing.T) {
Dir: tt.inputDir,
FilePath: tt.inputFile,
Content: f,
+ Options: analyzer.AnalysisOptions{
+ Offline: true,
+ },
})
if tt.wantErr != "" {
require.NotNil(t, err)
diff --git a/pkg/fanal/analyzer/language/java/pom/testdata/happy/pom.xml b/pkg/fanal/analyzer/language/java/pom/testdata/happy/pom.xml
index c4764b000af2..aa5f1066295c 100644
--- a/pkg/fanal/analyzer/language/java/pom/testdata/happy/pom.xml
+++ b/pkg/fanal/analyzer/language/java/pom/testdata/happy/pom.xml
@@ -23,4 +23,12 @@
https://github.com/knqyf263
+
+
+
+ com.example
+ example-api
+ 2.0.0
+
+
diff --git a/pkg/fanal/analyzer/language/nodejs/npm/npm.go b/pkg/fanal/analyzer/language/nodejs/npm/npm.go
index b827a37f83ff..8f70bd5c25a4 100644
--- a/pkg/fanal/analyzer/language/nodejs/npm/npm.go
+++ b/pkg/fanal/analyzer/language/nodejs/npm/npm.go
@@ -8,7 +8,6 @@ import (
"os"
"path"
"path/filepath"
- "strings"
"golang.org/x/xerrors"
@@ -87,13 +86,14 @@ func (a npmLibraryAnalyzer) PostAnalyze(_ context.Context, input analyzer.PostAn
func (a npmLibraryAnalyzer) Required(filePath string, _ os.FileInfo) bool {
fileName := filepath.Base(filePath)
+ // Don't save package-lock.json from the `node_modules` directory to avoid duplication and mistakes.
if fileName == types.NpmPkgLock && !xpath.Contains(filePath, "node_modules") {
return true
}
- // The file path to package.json - */node_modules//package.json
- // The path is slashed in analyzers.
- dirs := strings.Split(path.Dir(filePath), "/")
- if len(dirs) > 1 && dirs[len(dirs)-2] == "node_modules" && fileName == types.NpmPkg {
+
+ // Save package.json files only from the `node_modules` directory.
+ // Required to search for licenses.
+ if fileName == types.NpmPkg && xpath.Contains(filePath, "node_modules") {
return true
}
return false
diff --git a/pkg/fanal/analyzer/language/nodejs/npm/npm_test.go b/pkg/fanal/analyzer/language/nodejs/npm/npm_test.go
index ec03e751778f..7635e0266729 100644
--- a/pkg/fanal/analyzer/language/nodejs/npm/npm_test.go
+++ b/pkg/fanal/analyzer/language/nodejs/npm/npm_test.go
@@ -34,6 +34,19 @@ func Test_npmLibraryAnalyzer_Analyze(t *testing.T) {
Type: types.Npm,
FilePath: "package-lock.json",
Libraries: types.Packages{
+ {
+ ID: "@babel/parser@7.23.6",
+ Name: "@babel/parser",
+ Version: "7.23.6",
+ Indirect: true,
+ Licenses: []string{"MIT"},
+ Locations: []types.Location{
+ {
+ StartLine: 6,
+ EndLine: 10,
+ },
+ },
+ },
{
ID: "ansi-colors@3.2.3",
Name: "ansi-colors",
@@ -42,8 +55,8 @@ func Test_npmLibraryAnalyzer_Analyze(t *testing.T) {
Indirect: true,
Locations: []types.Location{
{
- StartLine: 6,
- EndLine: 11,
+ StartLine: 11,
+ EndLine: 16,
},
},
},
@@ -54,8 +67,8 @@ func Test_npmLibraryAnalyzer_Analyze(t *testing.T) {
Indirect: true,
Locations: []types.Location{
{
- StartLine: 12,
- EndLine: 16,
+ StartLine: 17,
+ EndLine: 21,
},
},
},
@@ -68,8 +81,8 @@ func Test_npmLibraryAnalyzer_Analyze(t *testing.T) {
Licenses: []string{"MIT"},
Locations: []types.Location{
{
- StartLine: 17,
- EndLine: 39,
+ StartLine: 22,
+ EndLine: 44,
},
},
},
@@ -82,12 +95,12 @@ func Test_npmLibraryAnalyzer_Analyze(t *testing.T) {
Licenses: []string{"MIT"},
Locations: []types.Location{
{
- StartLine: 25,
- EndLine: 32,
+ StartLine: 30,
+ EndLine: 37,
},
{
- StartLine: 48,
- EndLine: 55,
+ StartLine: 53,
+ EndLine: 60,
},
},
},
@@ -100,8 +113,8 @@ func Test_npmLibraryAnalyzer_Analyze(t *testing.T) {
Licenses: []string{"MIT"},
Locations: []types.Location{
{
- StartLine: 40,
- EndLine: 62,
+ StartLine: 45,
+ EndLine: 67,
},
},
},
@@ -113,12 +126,12 @@ func Test_npmLibraryAnalyzer_Analyze(t *testing.T) {
Licenses: []string{"MIT"},
Locations: []types.Location{
{
- StartLine: 33,
- EndLine: 37,
+ StartLine: 38,
+ EndLine: 42,
},
{
- StartLine: 56,
- EndLine: 60,
+ StartLine: 61,
+ EndLine: 65,
},
},
},
@@ -130,8 +143,8 @@ func Test_npmLibraryAnalyzer_Analyze(t *testing.T) {
Licenses: []string{"MIT"},
Locations: []types.Location{
{
- StartLine: 63,
- EndLine: 67,
+ StartLine: 68,
+ EndLine: 72,
},
},
},
@@ -206,9 +219,14 @@ func Test_nodePkgLibraryAnalyzer_Required(t *testing.T) {
filePath: "npm/node_modules/ms/package.json",
want: true,
},
+ {
+ name: "package.json with `/` in name",
+ filePath: "npm/node_modules/@babel/parser/package.json",
+ want: true,
+ },
{
name: "sad path",
- filePath: "npm/node_modules/package.json",
+ filePath: "npm/package.json",
want: false,
},
{
diff --git a/pkg/fanal/analyzer/language/nodejs/npm/testdata/happy/node_modules/@babel/parser/package.json b/pkg/fanal/analyzer/language/nodejs/npm/testdata/happy/node_modules/@babel/parser/package.json
new file mode 100644
index 000000000000..5dc69d812815
--- /dev/null
+++ b/pkg/fanal/analyzer/language/nodejs/npm/testdata/happy/node_modules/@babel/parser/package.json
@@ -0,0 +1,46 @@
+{
+ "name": "@babel/parser",
+ "version": "7.23.6",
+ "description": "A JavaScript parser",
+ "author": "The Babel Team (https://babel.dev/team)",
+ "homepage": "https://babel.dev/docs/en/next/babel-parser",
+ "bugs": "https://github.com/babel/babel/issues?utf8=%E2%9C%93&q=is%3Aissue+label%3A%22pkg%3A+parser+%28babylon%29%22+is%3Aopen",
+ "license": "MIT",
+ "publishConfig": {
+ "access": "public"
+ },
+ "keywords": [
+ "babel",
+ "javascript",
+ "parser",
+ "tc39",
+ "ecmascript",
+ "@babel/parser"
+ ],
+ "repository": {
+ "type": "git",
+ "url": "https://github.com/babel/babel.git",
+ "directory": "packages/babel-parser"
+ },
+ "main": "./lib/index.js",
+ "types": "./typings/babel-parser.d.ts",
+ "files": [
+ "bin",
+ "lib",
+ "typings/babel-parser.d.ts",
+ "index.cjs"
+ ],
+ "engines": {
+ "node": ">=6.0.0"
+ },
+ "devDependencies": {
+ "@babel/code-frame": "^7.23.5",
+ "@babel/helper-check-duplicate-nodes": "^7.22.5",
+ "@babel/helper-fixtures": "^7.23.4",
+ "@babel/helper-string-parser": "^7.23.4",
+ "@babel/helper-validator-identifier": "^7.22.20",
+ "charcodes": "^0.2.0"
+ },
+ "bin": "./bin/babel-parser.js",
+ "type": "commonjs"
+}
\ No newline at end of file
diff --git a/pkg/fanal/analyzer/language/nodejs/npm/testdata/happy/package-lock.json b/pkg/fanal/analyzer/language/nodejs/npm/testdata/happy/package-lock.json
index 6d43d12c7888..60c78b708d60 100644
--- a/pkg/fanal/analyzer/language/nodejs/npm/testdata/happy/package-lock.json
+++ b/pkg/fanal/analyzer/language/nodejs/npm/testdata/happy/package-lock.json
@@ -3,6 +3,11 @@
"lockfileVersion": 1,
"requires": true,
"dependencies": {
+ "@babel/parser": {
+ "version": "7.23.6",
+ "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.23.6.tgz",
+ "integrity": "sha512-Z2uID7YJ7oNvAI20O9X0bblw7Qqs8Q2hFy0R9tAfnfLkp5MW0UH9eUvnDSnFwKZ0AvgS1ucqR4KzvVHgnke1VQ=="
+ },
"ansi-colors": {
"version": "3.2.3",
"resolved": "https://registry.npmjs.org/ansi-colors/-/ansi-colors-3.2.3.tgz",
diff --git a/pkg/fanal/analyzer/pkg/apk/apk_test.go b/pkg/fanal/analyzer/pkg/apk/apk_test.go
index f7b308fcbd49..45ce2a77aa74 100644
--- a/pkg/fanal/analyzer/pkg/apk/apk_test.go
+++ b/pkg/fanal/analyzer/pkg/apk/apk_test.go
@@ -408,8 +408,8 @@ func TestParseApkInfo(t *testing.T) {
t.Run(testname, func(t *testing.T) {
a := alpinePkgAnalyzer{}
f, err := os.Open(tt.path)
- defer f.Close()
require.NoError(t, err)
+ defer f.Close()
scanner := bufio.NewScanner(f)
gotPkgs, gotFiles := a.parseApkInfo(scanner)
diff --git a/pkg/fanal/analyzer/pkg/rpm/rpm.go b/pkg/fanal/analyzer/pkg/rpm/rpm.go
index 1efd91c0e8e1..f3a52286e578 100644
--- a/pkg/fanal/analyzer/pkg/rpm/rpm.go
+++ b/pkg/fanal/analyzer/pkg/rpm/rpm.go
@@ -133,7 +133,7 @@ func (a rpmPkgAnalyzer) listPkgs(db RPMDB) (types.Packages, []string, error) {
// Check if the package is vendor-provided.
// If the package is not provided by vendor, the installed files should not be skipped.
var files []string
- if packageProvidedByVendor(pkg.Vendor) {
+ if packageProvidedByVendor(pkg) {
files, err = pkg.InstalledFileNames()
if err != nil {
return nil, nil, xerrors.Errorf("unable to get installed files: %w", err)
@@ -235,12 +235,19 @@ func splitFileName(filename string) (name, ver, rel string, err error) {
return name, ver, rel, nil
}
-func packageProvidedByVendor(pkgVendor string) bool {
+func packageProvidedByVendor(pkg *rpmdb.PackageInfo) bool {
+ if pkg.Vendor == "" {
+ // Official Amazon packages may not contain `Vendor` field:
+ // https://github.com/aquasecurity/trivy/issues/5887
+ return strings.Contains(pkg.Release, "amzn")
+ }
+
for _, vendor := range osVendors {
- if strings.HasPrefix(pkgVendor, vendor) {
+ if strings.HasPrefix(pkg.Vendor, vendor) {
return true
}
}
+
return false
}
diff --git a/pkg/fanal/analyzer/pkg/rpm/rpm_test.go b/pkg/fanal/analyzer/pkg/rpm/rpm_test.go
index 7e99cc601d61..2ef2a0b46219 100644
--- a/pkg/fanal/analyzer/pkg/rpm/rpm_test.go
+++ b/pkg/fanal/analyzer/pkg/rpm/rpm_test.go
@@ -165,6 +165,62 @@ func Test_rpmPkgAnalyzer_listPkgs(t *testing.T) {
"/lib64/libm-2.27.so",
},
},
+ {
+ name: "Amazon official package without `Vendor` field",
+ mock: mock{
+ packages: []*rpmdb.PackageInfo{
+ {
+ Name: "curl-minimal",
+ Version: "8.3.0",
+ Release: "1.amzn2023.0.2",
+ Arch: "aarch64",
+ SourceRpm: "curl-8.3.0-1.amzn2023.0.2.src.rpm",
+ DirNames: []string{
+ "/usr/bin/",
+ "/usr/lib/",
+ "/usr/lib/.build-id/",
+ "/usr/lib/.build-id/aa/",
+ "/usr/share/man/man1/",
+ },
+ DirIndexes: []int32{0, 1, 2, 3, 4},
+ BaseNames: []string{
+ "curl",
+ ".build-id",
+ "aa",
+ "d987ea9bc1c73706d12c7a143ee792117851ff",
+ "curl.1.gz",
+ },
+ Vendor: "",
+ },
+ },
+ },
+ wantPkgs: types.Packages{
+ {
+ ID: "curl-minimal@8.3.0-1.amzn2023.0.2.aarch64",
+ Name: "curl-minimal",
+ Version: "8.3.0",
+ Release: "1.amzn2023.0.2",
+ Arch: "aarch64",
+ SrcName: "curl",
+ SrcVersion: "8.3.0",
+ SrcRelease: "1.amzn2023.0.2",
+ InstalledFiles: []string{
+ "/usr/bin/curl",
+ "/usr/lib/.build-id",
+ "/usr/lib/.build-id/aa",
+ "/usr/lib/.build-id/aa/d987ea9bc1c73706d12c7a143ee792117851ff",
+ "/usr/share/man/man1/curl.1.gz",
+ },
+ },
+ },
+ wantFiles: []string{
+ "/usr/bin/curl",
+ "/usr/lib/.build-id",
+ "/usr/lib/.build-id/aa",
+ "/usr/lib/.build-id/aa/d987ea9bc1c73706d12c7a143ee792117851ff",
+ "/usr/share/man/man1/curl.1.gz",
+ },
+ },
{
name: "invalid source rpm",
mock: mock{
diff --git a/pkg/fanal/analyzer/sbom/sbom.go b/pkg/fanal/analyzer/sbom/sbom.go
index 51b5178c781c..efb9829a1593 100644
--- a/pkg/fanal/analyzer/sbom/sbom.go
+++ b/pkg/fanal/analyzer/sbom/sbom.go
@@ -88,9 +88,6 @@ func handleBitnamiImages(componentPath string, bom types.SBOM) {
// If the file path is empty, the file path will be set to the component dir path.
filePath := path.Join(componentPath, pkg.FilePath)
bom.Applications[i].Libraries[j].FilePath = filePath
- if pkg.Identifier.PURL != nil && pkg.Identifier.PURL.FilePath != "" {
- bom.Applications[i].Libraries[j].Identifier.PURL.FilePath = filePath
- }
}
}
}
diff --git a/pkg/fanal/analyzer/sbom/sbom_test.go b/pkg/fanal/analyzer/sbom/sbom_test.go
index 4e37834d04d8..096d0ececec5 100644
--- a/pkg/fanal/analyzer/sbom/sbom_test.go
+++ b/pkg/fanal/analyzer/sbom/sbom_test.go
@@ -35,13 +35,11 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
Version: "1.36.0",
FilePath: "opt/bitnami/elasticsearch",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "co.elastic.apm",
- Name: "apm-agent",
- Version: "1.36.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "co.elastic.apm",
+ Name: "apm-agent",
+ Version: "1.36.0",
},
},
},
@@ -50,13 +48,11 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
Version: "1.36.0",
FilePath: "opt/bitnami/elasticsearch",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "co.elastic.apm",
- Name: "apm-agent-cached-lookup-key",
- Version: "1.36.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "co.elastic.apm",
+ Name: "apm-agent-cached-lookup-key",
+ Version: "1.36.0",
},
},
},
@@ -65,13 +61,11 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
Version: "1.36.0",
FilePath: "opt/bitnami/elasticsearch",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "co.elastic.apm",
- Name: "apm-agent-common",
- Version: "1.36.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "co.elastic.apm",
+ Name: "apm-agent-common",
+ Version: "1.36.0",
},
},
},
@@ -80,13 +74,11 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
Version: "1.36.0",
FilePath: "opt/bitnami/elasticsearch",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "co.elastic.apm",
- Name: "apm-agent-core",
- Version: "1.36.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "co.elastic.apm",
+ Name: "apm-agent-core",
+ Version: "1.36.0",
},
},
},
@@ -102,16 +94,14 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
Arch: "arm64",
Licenses: []string{"Elastic-2.0"},
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeBitnami,
- Name: "elasticsearch",
- Version: "8.9.1",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "arch",
- Value: "arm64",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeBitnami,
+ Name: "elasticsearch",
+ Version: "8.9.1",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "arch",
+ Value: "arm64",
},
},
},
@@ -137,14 +127,11 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
Name: "co.elastic.apm:apm-agent",
Version: "1.36.0",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "co.elastic.apm",
- Name: "apm-agent",
- Version: "1.36.0",
- },
- FilePath: "opt/bitnami/elasticsearch/modules/apm/elastic-apm-agent-1.36.0.jar",
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "co.elastic.apm",
+ Name: "apm-agent",
+ Version: "1.36.0",
},
BOMRef: "pkg:maven/co.elastic.apm/apm-agent@1.36.0",
},
@@ -154,14 +141,11 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
Name: "co.elastic.apm:apm-agent-cached-lookup-key",
Version: "1.36.0",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "co.elastic.apm",
- Name: "apm-agent-cached-lookup-key",
- Version: "1.36.0",
- },
- FilePath: "opt/bitnami/elasticsearch/modules/apm/elastic-apm-agent-1.36.0.jar",
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "co.elastic.apm",
+ Name: "apm-agent-cached-lookup-key",
+ Version: "1.36.0",
},
BOMRef: "pkg:maven/co.elastic.apm/apm-agent-cached-lookup-key@1.36.0",
},
@@ -187,12 +171,10 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
Version: "3.7.1",
Licenses: []string{"MIT"},
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeBitnami,
- Name: "gdal",
- Version: "3.7.1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeBitnami,
+ Name: "gdal",
+ Version: "3.7.1",
},
},
},
@@ -201,12 +183,10 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
Version: "3.8.3",
Licenses: []string{"LGPL-2.1-only"},
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeBitnami,
- Name: "geos",
- Version: "3.8.3",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeBitnami,
+ Name: "geos",
+ Version: "3.8.3",
},
},
},
@@ -215,12 +195,10 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
Version: "15.3.0",
Licenses: []string{"PostgreSQL"},
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeBitnami,
- Name: "postgresql",
- Version: "15.3.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeBitnami,
+ Name: "postgresql",
+ Version: "15.3.0",
},
},
},
@@ -229,12 +207,10 @@ func Test_sbomAnalyzer_Analyze(t *testing.T) {
Version: "6.3.2",
Licenses: []string{"MIT"},
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeBitnami,
- Name: "proj",
- Version: "6.3.2",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeBitnami,
+ Name: "proj",
+ Version: "6.3.2",
},
},
},
diff --git a/pkg/fanal/analyzer/sbom/testdata/cdx.json b/pkg/fanal/analyzer/sbom/testdata/cdx.json
index 639677780faf..a006bf7053e2 100644
--- a/pkg/fanal/analyzer/sbom/testdata/cdx.json
+++ b/pkg/fanal/analyzer/sbom/testdata/cdx.json
@@ -5,13 +5,16 @@
"version": 1,
"metadata": {
"timestamp": "2023-06-01T13:10:23+00:00",
- "tools": [
- {
- "vendor": "aquasecurity",
- "name": "trivy",
- "version": "0.41.0-80-g1c03982fe"
- }
- ],
+ "tools": {
+ "components": [
+ {
+ "type": "application",
+ "group": "aquasecurity",
+ "name": "trivy",
+ "version": "0.41.0-80-g1c03982fe"
+ }
+ ]
+ },
"component": {
"bom-ref": "pkg:oci/elasticsearch@sha256:d4b68b602eb3d92ea3256886761752ae1159dc01fd391f4c4a87ebf6ba9d3895?repository_url=index.docker.io%2Fbitnami%2Felasticsearch\u0026arch=arm64",
"type": "container",
diff --git a/pkg/fanal/applier/applier_test.go b/pkg/fanal/applier/applier_test.go
index 0994d46bfc39..8037e0bee922 100644
--- a/pkg/fanal/applier/applier_test.go
+++ b/pkg/fanal/applier/applier_test.go
@@ -151,17 +151,15 @@ func TestApplier_ApplyLayers(t *testing.T) {
SrcName: "glibc",
SrcVersion: "2.24-11+deb9u4",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeDebian,
- Namespace: "debian",
- Name: "libc6",
- Version: "2.24-11+deb9u4",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "distro",
- Value: "debian-9.9",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeDebian,
+ Namespace: "debian",
+ Name: "libc6",
+ Version: "2.24-11+deb9u4",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "distro",
+ Value: "debian-9.9",
},
},
},
@@ -177,17 +175,15 @@ func TestApplier_ApplyLayers(t *testing.T) {
SrcName: "tzdata",
SrcVersion: "2019a-0+deb9u1",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeDebian,
- Namespace: "debian",
- Name: "tzdata",
- Version: "2019a-0+deb9u1",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "distro",
- Value: "debian-9.9",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeDebian,
+ Namespace: "debian",
+ Name: "tzdata",
+ Version: "2019a-0+deb9u1",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "distro",
+ Value: "debian-9.9",
},
},
},
@@ -211,13 +207,11 @@ func TestApplier_ApplyLayers(t *testing.T) {
DiffID: "sha256:24df0d4e20c0f42d3703bf1f1db2bdd77346c7956f74f423603d651e8e5ae8a7",
},
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeComposer,
- Namespace: "guzzlehttp",
- Name: "guzzle",
- Version: "6.2.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Namespace: "guzzlehttp",
+ Name: "guzzle",
+ Version: "6.2.0",
},
},
},
@@ -229,13 +223,11 @@ func TestApplier_ApplyLayers(t *testing.T) {
DiffID: "sha256:24df0d4e20c0f42d3703bf1f1db2bdd77346c7956f74f423603d651e8e5ae8a7",
},
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeComposer,
- Namespace: "symfony",
- Name: "process",
- Version: "v4.2.7",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Namespace: "symfony",
+ Name: "process",
+ Version: "v4.2.7",
},
},
},
@@ -353,17 +345,15 @@ func TestApplier_ApplyLayers(t *testing.T) {
Name: "busybox",
Version: "1.30.1-r3",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeApk,
- Namespace: "alpine",
- Name: "busybox",
- Version: "1.30.1-r3",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "distro",
- Value: "3.10.4",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeApk,
+ Namespace: "alpine",
+ Name: "busybox",
+ Version: "1.30.1-r3",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "distro",
+ Value: "3.10.4",
},
},
},
@@ -377,17 +367,15 @@ func TestApplier_ApplyLayers(t *testing.T) {
Name: "libcrypto1.1",
Version: "1.1.1d-r2",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeApk,
- Namespace: "alpine",
- Name: "libcrypto1.1",
- Version: "1.1.1d-r2",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "distro",
- Value: "3.10.4",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeApk,
+ Namespace: "alpine",
+ Name: "libcrypto1.1",
+ Version: "1.1.1d-r2",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "distro",
+ Value: "3.10.4",
},
},
},
@@ -401,17 +389,15 @@ func TestApplier_ApplyLayers(t *testing.T) {
Name: "libssl1.1",
Version: "1.1.1d-r2",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeApk,
- Namespace: "alpine",
- Name: "libssl1.1",
- Version: "1.1.1d-r2",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "distro",
- Value: "3.10.4",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeApk,
+ Namespace: "alpine",
+ Name: "libssl1.1",
+ Version: "1.1.1d-r2",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "distro",
+ Value: "3.10.4",
},
},
},
@@ -425,17 +411,15 @@ func TestApplier_ApplyLayers(t *testing.T) {
Name: "musl",
Version: "1.1.22-r3",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeApk,
- Namespace: "alpine",
- Name: "musl",
- Version: "1.1.22-r3",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "distro",
- Value: "3.10.4",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeApk,
+ Namespace: "alpine",
+ Name: "musl",
+ Version: "1.1.22-r3",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "distro",
+ Value: "3.10.4",
},
},
},
@@ -450,17 +434,15 @@ func TestApplier_ApplyLayers(t *testing.T) {
Version: "1.1.1d-r2",
Identifier: types.PkgIdentifier{
//PURL: "pkg:apk/alpine/openssl@1.1.1d-r2?distro=3.10.4",
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeApk,
- Namespace: "alpine",
- Name: "openssl",
- Version: "1.1.1d-r2",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "distro",
- Value: "3.10.4",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeApk,
+ Namespace: "alpine",
+ Name: "openssl",
+ Version: "1.1.1d-r2",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "distro",
+ Value: "3.10.4",
},
},
},
@@ -684,13 +666,11 @@ func TestApplier_ApplyLayers(t *testing.T) {
DiffID: "sha256:24df0d4e20c0f42d3703bf1f1db2bdd77346c7956f74f423603d651e8e5ae8a7",
},
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeComposer,
- Namespace: "guzzlehttp",
- Name: "guzzle",
- Version: "6.2.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Namespace: "guzzlehttp",
+ Name: "guzzle",
+ Version: "6.2.0",
},
},
},
@@ -702,13 +682,11 @@ func TestApplier_ApplyLayers(t *testing.T) {
DiffID: "sha256:24df0d4e20c0f42d3703bf1f1db2bdd77346c7956f74f423603d651e8e5ae8a7",
},
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeComposer,
- Namespace: "symfony",
- Name: "process",
- Version: "v4.2.7",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Namespace: "symfony",
+ Name: "process",
+ Version: "v4.2.7",
},
},
},
@@ -896,13 +874,11 @@ func TestApplier_ApplyLayers(t *testing.T) {
DiffID: "sha256:aad63a9339440e7c3e1fff2b988991b9bfb81280042fa7f39a5e327023056819",
},
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeComposer,
- Namespace: "guzzlehttp",
- Name: "guzzle",
- Version: "6.2.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Namespace: "guzzlehttp",
+ Name: "guzzle",
+ Version: "6.2.0",
},
},
},
@@ -914,13 +890,11 @@ func TestApplier_ApplyLayers(t *testing.T) {
DiffID: "sha256:aad63a9339440e7c3e1fff2b988991b9bfb81280042fa7f39a5e327023056819",
},
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeComposer,
- Namespace: "symfony",
- Name: "process",
- Version: "v4.2.7",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Namespace: "symfony",
+ Name: "process",
+ Version: "v4.2.7",
},
},
},
diff --git a/pkg/fanal/applier/docker.go b/pkg/fanal/applier/docker.go
index 68de804c89b1..730737e8a370 100644
--- a/pkg/fanal/applier/docker.go
+++ b/pkg/fanal/applier/docker.go
@@ -6,6 +6,7 @@ import (
"time"
"github.com/knqyf263/nested"
+ "github.com/package-url/packageurl-go"
"github.com/samber/lo"
ftypes "github.com/aquasecurity/trivy/pkg/fanal/types"
@@ -249,12 +250,13 @@ func ApplyLayers(layers []ftypes.BlobInfo) ftypes.ArtifactDetail {
return mergedLayer
}
-func newPURL(pkgType ftypes.TargetType, metadata types.Metadata, pkg ftypes.Package) *ftypes.PackageURL {
+func newPURL(pkgType ftypes.TargetType, metadata types.Metadata, pkg ftypes.Package) *packageurl.PackageURL {
p, err := purl.New(pkgType, metadata, pkg)
if err != nil {
log.Logger.Errorf("Failed to create PackageURL: %s", err)
+ return nil
}
- return p
+ return p.Unwrap()
}
// aggregate merges all packages installed by pip/gem/npm/jar/conda into each application
diff --git a/pkg/fanal/applier/docker_test.go b/pkg/fanal/applier/docker_test.go
index a8076f3bb4e5..425930b9ba2e 100644
--- a/pkg/fanal/applier/docker_test.go
+++ b/pkg/fanal/applier/docker_test.go
@@ -1,10 +1,10 @@
package applier_test
import (
- "github.com/package-url/packageurl-go"
"sort"
"testing"
+ "github.com/package-url/packageurl-go"
"github.com/stretchr/testify/assert"
"github.com/aquasecurity/trivy/pkg/fanal/applier"
@@ -145,17 +145,15 @@ func TestApplyLayers(t *testing.T) {
Version: "1.2.4",
Release: "4.5.8",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeApk,
- Namespace: "alpine",
- Name: "musl",
- Version: "1.2.4-4.5.8",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "distro",
- Value: "3.10",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeApk,
+ Namespace: "alpine",
+ Name: "musl",
+ Version: "1.2.4-4.5.8",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "distro",
+ Value: "3.10",
},
},
},
@@ -170,17 +168,15 @@ func TestApplyLayers(t *testing.T) {
Version: "1.2.3",
Release: "4.5.6",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeApk,
- Namespace: "alpine",
- Name: "openssl",
- Version: "1.2.3-4.5.6",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "distro",
- Value: "3.10",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeApk,
+ Namespace: "alpine",
+ Name: "openssl",
+ Version: "1.2.3-4.5.6",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "distro",
+ Value: "3.10",
},
},
},
@@ -204,13 +200,10 @@ func TestApplyLayers(t *testing.T) {
DiffID: "sha256:a187dde48cd289ac374ad8539930628314bc581a481cdb41409c9289419ddb72",
},
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGem,
- Name: "activesupport",
- Version: "6.0.2.1",
- },
- FilePath: "var/lib/gems/2.5.0/specifications/activesupport-6.0.2.1.gemspec",
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGem,
+ Name: "activesupport",
+ Version: "6.0.2.1",
},
},
},
@@ -223,13 +216,10 @@ func TestApplyLayers(t *testing.T) {
DiffID: "sha256:a187dde48cd289ac374ad8539930628314bc581a481cdb41409c9289419ddb72",
},
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGem,
- Name: "gon",
- Version: "6.3.2",
- },
- FilePath: "usr/local/bundle/specifications/gon-6.3.2.gemspec",
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGem,
+ Name: "gon",
+ Version: "6.3.2",
},
},
},
@@ -247,12 +237,10 @@ func TestApplyLayers(t *testing.T) {
DiffID: "sha256:a187dde48cd289ac374ad8539930628314bc581a481cdb41409c9289419ddb72",
},
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGem,
- Name: "gemlibrary1",
- Version: "1.2.3",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGem,
+ Name: "gemlibrary1",
+ Version: "1.2.3",
},
},
},
@@ -474,12 +462,10 @@ func TestApplyLayers(t *testing.T) {
DiffID: "sha256:a187dde48cd289ac374ad8539930628314bc581a481cdb41409c9289419ddb72",
},
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGem,
- Name: "rack",
- Version: "4.0.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGem,
+ Name: "rack",
+ Version: "4.0.0",
},
},
},
@@ -491,12 +477,10 @@ func TestApplyLayers(t *testing.T) {
DiffID: "sha256:aad63a9339440e7c3e1fff2b988991b9bfb81280042fa7f39a5e327023056819",
},
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGem,
- Name: "rails",
- Version: "6.0.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGem,
+ Name: "rails",
+ Version: "6.0.0",
},
},
},
@@ -514,12 +498,10 @@ func TestApplyLayers(t *testing.T) {
DiffID: "sha256:aad63a9339440e7c3e1fff2b988991b9bfb81280042fa7f39a5e327023056819",
},
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeComposer,
- Name: "phplibrary1",
- Version: "6.6.6",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Name: "phplibrary1",
+ Version: "6.6.6",
},
},
},
@@ -779,17 +761,15 @@ func TestApplyLayers(t *testing.T) {
Release: "4.5.7",
Licenses: []string{"GPL-2"},
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeDebian,
- Namespace: "debian",
- Name: "libc",
- Version: "1.2.4-4.5.7",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "distro",
- Value: "debian-8",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeDebian,
+ Namespace: "debian",
+ Name: "libc",
+ Version: "1.2.4-4.5.7",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "distro",
+ Value: "debian-8",
},
},
},
@@ -805,17 +785,15 @@ func TestApplyLayers(t *testing.T) {
Release: "4.5.6",
Licenses: []string{"OpenSSL"},
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeDebian,
- Namespace: "debian",
- Name: "openssl",
- Version: "1.2.3-4.5.6",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "distro",
- Value: "debian-8",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeDebian,
+ Namespace: "debian",
+ Name: "openssl",
+ Version: "1.2.3-4.5.6",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "distro",
+ Value: "debian-8",
},
},
},
@@ -957,17 +935,15 @@ func TestApplyLayers(t *testing.T) {
Version: "5.6.7",
Release: "8",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeRPM,
- Namespace: "redhat",
- Name: "bash",
- Version: "5.6.7-8",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "distro",
- Value: "redhat-8",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeRPM,
+ Namespace: "redhat",
+ Name: "bash",
+ Version: "5.6.7-8",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "distro",
+ Value: "redhat-8",
},
},
},
@@ -986,17 +962,15 @@ func TestApplyLayers(t *testing.T) {
Version: "1.2.4",
Release: "5",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeRPM,
- Namespace: "redhat",
- Name: "libc",
- Version: "1.2.4-5",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "distro",
- Value: "redhat-8",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeRPM,
+ Namespace: "redhat",
+ Name: "libc",
+ Version: "1.2.4-5",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "distro",
+ Value: "redhat-8",
},
},
},
@@ -1017,17 +991,15 @@ func TestApplyLayers(t *testing.T) {
Version: "1.2.3",
Release: "4",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeRPM,
- Namespace: "redhat",
- Name: "openssl",
- Version: "1.2.3-4",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "distro",
- Value: "redhat-8",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeRPM,
+ Namespace: "redhat",
+ Name: "openssl",
+ Version: "1.2.3-4",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "distro",
+ Value: "redhat-8",
},
},
},
diff --git a/pkg/fanal/artifact/image/remote_sbom_test.go b/pkg/fanal/artifact/image/remote_sbom_test.go
index 6b21e2200233..3e445fc0b9ee 100644
--- a/pkg/fanal/artifact/image/remote_sbom_test.go
+++ b/pkg/fanal/artifact/image/remote_sbom_test.go
@@ -84,17 +84,15 @@ func TestArtifact_InspectRekorAttestation(t *testing.T) {
Name: "musl",
Version: "1.2.3-r0",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeApk,
- Namespace: "alpine",
- Name: "musl",
- Version: "1.2.3-r0",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "distro",
- Value: "3.16.2",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeApk,
+ Namespace: "alpine",
+ Name: "musl",
+ Version: "1.2.3-r0",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "distro",
+ Value: "3.16.2",
},
},
},
@@ -235,13 +233,11 @@ func TestArtifact_inspectOCIReferrerSBOM(t *testing.T) {
Name: "github.com/opencontainers/go-digest",
Version: "v1.0.0",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGolang,
- Namespace: "github.com/opencontainers",
- Name: "go-digest",
- Version: "v1.0.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGolang,
+ Namespace: "github.com/opencontainers",
+ Name: "go-digest",
+ Version: "v1.0.0",
},
BOMRef: "pkg:golang/github.com/opencontainers/go-digest@v1.0.0",
},
@@ -250,13 +246,11 @@ func TestArtifact_inspectOCIReferrerSBOM(t *testing.T) {
Name: "golang.org/x/sync",
Version: "v0.1.0",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGolang,
- Namespace: "golang.org/x",
- Name: "sync",
- Version: "v0.1.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGolang,
+ Namespace: "golang.org/x",
+ Name: "sync",
+ Version: "v0.1.0",
},
BOMRef: "pkg:golang/golang.org/x/sync@v0.1.0",
},
diff --git a/pkg/fanal/artifact/sbom/sbom_test.go b/pkg/fanal/artifact/sbom/sbom_test.go
index e58437141ea8..f0286d4c3198 100644
--- a/pkg/fanal/artifact/sbom/sbom_test.go
+++ b/pkg/fanal/artifact/sbom/sbom_test.go
@@ -50,17 +50,15 @@ func TestArtifact_Inspect(t *testing.T) {
DiffID: "sha256:dd565ff850e7003356e2b252758f9bdc1ff2803f61e995e24c7844f6297f8fc3",
},
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeApk,
- Namespace: "alpine",
- Name: "musl",
- Version: "1.2.3-r0",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "distro",
- Value: "3.16.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeApk,
+ Namespace: "alpine",
+ Name: "musl",
+ Version: "1.2.3-r0",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "distro",
+ Value: "3.16.0",
},
},
},
@@ -82,13 +80,11 @@ func TestArtifact_Inspect(t *testing.T) {
DiffID: "sha256:3c79e832b1b4891a1cb4a326ef8524e0bd14a2537150ac0e203a5677176c1ca1",
},
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeComposer,
- Namespace: "pear",
- Name: "log",
- Version: "1.13.1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Namespace: "pear",
+ Name: "log",
+ Version: "1.13.1",
},
BOMRef: "pkg:composer/pear/log@1.13.1",
},
@@ -101,13 +97,11 @@ func TestArtifact_Inspect(t *testing.T) {
DiffID: "sha256:3c79e832b1b4891a1cb4a326ef8524e0bd14a2537150ac0e203a5677176c1ca1",
},
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeComposer,
- Namespace: "pear",
- Name: "pear_exception",
- Version: "v1.0.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Namespace: "pear",
+ Name: "pear_exception",
+ Version: "v1.0.0",
},
BOMRef: "pkg:composer/pear/pear_exception@v1.0.0",
},
@@ -125,13 +119,11 @@ func TestArtifact_Inspect(t *testing.T) {
DiffID: "sha256:3c79e832b1b4891a1cb4a326ef8524e0bd14a2537150ac0e203a5677176c1ca1",
},
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGolang,
- Namespace: "github.com/package-url",
- Name: "packageurl-go",
- Version: "v0.1.1-0.20220203205134-d70459300c8a",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGolang,
+ Namespace: "github.com/package-url",
+ Name: "packageurl-go",
+ Version: "v0.1.1-0.20220203205134-d70459300c8a",
},
BOMRef: "pkg:golang/github.com/package-url/packageurl-go@v0.1.1-0.20220203205134-d70459300c8a",
},
@@ -150,14 +142,11 @@ func TestArtifact_Inspect(t *testing.T) {
},
FilePath: "app/maven/target/child-project-1.0.jar",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "org.codehaus.mojo",
- Name: "child-project",
- Version: "1.0",
- },
- FilePath: "app/maven/target/child-project-1.0.jar",
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "org.codehaus.mojo",
+ Name: "child-project",
+ Version: "1.0",
},
BOMRef: "pkg:maven/org.codehaus.mojo/child-project@1.0?file_path=app%2Fmaven%2Ftarget%2Fchild-project-1.0.jar",
},
@@ -177,13 +166,10 @@ func TestArtifact_Inspect(t *testing.T) {
},
FilePath: "app/app/package.json",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeNPM,
- Name: "bootstrap",
- Version: "5.0.2",
- },
- FilePath: "app/app/package.json",
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeNPM,
+ Name: "bootstrap",
+ Version: "5.0.2",
},
BOMRef: "pkg:npm/bootstrap@5.0.2?file_path=app%2Fapp%2Fpackage.json",
},
@@ -226,17 +212,15 @@ func TestArtifact_Inspect(t *testing.T) {
SrcVersion: "1.2.3-r0",
Licenses: []string{"MIT"},
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeApk,
- Namespace: "alpine",
- Name: "musl",
- Version: "1.2.3-r0",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "distro",
- Value: "3.16.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeApk,
+ Namespace: "alpine",
+ Name: "musl",
+ Version: "1.2.3-r0",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "distro",
+ Value: "3.16.0",
},
},
},
@@ -258,13 +242,11 @@ func TestArtifact_Inspect(t *testing.T) {
Name: "pear/log",
Version: "1.13.1",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeComposer,
- Namespace: "pear",
- Name: "log",
- Version: "1.13.1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Namespace: "pear",
+ Name: "log",
+ Version: "1.13.1",
},
BOMRef: "pkg:composer/pear/log@1.13.1",
},
@@ -277,13 +259,11 @@ func TestArtifact_Inspect(t *testing.T) {
Name: "pear/pear_exception",
Version: "v1.0.0",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeComposer,
- Namespace: "pear",
- Name: "pear_exception",
- Version: "v1.0.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Namespace: "pear",
+ Name: "pear_exception",
+ Version: "v1.0.0",
},
BOMRef: "pkg:composer/pear/pear_exception@v1.0.0",
},
@@ -301,13 +281,11 @@ func TestArtifact_Inspect(t *testing.T) {
Name: "github.com/package-url/packageurl-go",
Version: "v0.1.1-0.20220203205134-d70459300c8a",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGolang,
- Namespace: "github.com/package-url",
- Name: "packageurl-go",
- Version: "v0.1.1-0.20220203205134-d70459300c8a",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGolang,
+ Namespace: "github.com/package-url",
+ Name: "packageurl-go",
+ Version: "v0.1.1-0.20220203205134-d70459300c8a",
},
BOMRef: "pkg:golang/github.com/package-url/packageurl-go@v0.1.1-0.20220203205134-d70459300c8a",
},
@@ -325,14 +303,11 @@ func TestArtifact_Inspect(t *testing.T) {
Name: "org.codehaus.mojo:child-project",
Version: "1.0",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "org.codehaus.mojo",
- Name: "child-project",
- Version: "1.0",
- },
- FilePath: "app/maven/target/child-project-1.0.jar",
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "org.codehaus.mojo",
+ Name: "child-project",
+ Version: "1.0",
},
BOMRef: "pkg:maven/org.codehaus.mojo/child-project@1.0?file_path=app%2Fmaven%2Ftarget%2Fchild-project-1.0.jar",
},
@@ -351,13 +326,10 @@ func TestArtifact_Inspect(t *testing.T) {
Name: "bootstrap",
Version: "5.0.2",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeNPM,
- Name: "bootstrap",
- Version: "5.0.2",
- },
- FilePath: "app/app/package.json",
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeNPM,
+ Name: "bootstrap",
+ Version: "5.0.2",
},
BOMRef: "pkg:npm/bootstrap@5.0.2?file_path=app%2Fapp%2Fpackage.json",
},
diff --git a/pkg/fanal/artifact/sbom/testdata/bom.json b/pkg/fanal/artifact/sbom/testdata/bom.json
index 2244d48334e2..f8fd55ea6add 100644
--- a/pkg/fanal/artifact/sbom/testdata/bom.json
+++ b/pkg/fanal/artifact/sbom/testdata/bom.json
@@ -5,13 +5,16 @@
"version": 1,
"metadata": {
"timestamp": "2022-05-28T10:20:03.79527Z",
- "tools": [
- {
- "vendor": "aquasecurity",
- "name": "trivy",
- "version": "dev"
- }
- ],
+ "tools": {
+ "components": [
+ {
+ "type": "application",
+ "group": "aquasecurity",
+ "name": "trivy",
+ "version": "dev"
+ }
+ ]
+ },
"component": {
"bom-ref": "0f585d64-4815-4b72-92c5-97dae191fa4a",
"type": "container",
diff --git a/pkg/fanal/artifact/sbom/testdata/os-only-bom.json b/pkg/fanal/artifact/sbom/testdata/os-only-bom.json
index 820057006668..837c16754211 100644
--- a/pkg/fanal/artifact/sbom/testdata/os-only-bom.json
+++ b/pkg/fanal/artifact/sbom/testdata/os-only-bom.json
@@ -5,13 +5,16 @@
"version": 1,
"metadata": {
"timestamp": "2022-05-28T10:20:03.79527Z",
- "tools": [
- {
- "vendor": "aquasecurity",
- "name": "trivy",
- "version": "dev"
- }
- ],
+ "tools": {
+ "components": [
+ {
+ "type": "application",
+ "group": "aquasecurity",
+ "name": "trivy",
+ "version": "dev"
+ }
+ ]
+ },
"component": {
"bom-ref": "0f585d64-4815-4b72-92c5-97dae191fa4a",
"type": "container",
diff --git a/pkg/fanal/handler/unpackaged/unpackaged_test.go b/pkg/fanal/handler/unpackaged/unpackaged_test.go
index 40c3cff54fdd..a37748101144 100644
--- a/pkg/fanal/handler/unpackaged/unpackaged_test.go
+++ b/pkg/fanal/handler/unpackaged/unpackaged_test.go
@@ -46,13 +46,11 @@ func Test_unpackagedHook_Handle(t *testing.T) {
Name: "github.com/spf13/cobra",
Version: "1.5.0",
Identifier: types.PkgIdentifier{
- PURL: &types.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGolang,
- Namespace: "github.com/spf13",
- Name: "cobra",
- Version: "1.5.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGolang,
+ Namespace: "github.com/spf13",
+ Name: "cobra",
+ Version: "1.5.0",
},
BOMRef: "pkg:golang/github.com/spf13/cobra@1.5.0",
},
diff --git a/pkg/fanal/secret/builtin-rules.go b/pkg/fanal/secret/builtin-rules.go
index ce6baa99a245..47eaa716f34d 100644
--- a/pkg/fanal/secret/builtin-rules.go
+++ b/pkg/fanal/secret/builtin-rules.go
@@ -5,7 +5,7 @@ import (
"github.com/samber/lo"
- defsecRules "github.com/aquasecurity/trivy-iac/pkg/rules"
+ defsecRules "github.com/aquasecurity/defsec/pkg/rules"
"github.com/aquasecurity/trivy/pkg/fanal/types"
)
@@ -76,9 +76,9 @@ const (
quote = `["']?`
connect = `\s*(:|=>|=)?\s*`
startSecret = `(^|\s+)`
- endSecret = `(\s+|$)`
+ endSecret = `[.,]?(\s+|$)`
- aws = `(aws)?_?`
+ aws = `aws_?`
)
// This function is exported for trivy-plugin-aqua purposes only
diff --git a/pkg/fanal/secret/scanner_test.go b/pkg/fanal/secret/scanner_test.go
index 7f11c6731ac5..c6567cc28b2d 100644
--- a/pkg/fanal/secret/scanner_test.go
+++ b/pkg/fanal/secret/scanner_test.go
@@ -429,7 +429,7 @@ func TestSecretScanner(t *testing.T) {
Severity: "CRITICAL",
StartLine: 5,
EndLine: 5,
- Match: `aws_sec_key "****************************************"`,
+ Match: ` "created_by": "ENV aws_sec_key "****************************************",`,
Code: types.Code{
Lines: []types.Line{
{
@@ -444,8 +444,8 @@ func TestSecretScanner(t *testing.T) {
},
{
Number: 5,
- Content: "aws_sec_key \"****************************************\"",
- Highlighted: "aws_sec_key \"****************************************\"",
+ Content: " \"created_by\": \"ENV aws_sec_key \"****************************************\",",
+ Highlighted: " \"created_by\": \"ENV aws_sec_key \"****************************************\",",
IsCause: true,
FirstCause: true,
LastCause: true,
@@ -662,7 +662,7 @@ func TestSecretScanner(t *testing.T) {
inputFilePath: filepath.Join("testdata", "aws-secrets.txt"),
want: types.Secret{
FilePath: filepath.Join("testdata", "aws-secrets.txt"),
- Findings: []types.SecretFinding{wantFinding5, wantFinding9, wantFinding10},
+ Findings: []types.SecretFinding{wantFinding5, wantFinding10, wantFinding9},
},
},
{
diff --git a/pkg/fanal/secret/testdata/aws-secrets.txt b/pkg/fanal/secret/testdata/aws-secrets.txt
index 7739ce9bfb79..737708284303 100644
--- a/pkg/fanal/secret/testdata/aws-secrets.txt
+++ b/pkg/fanal/secret/testdata/aws-secrets.txt
@@ -2,4 +2,4 @@
AWS_ACCESS_KEY_ID=AKIA0123456789ABCDEF
"aws_account_ID":'1234-5678-9123'
AWS_example=AKIAIOSFODNN7EXAMPLE
-aws_sec_key "KEYKEYKEYKEYKEYKEYKEYKEYKEYKEYKEYKEYKEYK"
\ No newline at end of file
+ "created_by": "ENV aws_sec_key "KEYKEYKEYKEYKEYKEYKEYKEYKEYKEYKEYKEYKEYK",
\ No newline at end of file
diff --git a/pkg/fanal/types/artifact.go b/pkg/fanal/types/artifact.go
index b715cb7eeb77..2d8e491fc72c 100644
--- a/pkg/fanal/types/artifact.go
+++ b/pkg/fanal/types/artifact.go
@@ -1,9 +1,11 @@
package types
import (
+ "encoding/json"
"time"
v1 "github.com/google/go-containerregistry/pkg/v1"
+ "github.com/package-url/packageurl-go"
"github.com/samber/lo"
"github.com/aquasecurity/trivy/pkg/digest"
@@ -102,8 +104,51 @@ type Package struct {
// PkgIdentifier represents a software identifiers in one of more of the supported formats.
type PkgIdentifier struct {
- PURL *PackageURL `json:",omitempty"`
- BOMRef string `json:",omitempty"` // For CycloneDX
+ PURL *packageurl.PackageURL `json:"-"`
+ BOMRef string `json:",omitempty"` // For CycloneDX
+}
+
+// MarshalJSON customizes the JSON encoding of PkgIdentifier.
+func (id *PkgIdentifier) MarshalJSON() ([]byte, error) {
+ var p string
+ if id.PURL != nil {
+ p = id.PURL.String()
+ }
+
+ type Alias PkgIdentifier
+ return json.Marshal(&struct {
+ PURL string `json:",omitempty"`
+ *Alias
+ }{
+ PURL: p,
+ Alias: (*Alias)(id),
+ })
+}
+
+// UnmarshalJSON customizes the JSON decoding of PkgIdentifier.
+func (id *PkgIdentifier) UnmarshalJSON(data []byte) error {
+ type Alias PkgIdentifier
+ aux := &struct {
+ PURL string `json:",omitempty"`
+ *Alias
+ }{
+ Alias: (*Alias)(id),
+ }
+ if err := json.Unmarshal(data, &aux); err != nil {
+ return err
+ }
+
+ if aux.PURL != "" {
+ p, err := packageurl.FromString(aux.PURL)
+ if err != nil {
+ return err
+ } else if len(p.Qualifiers) == 0 {
+ p.Qualifiers = nil
+ }
+ id.PURL = &p
+ }
+
+ return nil
}
func (id *PkgIdentifier) Empty() bool {
diff --git a/pkg/fanal/types/purl.go b/pkg/fanal/types/purl.go
deleted file mode 100644
index 53ad1cbdc0ec..000000000000
--- a/pkg/fanal/types/purl.go
+++ /dev/null
@@ -1,78 +0,0 @@
-package types
-
-import (
- "encoding/json"
-
- "github.com/package-url/packageurl-go"
- "golang.org/x/xerrors"
-)
-
-type PackageURL struct {
- packageurl.PackageURL
- FilePath string
-}
-
-func (p *PackageURL) BOMRef() string {
- // 'bom-ref' must be unique within BOM, but PURLs may conflict
- // when the same packages are installed in an artifact.
- // In that case, we prefer to make PURLs unique by adding file paths,
- // rather than using UUIDs, even if it is not PURL technically.
- // ref. https://cyclonedx.org/use-cases/#dependency-graph
- purl := p.PackageURL // so that it will not override the qualifiers below
- if p.FilePath != "" {
- purl.Qualifiers = append(purl.Qualifiers,
- packageurl.Qualifier{
- Key: "file_path",
- Value: p.FilePath,
- },
- )
- }
- return purl.String()
-}
-
-func (p *PackageURL) MarshalJSON() ([]byte, error) {
- if p == nil {
- return nil, nil
- }
- return json.Marshal(p.String())
-}
-
-func (p *PackageURL) UnmarshalJSON(b []byte) error {
- var s string
- if err := json.Unmarshal(b, &s); err != nil {
- return err
- }
- purl, err := NewPackageURL(s)
- if err != nil {
- return xerrors.Errorf("failed to parse purl(%s): %w", string(b), err)
- }
- *p = *purl
- return nil
-}
-
-func NewPackageURL(s string) (*PackageURL, error) {
- p, err := packageurl.FromString(s)
- if err != nil {
- return nil, xerrors.Errorf("failed to parse purl(%s): %w", s, err)
- }
-
- // Take out and delete the file path from qualifiers
- var filePath string
- for i, q := range p.Qualifiers {
- if q.Key != "file_path" {
- continue
- }
- filePath = q.Value
- p.Qualifiers = append(p.Qualifiers[:i], p.Qualifiers[i+1:]...)
- break
- }
-
- if len(p.Qualifiers) == 0 {
- p.Qualifiers = nil
- }
-
- return &PackageURL{
- PackageURL: p,
- FilePath: filePath,
- }, nil
-}
diff --git a/pkg/flag/kubernetes_flags.go b/pkg/flag/kubernetes_flags.go
index 084242e3f47f..e493c0497fbc 100644
--- a/pkg/flag/kubernetes_flags.go
+++ b/pkg/flag/kubernetes_flags.go
@@ -80,6 +80,18 @@ var (
Default: "ghcr.io/aquasecurity/node-collector:0.0.9",
Usage: "indicate the image reference for the node-collector scan job",
}
+ QPS = Flag[float32]{
+ Name: "qps",
+ ConfigName: "kubernetes.qps",
+ Default: 5.0,
+ Usage: "specify the maximum QPS to the master from this client",
+ }
+ Burst = Flag[int]{
+ Name: "burst",
+ ConfigName: "kubernetes.burst",
+ Default: 10,
+ Usage: "specify the maximum burst for throttle",
+ }
)
type K8sFlagGroup struct {
@@ -94,6 +106,8 @@ type K8sFlagGroup struct {
NodeCollectorNamespace *Flag[string]
ExcludeOwned *Flag[bool]
ExcludeNodes *Flag[[]string]
+ QPS *Flag[float32]
+ Burst *Flag[int]
}
type K8sOptions struct {
@@ -108,6 +122,8 @@ type K8sOptions struct {
NodeCollectorNamespace string
ExcludeOwned bool
ExcludeNodes map[string]string
+ QPS float32
+ Burst int
}
func NewK8sFlagGroup() *K8sFlagGroup {
@@ -123,6 +139,8 @@ func NewK8sFlagGroup() *K8sFlagGroup {
ExcludeOwned: ExcludeOwned.Clone(),
ExcludeNodes: ExcludeNodes.Clone(),
NodeCollectorImageRef: NodeCollectorImageRef.Clone(),
+ QPS: QPS.Clone(),
+ Burst: Burst.Clone(),
}
}
@@ -143,6 +161,8 @@ func (f *K8sFlagGroup) Flags() []Flagger {
f.ExcludeOwned,
f.ExcludeNodes,
f.NodeCollectorImageRef,
+ f.QPS,
+ f.Burst,
}
}
@@ -178,6 +198,8 @@ func (f *K8sFlagGroup) ToOptions() (K8sOptions, error) {
ExcludeOwned: f.ExcludeOwned.Value(),
ExcludeNodes: exludeNodeLabels,
NodeCollectorImageRef: f.NodeCollectorImageRef.Value(),
+ QPS: f.QPS.Value(),
+ Burst: f.Burst.Value(),
}, nil
}
diff --git a/pkg/flag/options.go b/pkg/flag/options.go
index 60514cd525b5..5a13cfe1906b 100644
--- a/pkg/flag/options.go
+++ b/pkg/flag/options.go
@@ -27,7 +27,7 @@ import (
)
type FlagType interface {
- int | string | []string | bool | time.Duration | float64
+ int | string | []string | bool | time.Duration | float32 | float64
}
type Flag[T FlagType] struct {
diff --git a/pkg/flag/sbom_flags.go b/pkg/flag/sbom_flags.go
index 8bf34560bffb..f5ab1aff3189 100644
--- a/pkg/flag/sbom_flags.go
+++ b/pkg/flag/sbom_flags.go
@@ -19,29 +19,20 @@ var (
Usage: "deprecated",
Deprecated: true,
}
- VEXFlag = Flag[string]{
- Name: "vex",
- ConfigName: "sbom.vex",
- Default: "",
- Usage: "[EXPERIMENTAL] file path to VEX",
- }
)
type SBOMFlagGroup struct {
ArtifactType *Flag[string] // deprecated
SBOMFormat *Flag[string] // deprecated
- VEXPath *Flag[string]
}
type SBOMOptions struct {
- VEXPath string
}
func NewSBOMFlagGroup() *SBOMFlagGroup {
return &SBOMFlagGroup{
ArtifactType: ArtifactTypeFlag.Clone(),
SBOMFormat: SBOMFormatFlag.Clone(),
- VEXPath: VEXFlag.Clone(),
}
}
@@ -53,7 +44,6 @@ func (f *SBOMFlagGroup) Flags() []Flagger {
return []Flagger{
f.ArtifactType,
f.SBOMFormat,
- f.VEXPath,
}
}
@@ -71,7 +61,5 @@ func (f *SBOMFlagGroup) ToOptions() (SBOMOptions, error) {
return SBOMOptions{}, xerrors.New("'--artifact-type' and '--sbom-format' are no longer available")
}
- return SBOMOptions{
- VEXPath: f.VEXPath.Value(),
- }, nil
+ return SBOMOptions{}, nil
}
diff --git a/pkg/flag/vulnerability_flags.go b/pkg/flag/vulnerability_flags.go
index febedc8c5f3f..3989fbfa1c51 100644
--- a/pkg/flag/vulnerability_flags.go
+++ b/pkg/flag/vulnerability_flags.go
@@ -33,17 +33,25 @@ var (
Values: dbTypes.Statuses,
Usage: "comma-separated list of vulnerability status to ignore",
}
+ VEXFlag = Flag[string]{
+ Name: "vex",
+ ConfigName: "vulnerability.vex",
+ Default: "",
+ Usage: "[EXPERIMENTAL] file path to VEX",
+ }
)
type VulnerabilityFlagGroup struct {
VulnType *Flag[[]string]
IgnoreUnfixed *Flag[bool]
IgnoreStatus *Flag[[]string]
+ VEXPath *Flag[string]
}
type VulnerabilityOptions struct {
VulnType []string
IgnoreStatuses []dbTypes.Status
+ VEXPath string
}
func NewVulnerabilityFlagGroup() *VulnerabilityFlagGroup {
@@ -51,6 +59,7 @@ func NewVulnerabilityFlagGroup() *VulnerabilityFlagGroup {
VulnType: VulnTypeFlag.Clone(),
IgnoreUnfixed: IgnoreUnfixedFlag.Clone(),
IgnoreStatus: IgnoreStatusFlag.Clone(),
+ VEXPath: VEXFlag.Clone(),
}
}
@@ -63,6 +72,7 @@ func (f *VulnerabilityFlagGroup) Flags() []Flagger {
f.VulnType,
f.IgnoreUnfixed,
f.IgnoreStatus,
+ f.VEXPath,
}
}
@@ -97,5 +107,6 @@ func (f *VulnerabilityFlagGroup) ToOptions() (VulnerabilityOptions, error) {
return VulnerabilityOptions{
VulnType: f.VulnType.Value(),
IgnoreStatuses: ignoreStatuses,
+ VEXPath: f.VEXPath.Value(),
}, nil
}
diff --git a/pkg/javadb/client.go b/pkg/javadb/client.go
index e1b67b81f781..7b206b6fc9e9 100644
--- a/pkg/javadb/client.go
+++ b/pkg/javadb/client.go
@@ -142,8 +142,8 @@ func (d *DB) SearchBySHA1(sha1 string) (jar.Properties, error) {
}, nil
}
-func (d *DB) SearchByArtifactID(artifactID string) (string, error) {
- indexes, err := d.driver.SelectIndexesByArtifactIDAndFileType(artifactID, types.JarType)
+func (d *DB) SearchByArtifactID(artifactID, version string) (string, error) {
+ indexes, err := d.driver.SelectIndexesByArtifactIDAndFileType(artifactID, version, types.JarType)
if err != nil {
return "", xerrors.Errorf("select error: %w", err)
} else if len(indexes) == 0 {
diff --git a/pkg/k8s/commands/run.go b/pkg/k8s/commands/run.go
index 61ea4860db61..e9e3510f6bce 100644
--- a/pkg/k8s/commands/run.go
+++ b/pkg/k8s/commands/run.go
@@ -30,6 +30,8 @@ func Run(ctx context.Context, args []string, opts flag.Options) error {
cluster, err := k8s.GetCluster(
k8s.WithContext(opts.K8sOptions.ClusterContext),
k8s.WithKubeConfig(opts.K8sOptions.KubeConfig),
+ k8s.WithBurst(opts.K8sOptions.Burst),
+ k8s.WithQPS(opts.K8sOptions.QPS),
)
if err != nil {
return xerrors.Errorf("failed getting k8s cluster: %w", err)
diff --git a/pkg/k8s/scanner/scanner.go b/pkg/k8s/scanner/scanner.go
index bbc7913ae745..ca08f8a86bd1 100644
--- a/pkg/k8s/scanner/scanner.go
+++ b/pkg/k8s/scanner/scanner.go
@@ -577,7 +577,7 @@ func nodeComponent(nf bom.NodeInfo) *core.Component {
Namespace: k8sCoreComponentNamespace,
},
},
- PackageURL: &ftypes.PackageURL{
+ PackageURL: &purl.PackageURL{
PackageURL: *packageurl.NewPackageURL(golang, "", runtimeName, runtimeVersion, packageurl.Qualifiers{}, ""),
},
},
@@ -601,7 +601,7 @@ func toProperties(props map[string]string, namespace string) []core.Property {
return properties
}
-func generatePURL(name, ver, nodeName string) *ftypes.PackageURL {
+func generatePURL(name, ver, nodeName string) *purl.PackageURL {
var namespace string
// Identify k8s distribution. An empty namespace means upstream.
@@ -611,7 +611,7 @@ func generatePURL(name, ver, nodeName string) *ftypes.PackageURL {
namespace = ""
}
- return &ftypes.PackageURL{
+ return &purl.PackageURL{
PackageURL: *packageurl.NewPackageURL(purl.TypeK8s, namespace, name, ver, nil, ""),
}
}
diff --git a/pkg/k8s/scanner/scanner_test.go b/pkg/k8s/scanner/scanner_test.go
index 5f70facd3cf6..ec6d78f73c05 100644
--- a/pkg/k8s/scanner/scanner_test.go
+++ b/pkg/k8s/scanner/scanner_test.go
@@ -2,7 +2,6 @@ package scanner
import (
"context"
- ftypes "github.com/aquasecurity/trivy/pkg/fanal/types"
"sort"
"testing"
@@ -98,7 +97,7 @@ func TestScanner_Scan(t *testing.T) {
Namespace: k8sCoreComponentNamespace,
},
},
- PackageURL: &ftypes.PackageURL{
+ PackageURL: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: purl.TypeK8s,
Name: "k8s.io/kubernetes",
@@ -110,7 +109,7 @@ func TestScanner_Scan(t *testing.T) {
Type: cdx.ComponentTypeApplication,
Name: "k8s.io/apiserver",
Version: "1.21.1",
- PackageURL: &ftypes.PackageURL{
+ PackageURL: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: purl.TypeK8s,
Name: "k8s.io/apiserver",
@@ -123,7 +122,7 @@ func TestScanner_Scan(t *testing.T) {
Type: cdx.ComponentTypeContainer,
Name: "k8s.gcr.io/kube-apiserver",
Version: "sha256:18e61c783b41758dd391ab901366ec3546b26fae00eef7e223d1f94da808e02f",
- PackageURL: &ftypes.PackageURL{
+ PackageURL: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: "oci",
Name: "kube-apiserver",
@@ -234,7 +233,7 @@ func TestScanner_Scan(t *testing.T) {
Namespace: k8sCoreComponentNamespace,
},
},
- PackageURL: &ftypes.PackageURL{
+ PackageURL: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: "k8s",
Name: "k8s.io/kubelet",
@@ -258,7 +257,7 @@ func TestScanner_Scan(t *testing.T) {
Namespace: k8sCoreComponentNamespace,
},
},
- PackageURL: &ftypes.PackageURL{
+ PackageURL: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: "golang",
Name: "github.com/containerd/containerd",
diff --git a/pkg/module/serialize/types_easyjson.go b/pkg/module/serialize/types_easyjson.go
index 3ccb7e194271..cd2826c716ea 100644
--- a/pkg/module/serialize/types_easyjson.go
+++ b/pkg/module/serialize/types_easyjson.go
@@ -1617,7 +1617,9 @@ func easyjson6601e8cdDecodeGithubComAquasecurityTrivyPkgTypes(in *jlexer.Lexer,
case "PkgPath":
out.PkgPath = string(in.String())
case "PkgIdentifier":
- easyjson6601e8cdDecodeGithubComAquasecurityTrivyPkgFanalTypes9(in, &out.PkgIdentifier)
+ if data := in.Raw(); in.Ok() {
+ in.AddError((out.PkgIdentifier).UnmarshalJSON(data))
+ }
case "InstalledVersion":
out.InstalledVersion = string(in.String())
case "FixedVersion":
@@ -1843,7 +1845,7 @@ func easyjson6601e8cdEncodeGithubComAquasecurityTrivyPkgTypes(out *jwriter.Write
} else {
out.RawString(prefix)
}
- easyjson6601e8cdEncodeGithubComAquasecurityTrivyPkgFanalTypes9(out, in.PkgIdentifier)
+ out.Raw((in.PkgIdentifier).MarshalJSON())
}
if in.InstalledVersion != "" {
const prefix string = ",\"InstalledVersion\":"
@@ -2215,71 +2217,6 @@ func easyjson6601e8cdEncodeGithubComAquasecurityTrivyDbPkgTypes(out *jwriter.Wri
}
out.RawByte('}')
}
-func easyjson6601e8cdDecodeGithubComAquasecurityTrivyPkgFanalTypes9(in *jlexer.Lexer, out *types1.PkgIdentifier) {
- isTopLevel := in.IsStart()
- if in.IsNull() {
- if isTopLevel {
- in.Consumed()
- }
- in.Skip()
- return
- }
- in.Delim('{')
- for !in.IsDelim('}') {
- key := in.UnsafeFieldName(false)
- in.WantColon()
- if in.IsNull() {
- in.Skip()
- in.WantComma()
- continue
- }
- switch key {
- case "PURL":
- if in.IsNull() {
- in.Skip()
- out.PURL = nil
- } else {
- if out.PURL == nil {
- out.PURL = new(types1.PackageURL)
- }
- if data := in.Raw(); in.Ok() {
- in.AddError((*out.PURL).UnmarshalJSON(data))
- }
- }
- case "BOMRef":
- out.BOMRef = string(in.String())
- default:
- in.SkipRecursive()
- }
- in.WantComma()
- }
- in.Delim('}')
- if isTopLevel {
- in.Consumed()
- }
-}
-func easyjson6601e8cdEncodeGithubComAquasecurityTrivyPkgFanalTypes9(out *jwriter.Writer, in types1.PkgIdentifier) {
- out.RawByte('{')
- first := true
- _ = first
- if in.PURL != nil {
- const prefix string = ",\"PURL\":"
- first = false
- out.RawString(prefix[1:])
- out.Raw((*in.PURL).MarshalJSON())
- }
- if in.BOMRef != "" {
- const prefix string = ",\"BOMRef\":"
- if first {
- first = false
- out.RawString(prefix[1:])
- } else {
- out.RawString(prefix)
- }
- out.String(string(in.BOMRef))
- }
- out.RawByte('}')
-}
func easyjson6601e8cdDecodeGithubComAquasecurityTrivyPkgFanalTypes(in *jlexer.Lexer, out *types1.Package) {
isTopLevel := in.IsStart()
if in.IsNull() {
@@ -2304,7 +2241,9 @@ func easyjson6601e8cdDecodeGithubComAquasecurityTrivyPkgFanalTypes(in *jlexer.Le
case "Name":
out.Name = string(in.String())
case "Identifier":
- easyjson6601e8cdDecodeGithubComAquasecurityTrivyPkgFanalTypes9(in, &out.Identifier)
+ if data := in.Raw(); in.Ok() {
+ in.AddError((out.Identifier).UnmarshalJSON(data))
+ }
case "Version":
out.Version = string(in.String())
case "Release":
@@ -2358,7 +2297,7 @@ func easyjson6601e8cdDecodeGithubComAquasecurityTrivyPkgFanalTypes(in *jlexer.Le
if out.BuildInfo == nil {
out.BuildInfo = new(types1.BuildInfo)
}
- easyjson6601e8cdDecodeGithubComAquasecurityTrivyPkgFanalTypes10(in, out.BuildInfo)
+ easyjson6601e8cdDecodeGithubComAquasecurityTrivyPkgFanalTypes9(in, out.BuildInfo)
}
case "Indirect":
out.Indirect = bool(in.Bool())
@@ -2475,7 +2414,7 @@ func easyjson6601e8cdEncodeGithubComAquasecurityTrivyPkgFanalTypes(out *jwriter.
} else {
out.RawString(prefix)
}
- easyjson6601e8cdEncodeGithubComAquasecurityTrivyPkgFanalTypes9(out, in.Identifier)
+ out.Raw((in.Identifier).MarshalJSON())
}
if in.Version != "" {
const prefix string = ",\"Version\":"
@@ -2614,7 +2553,7 @@ func easyjson6601e8cdEncodeGithubComAquasecurityTrivyPkgFanalTypes(out *jwriter.
} else {
out.RawString(prefix)
}
- easyjson6601e8cdEncodeGithubComAquasecurityTrivyPkgFanalTypes10(out, *in.BuildInfo)
+ easyjson6601e8cdEncodeGithubComAquasecurityTrivyPkgFanalTypes9(out, *in.BuildInfo)
}
if in.Indirect {
const prefix string = ",\"Indirect\":"
@@ -2715,7 +2654,7 @@ func easyjson6601e8cdEncodeGithubComAquasecurityTrivyPkgFanalTypes(out *jwriter.
}
out.RawByte('}')
}
-func easyjson6601e8cdDecodeGithubComAquasecurityTrivyPkgFanalTypes10(in *jlexer.Lexer, out *types1.BuildInfo) {
+func easyjson6601e8cdDecodeGithubComAquasecurityTrivyPkgFanalTypes9(in *jlexer.Lexer, out *types1.BuildInfo) {
isTopLevel := in.IsStart()
if in.IsNull() {
if isTopLevel {
@@ -2771,7 +2710,7 @@ func easyjson6601e8cdDecodeGithubComAquasecurityTrivyPkgFanalTypes10(in *jlexer.
in.Consumed()
}
}
-func easyjson6601e8cdEncodeGithubComAquasecurityTrivyPkgFanalTypes10(out *jwriter.Writer, in types1.BuildInfo) {
+func easyjson6601e8cdEncodeGithubComAquasecurityTrivyPkgFanalTypes9(out *jwriter.Writer, in types1.BuildInfo) {
out.RawByte('{')
first := true
_ = first
diff --git a/pkg/purl/purl.go b/pkg/purl/purl.go
index c63c4fbb849f..bd62ce57cef8 100644
--- a/pkg/purl/purl.go
+++ b/pkg/purl/purl.go
@@ -43,13 +43,135 @@ const (
TypeUnknown = "unknown"
)
-func FromString(s string) (*ftypes.PackageURL, error) {
- return ftypes.NewPackageURL(s)
+type PackageURL struct {
+ packageurl.PackageURL
+ FilePath string
+}
+
+func FromString(s string) (*PackageURL, error) {
+ p, err := packageurl.FromString(s)
+ if err != nil {
+ return nil, xerrors.Errorf("failed to parse purl(%s): %w", s, err)
+ }
+
+ // Take out and delete the file path from qualifiers
+ var filePath string
+ for i, q := range p.Qualifiers {
+ if q.Key != "file_path" {
+ continue
+ }
+ filePath = q.Value
+ p.Qualifiers = append(p.Qualifiers[:i], p.Qualifiers[i+1:]...)
+ break
+ }
+
+ if len(p.Qualifiers) == 0 {
+ p.Qualifiers = nil
+ }
+
+ return &PackageURL{
+ PackageURL: p,
+ FilePath: filePath,
+ }, nil
+}
+
+// nolint: gocyclo
+func New(t ftypes.TargetType, metadata types.Metadata, pkg ftypes.Package) (*PackageURL, error) {
+ qualifiers := parseQualifier(pkg)
+ pkg.Epoch = 0 // we moved Epoch to qualifiers so we don't need it in version
+
+ ptype := purlType(t)
+ name := pkg.Name
+ ver := utils.FormatVersion(pkg)
+ namespace := ""
+ subpath := ""
+
+ switch ptype {
+ case packageurl.TypeRPM:
+ ns, qs := parseRPM(metadata.OS, pkg.Modularitylabel)
+ namespace = string(ns)
+ qualifiers = append(qualifiers, qs...)
+ case packageurl.TypeDebian:
+ qualifiers = append(qualifiers, parseDeb(metadata.OS)...)
+ if metadata.OS != nil {
+ namespace = string(metadata.OS.Family)
+ }
+ case packageurl.TypeApk:
+ var qs packageurl.Qualifiers
+ name, namespace, qs = parseApk(name, metadata.OS)
+ qualifiers = append(qualifiers, qs...)
+ case packageurl.TypeMaven, string(ftypes.Gradle): // TODO: replace with packageurl.TypeGradle once they add it.
+ namespace, name = parseMaven(name)
+ case packageurl.TypePyPi:
+ name = parsePyPI(name)
+ case packageurl.TypeComposer:
+ namespace, name = parseComposer(name)
+ case packageurl.TypeGolang:
+ namespace, name = parseGolang(name)
+ if name == "" {
+ return nil, nil
+ }
+ case packageurl.TypeNPM:
+ namespace, name = parseNpm(name)
+ case packageurl.TypeSwift:
+ namespace, name = parseSwift(name)
+ case packageurl.TypeCocoapods:
+ name, subpath = parseCocoapods(name)
+ case packageurl.TypeOCI:
+ purl, err := parseOCI(metadata)
+ if err != nil {
+ return nil, err
+ } else if purl.Type == "" {
+ return nil, nil
+ }
+ return &PackageURL{PackageURL: purl}, nil
+ }
+
+ return &PackageURL{
+ PackageURL: *packageurl.NewPackageURL(ptype, namespace, name, ver, qualifiers, subpath),
+ FilePath: pkg.FilePath,
+ }, nil
+}
+
+// WithPath wraps packageurl.PackageURL with the given file path
+func WithPath(purl *packageurl.PackageURL, filePath string) *PackageURL {
+ if purl == nil {
+ return nil
+ }
+ return &PackageURL{
+ PackageURL: *purl,
+ FilePath: filePath,
+ }
+}
+
+func (p *PackageURL) BOMRef() string {
+ // 'bom-ref' must be unique within BOM, but PURLs may conflict
+ // when the same packages are installed in an artifact.
+ // In that case, we prefer to make PURLs unique by adding file paths,
+ // rather than using UUIDs, even if it is not PURL technically.
+ // ref. https://cyclonedx.org/use-cases/#dependency-graph
+ purl := p.PackageURL // so that it will not override the qualifiers below
+ if p.FilePath != "" {
+ purl.Qualifiers = append(purl.Qualifiers,
+ packageurl.Qualifier{
+ Key: "file_path",
+ Value: p.FilePath,
+ },
+ )
+ }
+ return purl.String()
+}
+
+func (p *PackageURL) Unwrap() *packageurl.PackageURL {
+ if p == nil {
+ return nil
+ }
+ return &p.PackageURL
}
// LangType returns an application type in Trivy
// nolint: gocyclo
-func LangType(p *ftypes.PackageURL) ftypes.LangType {
+func (p *PackageURL) LangType() ftypes.LangType {
switch p.Type {
case packageurl.TypeComposer:
return ftypes.Composer
@@ -102,13 +224,13 @@ func LangType(p *ftypes.PackageURL) ftypes.LangType {
}
}
-func Class(p *ftypes.PackageURL) types.ResultClass {
+func (p *PackageURL) Class() types.ResultClass {
switch p.Type {
case packageurl.TypeApk, packageurl.TypeDebian, packageurl.TypeRPM:
// OS packages
return types.ClassOSPkg
default:
- if LangType(p) == TypeUnknown {
+ if p.LangType() == TypeUnknown {
return types.ClassUnknown
}
// Language-specific packages
@@ -116,10 +238,13 @@ func Class(p *ftypes.PackageURL) types.ResultClass {
}
}
-func ToPackage(p *ftypes.PackageURL) *ftypes.Package {
+func (p *PackageURL) Package() *ftypes.Package {
pkg := &ftypes.Package{
Name: p.Name,
Version: p.Version,
+ Identifier: ftypes.PkgIdentifier{
+ PURL: p.Unwrap(),
+ },
}
for _, q := range p.Qualifiers {
switch q.Key {
@@ -151,11 +276,10 @@ func ToPackage(p *ftypes.PackageURL) *ftypes.Package {
// Return packages without namespace.
// OS packages are not supposed to have namespace.
- if p.Namespace == "" || Class(p) == types.ClassOSPkg {
+ if p.Namespace == "" || p.Class() == types.ClassOSPkg {
return pkg
}
- // TODO: replace with packageurl.TypeGradle once they add it.
if p.Type == packageurl.TypeMaven || p.Type == packageurl.TypeGradle {
// Maven and Gradle packages separate ":"
// e.g. org.springframework:spring-core
@@ -167,63 +291,34 @@ func ToPackage(p *ftypes.PackageURL) *ftypes.Package {
return pkg
}
-// nolint: gocyclo
-func New(t ftypes.TargetType, metadata types.Metadata, pkg ftypes.Package) (*ftypes.PackageURL, error) {
- qualifiers := parseQualifier(pkg)
- pkg.Epoch = 0 // we moved Epoch to qualifiers so we don't need it in version
-
- ptype := purlType(t)
- name := pkg.Name
- ver := utils.FormatVersion(pkg)
- namespace := ""
- subpath := ""
+// Match returns true if the given PURL "target" satisfies the constraint PURL "p".
+// - If the constraint does not have a version, it will match any version in the target.
+// - If the constraint has qualifiers, the target must have the same set of qualifiers to match.
+func (p *PackageURL) Match(target *packageurl.PackageURL) bool {
+ if target == nil {
+ return false
+ }
+ switch {
+ case p.Type != target.Type:
+ return false
+ case p.Namespace != target.Namespace:
+ return false
+ case p.Name != target.Name:
+ return false
+ case p.Version != "" && p.Version != target.Version:
+ return false
+ case p.Subpath != "" && p.Subpath != target.Subpath:
+ return false
+ }
- switch ptype {
- case packageurl.TypeRPM:
- ns, qs := parseRPM(metadata.OS, pkg.Modularitylabel)
- namespace = string(ns)
- qualifiers = append(qualifiers, qs...)
- case packageurl.TypeDebian:
- qualifiers = append(qualifiers, parseDeb(metadata.OS)...)
- if metadata.OS != nil {
- namespace = string(metadata.OS.Family)
+ // All qualifiers in the constraint must be in the target to match
+ q := target.Qualifiers.Map()
+ for k, v1 := range p.Qualifiers.Map() {
+ if v2, ok := q[k]; !ok || v1 != v2 {
+ return false
}
- case packageurl.TypeApk:
- var qs packageurl.Qualifiers
- name, namespace, qs = parseApk(name, metadata.OS)
- qualifiers = append(qualifiers, qs...)
- case packageurl.TypeMaven, string(ftypes.Gradle): // TODO: replace with packageurl.TypeGradle once they add it.
- namespace, name = parseMaven(name)
- case packageurl.TypePyPi:
- name = parsePyPI(name)
- case packageurl.TypeComposer:
- namespace, name = parseComposer(name)
- case packageurl.TypeGolang:
- namespace, name = parseGolang(name)
- if name == "" {
- return nil, nil
- }
- case packageurl.TypeNPM:
- namespace, name = parseNpm(name)
- case packageurl.TypeSwift:
- namespace, name = parseSwift(name)
- case packageurl.TypeCocoapods:
- name, subpath = parseCocoapods(name)
- case packageurl.TypeOCI:
- purl, err := parseOCI(metadata)
- if err != nil {
- return nil, err
- }
- if purl.Type == "" {
- return nil, nil
- }
- return &ftypes.PackageURL{PackageURL: purl}, nil
}
-
- return &ftypes.PackageURL{
- PackageURL: *packageurl.NewPackageURL(ptype, namespace, name, ver, qualifiers, subpath),
- FilePath: pkg.FilePath,
- }, nil
+ return true
}
// ref. https://github.com/package-url/purl-spec/blob/a748c36ad415c8aeffe2b8a4a5d8a50d16d6d85f/PURL-TYPES.rst#oci
diff --git a/pkg/purl/purl_test.go b/pkg/purl/purl_test.go
index 16c32cdf056c..876911ca521a 100644
--- a/pkg/purl/purl_test.go
+++ b/pkg/purl/purl_test.go
@@ -20,7 +20,7 @@ func TestNewPackageURL(t *testing.T) {
typ ftypes.TargetType
pkg ftypes.Package
metadata types.Metadata
- want *ftypes.PackageURL
+ want *purl.PackageURL
wantErr string
}{
{
@@ -30,7 +30,7 @@ func TestNewPackageURL(t *testing.T) {
Name: "org.springframework:spring-core",
Version: "5.3.14",
},
- want: &ftypes.PackageURL{
+ want: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeMaven,
Namespace: "org.springframework",
@@ -46,7 +46,7 @@ func TestNewPackageURL(t *testing.T) {
Name: "org.springframework:spring-core",
Version: "5.3.14",
},
- want: &ftypes.PackageURL{
+ want: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeMaven,
Namespace: "org.springframework",
@@ -62,7 +62,7 @@ func TestNewPackageURL(t *testing.T) {
Name: "@xtuc/ieee754",
Version: "1.2.0",
},
- want: &ftypes.PackageURL{
+ want: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeNPM,
Namespace: "@xtuc",
@@ -78,7 +78,7 @@ func TestNewPackageURL(t *testing.T) {
Name: "lodash",
Version: "4.17.21",
},
- want: &ftypes.PackageURL{
+ want: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeNPM,
Name: "lodash",
@@ -93,7 +93,7 @@ func TestNewPackageURL(t *testing.T) {
Name: "@xtuc/ieee754",
Version: "1.2.0",
},
- want: &ftypes.PackageURL{
+ want: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeNPM,
Namespace: "@xtuc",
@@ -109,7 +109,7 @@ func TestNewPackageURL(t *testing.T) {
Name: "lodash",
Version: "4.17.21",
},
- want: &ftypes.PackageURL{
+ want: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeNPM,
Name: "lodash",
@@ -124,7 +124,7 @@ func TestNewPackageURL(t *testing.T) {
Name: "Django_test",
Version: "1.2.0",
},
- want: &ftypes.PackageURL{
+ want: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypePyPi,
Name: "django-test",
@@ -139,7 +139,7 @@ func TestNewPackageURL(t *testing.T) {
Name: "absl-py",
Version: "0.4.1",
},
- want: &ftypes.PackageURL{
+ want: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeConda,
Name: "absl-py",
@@ -154,7 +154,7 @@ func TestNewPackageURL(t *testing.T) {
Name: "symfony/contracts",
Version: "v1.0.2",
},
- want: &ftypes.PackageURL{
+ want: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeComposer,
Namespace: "symfony",
@@ -170,7 +170,7 @@ func TestNewPackageURL(t *testing.T) {
Name: "github.com/go-sql-driver/Mysql",
Version: "v1.5.0",
},
- want: &ftypes.PackageURL{
+ want: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeGolang,
Namespace: "github.com/go-sql-driver",
@@ -202,7 +202,7 @@ func TestNewPackageURL(t *testing.T) {
},
},
},
- want: &ftypes.PackageURL{
+ want: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeHex,
Name: "bunt",
@@ -217,7 +217,7 @@ func TestNewPackageURL(t *testing.T) {
Name: "http",
Version: "0.13.2",
},
- want: &ftypes.PackageURL{
+ want: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypePub,
Name: "http",
@@ -233,7 +233,7 @@ func TestNewPackageURL(t *testing.T) {
Name: "github.com/apple/swift-atomics",
Version: "1.1.0",
},
- want: &ftypes.PackageURL{
+ want: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeSwift,
Namespace: "github.com/apple",
@@ -250,7 +250,7 @@ func TestNewPackageURL(t *testing.T) {
Name: "GoogleUtilities/NSData+zlib",
Version: "7.5.2",
},
- want: &ftypes.PackageURL{
+ want: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeCocoapods,
Name: "GoogleUtilities",
@@ -267,7 +267,7 @@ func TestNewPackageURL(t *testing.T) {
Name: "abomination",
Version: "0.7.3",
},
- want: &ftypes.PackageURL{
+ want: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeCargo,
Name: "abomination",
@@ -283,7 +283,7 @@ func TestNewPackageURL(t *testing.T) {
Name: "Newtonsoft.Json",
Version: "9.0.1",
},
- want: &ftypes.PackageURL{
+ want: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeNuget,
Name: "Newtonsoft.Json",
@@ -313,7 +313,7 @@ func TestNewPackageURL(t *testing.T) {
Name: "8",
},
},
- want: &ftypes.PackageURL{
+ want: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeRPM,
Namespace: "redhat",
@@ -351,7 +351,7 @@ func TestNewPackageURL(t *testing.T) {
Architecture: "amd64",
},
},
- want: &ftypes.PackageURL{
+ want: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeOCI,
Namespace: "",
@@ -399,7 +399,7 @@ func TestNewPackageURL(t *testing.T) {
Architecture: "amd64",
},
},
- want: &ftypes.PackageURL{
+ want: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeOCI,
Namespace: "",
@@ -451,13 +451,13 @@ func TestFromString(t *testing.T) {
testCases := []struct {
name string
purl string
- want ftypes.PackageURL
+ want purl.PackageURL
wantErr string
}{
{
name: "happy path for maven",
purl: "pkg:maven/org.springframework/spring-core@5.0.4.RELEASE",
- want: ftypes.PackageURL{
+ want: purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeMaven,
Namespace: "org.springframework",
@@ -470,7 +470,7 @@ func TestFromString(t *testing.T) {
{
name: "happy path for npm",
purl: "pkg:npm/bootstrap@5.0.2?file_path=app%2Fapp%2Fpackage.json",
- want: ftypes.PackageURL{
+ want: purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeNPM,
Name: "bootstrap",
@@ -482,7 +482,7 @@ func TestFromString(t *testing.T) {
{
name: "happy path for coocapods",
purl: "pkg:cocoapods/GoogleUtilities@7.5.2#NSData+zlib",
- want: ftypes.PackageURL{
+ want: purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeCocoapods,
Name: "GoogleUtilities",
@@ -494,7 +494,7 @@ func TestFromString(t *testing.T) {
{
name: "happy path for hex",
purl: "pkg:hex/plug@1.14.0",
- want: ftypes.PackageURL{
+ want: purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeHex,
Name: "plug",
@@ -505,7 +505,7 @@ func TestFromString(t *testing.T) {
{
name: "happy path for dart",
purl: "pkg:pub/http@0.13.2",
- want: ftypes.PackageURL{
+ want: purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypePub,
Name: "http",
@@ -516,7 +516,7 @@ func TestFromString(t *testing.T) {
{
name: "happy path for apk",
purl: "pkg:apk/alpine/alpine-baselayout@3.2.0-r16?distro=3.14.2&epoch=1",
- want: ftypes.PackageURL{
+ want: purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: string(analyzer.TypeApk),
Namespace: "alpine",
@@ -538,7 +538,7 @@ func TestFromString(t *testing.T) {
{
name: "happy path for rpm",
purl: "pkg:rpm/redhat/containers-common@0.1.14",
- want: ftypes.PackageURL{
+ want: purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeRPM,
Namespace: "redhat",
@@ -550,7 +550,7 @@ func TestFromString(t *testing.T) {
{
name: "happy path for conda",
purl: "pkg:conda/absl-py@0.4.1",
- want: ftypes.PackageURL{
+ want: purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeConda,
Name: "absl-py",
@@ -561,7 +561,7 @@ func TestFromString(t *testing.T) {
{
name: "bad rpm",
purl: "pkg:rpm/redhat/a--@1.0.0",
- want: ftypes.PackageURL{
+ want: purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeRPM,
Namespace: "redhat",
@@ -585,15 +585,15 @@ func TestFromString(t *testing.T) {
}
}
-func TestToPackage(t *testing.T) {
+func TestPackageURL_Package(t *testing.T) {
tests := []struct {
name string
- pkgURL *ftypes.PackageURL
+ pkgURL *purl.PackageURL
wantPkg *ftypes.Package
}{
{
name: "rpm + Qualifiers",
- pkgURL: &ftypes.PackageURL{
+ pkgURL: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeRPM,
Namespace: "redhat",
@@ -626,26 +626,60 @@ func TestToPackage(t *testing.T) {
Arch: "x86_64",
Epoch: 1,
Modularitylabel: "nodejs:10:8020020200707141642:6a468ee4",
+ Identifier: ftypes.PkgIdentifier{
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeRPM,
+ Namespace: "redhat",
+ Name: "nodejs-full-i18n",
+ Version: "10.21.0-3.module_el8.2.0+391+8da3adc6",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "arch",
+ Value: "x86_64",
+ },
+ {
+ Key: "epoch",
+ Value: "1",
+ },
+ {
+ Key: "modularitylabel",
+ Value: "nodejs:10:8020020200707141642:6a468ee4",
+ },
+ {
+ Key: "distro",
+ Value: "redhat-8",
+ },
+ },
+ },
+ },
},
},
{
name: "composer with namespace",
- pkgURL: &ftypes.PackageURL{
+ pkgURL: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeComposer,
Namespace: "symfony",
Name: "contracts",
- Version: "v1.0.2",
+ Version: "1.0.2",
},
},
wantPkg: &ftypes.Package{
Name: "symfony/contracts",
- Version: "v1.0.2",
+ Version: "1.0.2",
+ Identifier: ftypes.PkgIdentifier{
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Namespace: "symfony",
+ Name: "contracts",
+ Version: "1.0.2",
+ },
+ },
},
},
{
name: "maven with namespace",
- pkgURL: &ftypes.PackageURL{
+ pkgURL: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeMaven,
Namespace: "org.springframework",
@@ -656,11 +690,19 @@ func TestToPackage(t *testing.T) {
wantPkg: &ftypes.Package{
Name: "org.springframework:spring-core",
Version: "5.0.4.RELEASE",
+ Identifier: ftypes.PkgIdentifier{
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "org.springframework",
+ Name: "spring-core",
+ Version: "5.0.4.RELEASE",
+ },
+ },
},
},
{
name: "cocoapods with subpath",
- pkgURL: &ftypes.PackageURL{
+ pkgURL: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeCocoapods,
Version: "4.2.0",
@@ -671,11 +713,19 @@ func TestToPackage(t *testing.T) {
wantPkg: &ftypes.Package{
Name: "AppCenter/Analytics",
Version: "4.2.0",
+ Identifier: ftypes.PkgIdentifier{
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeCocoapods,
+ Version: "4.2.0",
+ Name: "AppCenter",
+ Subpath: "Analytics",
+ },
+ },
},
},
{
name: "wrong epoch",
- pkgURL: &ftypes.PackageURL{
+ pkgURL: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: packageurl.TypeRPM,
Namespace: "redhat",
@@ -693,19 +743,33 @@ func TestToPackage(t *testing.T) {
Name: "acl",
Version: "2.2.53",
Release: "1.el8",
+ Identifier: ftypes.PkgIdentifier{
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeRPM,
+ Namespace: "redhat",
+ Name: "acl",
+ Version: "2.2.53-1.el8",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "epoch",
+ Value: "wrong",
+ },
+ },
+ },
+ },
},
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
- got := purl.ToPackage(tt.pkgURL)
+ got := tt.pkgURL.Package()
assert.Equal(t, tt.wantPkg, got)
})
}
}
-func TestLangType(t *testing.T) {
+func TestPackageURL_LangType(t *testing.T) {
tests := []struct {
name string
purl packageurl.PackageURL
@@ -743,8 +807,77 @@ func TestLangType(t *testing.T) {
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
- p := &ftypes.PackageURL{PackageURL: tt.purl}
- assert.Equalf(t, tt.want, purl.LangType(p), "LangType()")
+ p := &purl.PackageURL{PackageURL: tt.purl}
+ assert.Equalf(t, tt.want, p.LangType(), "LangType()")
+ })
+ }
+}
+
+func TestPackageURL_Match(t *testing.T) {
+ tests := []struct {
+ name string
+ constraint string
+ target string
+ want bool
+ }{
+ {
+ name: "same purl",
+ constraint: "pkg:golang/github.com/aquasecurity/trivy@0.49.0",
+ target: "pkg:golang/github.com/aquasecurity/trivy@0.49.0",
+ want: true,
+ },
+ {
+ name: "different type",
+ constraint: "pkg:golang/github.com/aquasecurity/trivy@0.49.0",
+ target: "pkg:maven/github.com/aquasecurity/trivy@0.49.0",
+ want: false,
+ },
+ {
+ name: "different namespace",
+ constraint: "pkg:golang/github.com/aquasecurity/trivy@0.49.0",
+ target: "pkg:golang/github.com/aquasecurity2/trivy@0.49.0",
+ want: false,
+ },
+ {
+ name: "different name",
+ constraint: "pkg:golang/github.com/aquasecurity/trivy@0.49.0",
+ target: "pkg:golang/github.com/aquasecurity/tracee@0.49.0",
+ want: false,
+ },
+ {
+ name: "different version",
+ constraint: "pkg:golang/github.com/aquasecurity/trivy@0.49.0",
+ target: "pkg:golang/github.com/aquasecurity/trivy@0.49.1",
+ want: false,
+ },
+ {
+ name: "version wildcard",
+ constraint: "pkg:golang/github.com/aquasecurity/trivy",
+ target: "pkg:golang/github.com/aquasecurity/trivy@0.50.0",
+ want: true,
+ },
+ {
+ name: "different qualifier",
+ constraint: "pkg:bitnami/wordpress@6.2.0?arch=arm64&distro=debian-12",
+ target: "pkg:bitnami/wordpress@6.2.0?arch=arm64&distro=debian-13",
+ want: false,
+ },
+ {
+ name: "target more qualifiers",
+ constraint: "pkg:bitnami/wordpress@6.2.0?arch=arm64",
+ target: "pkg:bitnami/wordpress@6.2.0?arch=arm64&distro=debian-13",
+ want: true,
+ },
+ }
+ for _, tt := range tests {
+ t.Run(tt.name, func(t *testing.T) {
+ c, err := purl.FromString(tt.constraint)
+ require.NoError(t, err)
+
+ p, err := purl.FromString(tt.target)
+ require.NoError(t, err)
+
+ assert.Equalf(t, tt.want, c.Match(p.Unwrap()), "Match()")
})
}
}
diff --git a/pkg/rekortest/server.go b/pkg/rekortest/server.go
index 72a9e6ef7c71..e5eb7dbd7858 100644
--- a/pkg/rekortest/server.go
+++ b/pkg/rekortest/server.go
@@ -54,11 +54,14 @@ var (
Version: 1,
Metadata: &cyclonedx.Metadata{
Timestamp: "2022-09-15T13:53:49+00:00",
- Tools: &[]cyclonedx.Tool{
- {
- Vendor: "aquasecurity",
- Name: "trivy",
- Version: "dev",
+ Tools: &cyclonedx.ToolsChoice{
+ Components: &[]cyclonedx.Component{
+ {
+ Type: cyclonedx.ComponentTypeApplication,
+ Name: "trivy",
+ Group: "aquasecurity",
+ Version: "dev",
+ },
},
},
Component: &cyclonedx.Component{
@@ -175,11 +178,14 @@ var (
Version: 1,
Metadata: &cyclonedx.Metadata{
Timestamp: "2022-10-21T09:50:08+00:00",
- Tools: &[]cyclonedx.Tool{
- {
- Vendor: "aquasecurity",
- Name: "trivy",
- Version: "dev",
+ Tools: &cyclonedx.ToolsChoice{
+ Components: &[]cyclonedx.Component{
+ {
+ Type: cyclonedx.ComponentTypeApplication,
+ Name: "trivy",
+ Group: "aquasecurity",
+ Version: "dev",
+ },
},
},
Component: &cyclonedx.Component{
diff --git a/pkg/report/sarif.go b/pkg/report/sarif.go
index 800737a84258..25f1ba47bee5 100644
--- a/pkg/report/sarif.go
+++ b/pkg/report/sarif.go
@@ -169,11 +169,11 @@ func (sw *SarifWriter) Write(ctx context.Context, report types.Report) error {
resultIndex: getRuleIndex(vuln.VulnerabilityID, ruleIndexes),
shortDescription: html.EscapeString(vuln.Title),
fullDescription: html.EscapeString(fullDescription),
- helpText: fmt.Sprintf(`Vulnerability %v\nSeverity: %v\nPackage: %v\nFixed Version: %v\nLink: [%v](%v)\n%v`,
+ helpText: fmt.Sprintf("Vulnerability %v\nSeverity: %v\nPackage: %v\nFixed Version: %v\nLink: [%v](%v)\n%v",
vuln.VulnerabilityID, vuln.Severity, vuln.PkgName, vuln.FixedVersion, vuln.VulnerabilityID, vuln.PrimaryURL, vuln.Description),
- helpMarkdown: fmt.Sprintf(`**Vulnerability %v**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|%v|%v|%v|[%v](%v)|\n\n%v`,
+ helpMarkdown: fmt.Sprintf("**Vulnerability %v**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|%v|%v|%v|[%v](%v)|\n\n%v",
vuln.VulnerabilityID, vuln.Severity, vuln.PkgName, vuln.FixedVersion, vuln.VulnerabilityID, vuln.PrimaryURL, vuln.Description),
- message: fmt.Sprintf(`Package: %v\nInstalled Version: %v\nVulnerability %v\nSeverity: %v\nFixed Version: %v\nLink: [%v](%v)`,
+ message: fmt.Sprintf("Package: %v\nInstalled Version: %v\nVulnerability %v\nSeverity: %v\nFixed Version: %v\nLink: [%v](%v)",
vuln.PkgName, vuln.InstalledVersion, vuln.VulnerabilityID, vuln.Severity, vuln.FixedVersion, vuln.VulnerabilityID, vuln.PrimaryURL),
})
}
@@ -196,11 +196,11 @@ func (sw *SarifWriter) Write(ctx context.Context, report types.Report) error {
resultIndex: getRuleIndex(misconf.ID, ruleIndexes),
shortDescription: html.EscapeString(misconf.Title),
fullDescription: html.EscapeString(misconf.Description),
- helpText: fmt.Sprintf(`Misconfiguration %v\nType: %s\nSeverity: %v\nCheck: %v\nMessage: %v\nLink: [%v](%v)\n%s`,
+ helpText: fmt.Sprintf("Misconfiguration %v\nType: %s\nSeverity: %v\nCheck: %v\nMessage: %v\nLink: [%v](%v)\n%s",
misconf.ID, misconf.Type, misconf.Severity, misconf.Title, misconf.Message, misconf.ID, misconf.PrimaryURL, misconf.Description),
- helpMarkdown: fmt.Sprintf(`**Misconfiguration %v**\n| Type | Severity | Check | Message | Link |\n| --- | --- | --- | --- | --- |\n|%v|%v|%v|%s|[%v](%v)|\n\n%v`,
+ helpMarkdown: fmt.Sprintf("**Misconfiguration %v**\n| Type | Severity | Check | Message | Link |\n| --- | --- | --- | --- | --- |\n|%v|%v|%v|%s|[%v](%v)|\n\n%v",
misconf.ID, misconf.Type, misconf.Severity, misconf.Title, misconf.Message, misconf.ID, misconf.PrimaryURL, misconf.Description),
- message: fmt.Sprintf(`Artifact: %v\nType: %v\nVulnerability %v\nSeverity: %v\nMessage: %v\nLink: [%v](%v)`,
+ message: fmt.Sprintf("Artifact: %v\nType: %v\nVulnerability %v\nSeverity: %v\nMessage: %v\nLink: [%v](%v)",
res.Target, res.Type, misconf.ID, misconf.Severity, misconf.Message, misconf.ID, misconf.PrimaryURL),
})
}
@@ -223,11 +223,11 @@ func (sw *SarifWriter) Write(ctx context.Context, report types.Report) error {
resultIndex: getRuleIndex(secret.RuleID, ruleIndexes),
shortDescription: html.EscapeString(secret.Title),
fullDescription: html.EscapeString(secret.Match),
- helpText: fmt.Sprintf(`Secret %v\nSeverity: %v\nMatch: %s`,
+ helpText: fmt.Sprintf("Secret %v\nSeverity: %v\nMatch: %s",
secret.Title, secret.Severity, secret.Match),
- helpMarkdown: fmt.Sprintf(`**Secret %v**\n| Severity | Match |\n| --- | --- |\n|%v|%v|`,
+ helpMarkdown: fmt.Sprintf("**Secret %v**\n| Severity | Match |\n| --- | --- |\n|%v|%v|",
secret.Title, secret.Severity, secret.Match),
- message: fmt.Sprintf(`Artifact: %v\nType: %v\nSecret %v\nSeverity: %v\nMatch: %v`,
+ message: fmt.Sprintf("Artifact: %v\nType: %v\nSecret %v\nSeverity: %v\nMatch: %v",
res.Target, res.Type, secret.Title, secret.Severity, secret.Match),
})
}
@@ -245,11 +245,11 @@ func (sw *SarifWriter) Write(ctx context.Context, report types.Report) error {
resultIndex: getRuleIndex(id, ruleIndexes),
shortDescription: desc,
fullDescription: desc,
- helpText: fmt.Sprintf(`License %s\nClassification: %s\nPkgName: %s\nPath: %s`,
+ helpText: fmt.Sprintf("License %s\nClassification: %s\nPkgName: %s\nPath: %s",
license.Name, license.Category, license.PkgName, license.FilePath),
- helpMarkdown: fmt.Sprintf(`**License %s**\n| PkgName | Classification | Path |\n| --- | --- | --- |\n|%s|%s|%s|`,
+ helpMarkdown: fmt.Sprintf("**License %s**\n| PkgName | Classification | Path |\n| --- | --- | --- |\n|%s|%s|%s|",
license.Name, license.PkgName, license.Category, license.FilePath),
- message: fmt.Sprintf(`Artifact: %s\nLicense %s\nPkgName: %s\n Classification: %s\n Path: %s`,
+ message: fmt.Sprintf("Artifact: %s\nLicense %s\nPkgName: %s\n Classification: %s\n Path: %s",
res.Target, license.Name, license.Category, license.PkgName, license.FilePath),
})
}
diff --git a/pkg/report/sarif_test.go b/pkg/report/sarif_test.go
index 737662dcd536..d5f88d443373 100644
--- a/pkg/report/sarif_test.go
+++ b/pkg/report/sarif_test.go
@@ -118,8 +118,8 @@ func TestReportWriter_Sarif(t *testing.T) {
"security-severity": "7.5",
},
Help: &sarif.MultiformatMessageString{
- Text: lo.ToPtr("Vulnerability CVE-2020-0001\\nSeverity: HIGH\\nPackage: foo\\nFixed Version: 3.4.5\\nLink: [CVE-2020-0001](https://avd.aquasec.com/nvd/cve-2020-0001)\\nbaz"),
- Markdown: lo.ToPtr("**Vulnerability CVE-2020-0001**\\n| Severity | Package | Fixed Version | Link |\\n| --- | --- | --- | --- |\\n|HIGH|foo|3.4.5|[CVE-2020-0001](https://avd.aquasec.com/nvd/cve-2020-0001)|\\n\\nbaz"),
+ Text: lo.ToPtr("Vulnerability CVE-2020-0001\nSeverity: HIGH\nPackage: foo\nFixed Version: 3.4.5\nLink: [CVE-2020-0001](https://avd.aquasec.com/nvd/cve-2020-0001)\nbaz"),
+ Markdown: lo.ToPtr("**Vulnerability CVE-2020-0001**\n| Severity | Package | Fixed Version | Link |\n| --- | --- | --- | --- |\n|HIGH|foo|3.4.5|[CVE-2020-0001](https://avd.aquasec.com/nvd/cve-2020-0001)|\n\nbaz"),
},
},
},
@@ -130,7 +130,7 @@ func TestReportWriter_Sarif(t *testing.T) {
RuleID: lo.ToPtr("CVE-2020-0001"),
RuleIndex: lo.ToPtr[uint](0),
Level: lo.ToPtr("error"),
- Message: sarif.Message{Text: lo.ToPtr("Package: foo\\nInstalled Version: 1.2.3\\nVulnerability CVE-2020-0001\\nSeverity: HIGH\\nFixed Version: 3.4.5\\nLink: [CVE-2020-0001](https://avd.aquasec.com/nvd/cve-2020-0001)")},
+ Message: sarif.Message{Text: lo.ToPtr("Package: foo\nInstalled Version: 1.2.3\nVulnerability CVE-2020-0001\nSeverity: HIGH\nFixed Version: 3.4.5\nLink: [CVE-2020-0001](https://avd.aquasec.com/nvd/cve-2020-0001)")},
Locations: []*sarif.Location{
{
Message: &sarif.Message{Text: lo.ToPtr("library/test: foo@1.2.3")},
@@ -243,8 +243,8 @@ func TestReportWriter_Sarif(t *testing.T) {
"security-severity": "8.0",
},
Help: &sarif.MultiformatMessageString{
- Text: lo.ToPtr("Misconfiguration KSV001\\nType: Kubernetes Security Check\\nSeverity: HIGH\\nCheck: Image tag ':latest' used\\nMessage: Message\\nLink: [KSV001](https://avd.aquasec.com/appshield/ksv001)\\n"),
- Markdown: lo.ToPtr("**Misconfiguration KSV001**\\n| Type | Severity | Check | Message | Link |\\n| --- | --- | --- | --- | --- |\\n|Kubernetes Security Check|HIGH|Image tag ':latest' used|Message|[KSV001](https://avd.aquasec.com/appshield/ksv001)|\\n\\n"),
+ Text: lo.ToPtr("Misconfiguration KSV001\nType: Kubernetes Security Check\nSeverity: HIGH\nCheck: Image tag ':latest' used\nMessage: Message\nLink: [KSV001](https://avd.aquasec.com/appshield/ksv001)\n"),
+ Markdown: lo.ToPtr("**Misconfiguration KSV001**\n| Type | Severity | Check | Message | Link |\n| --- | --- | --- | --- | --- |\n|Kubernetes Security Check|HIGH|Image tag ':latest' used|Message|[KSV001](https://avd.aquasec.com/appshield/ksv001)|\n\n"),
},
},
{
@@ -266,8 +266,8 @@ func TestReportWriter_Sarif(t *testing.T) {
"security-severity": "9.5",
},
Help: &sarif.MultiformatMessageString{
- Text: lo.ToPtr("Misconfiguration KSV002\\nType: Kubernetes Security Check\\nSeverity: CRITICAL\\nCheck: SYS_ADMIN capability added\\nMessage: Message\\nLink: [KSV002](https://avd.aquasec.com/appshield/ksv002)\\n"),
- Markdown: lo.ToPtr("**Misconfiguration KSV002**\\n| Type | Severity | Check | Message | Link |\\n| --- | --- | --- | --- | --- |\\n|Kubernetes Security Check|CRITICAL|SYS_ADMIN capability added|Message|[KSV002](https://avd.aquasec.com/appshield/ksv002)|\\n\\n"),
+ Text: lo.ToPtr("Misconfiguration KSV002\nType: Kubernetes Security Check\nSeverity: CRITICAL\nCheck: SYS_ADMIN capability added\nMessage: Message\nLink: [KSV002](https://avd.aquasec.com/appshield/ksv002)\n"),
+ Markdown: lo.ToPtr("**Misconfiguration KSV002**\n| Type | Severity | Check | Message | Link |\n| --- | --- | --- | --- | --- |\n|Kubernetes Security Check|CRITICAL|SYS_ADMIN capability added|Message|[KSV002](https://avd.aquasec.com/appshield/ksv002)|\n\n"),
},
},
},
@@ -278,7 +278,7 @@ func TestReportWriter_Sarif(t *testing.T) {
RuleID: lo.ToPtr("KSV001"),
RuleIndex: lo.ToPtr[uint](0),
Level: lo.ToPtr("error"),
- Message: sarif.Message{Text: lo.ToPtr("Artifact: library/test\\nType: \\nVulnerability KSV001\\nSeverity: HIGH\\nMessage: Message\\nLink: [KSV001](https://avd.aquasec.com/appshield/ksv001)")},
+ Message: sarif.Message{Text: lo.ToPtr("Artifact: library/test\nType: \nVulnerability KSV001\nSeverity: HIGH\nMessage: Message\nLink: [KSV001](https://avd.aquasec.com/appshield/ksv001)")},
Locations: []*sarif.Location{
{
Message: &sarif.Message{Text: lo.ToPtr("library/test")},
@@ -301,7 +301,7 @@ func TestReportWriter_Sarif(t *testing.T) {
RuleID: lo.ToPtr("KSV002"),
RuleIndex: lo.ToPtr[uint](1),
Level: lo.ToPtr("error"),
- Message: sarif.Message{Text: lo.ToPtr("Artifact: library/test\\nType: \\nVulnerability KSV002\\nSeverity: CRITICAL\\nMessage: Message\\nLink: [KSV002](https://avd.aquasec.com/appshield/ksv002)")},
+ Message: sarif.Message{Text: lo.ToPtr("Artifact: library/test\nType: \nVulnerability KSV002\nSeverity: CRITICAL\nMessage: Message\nLink: [KSV002](https://avd.aquasec.com/appshield/ksv002)")},
Locations: []*sarif.Location{
{
Message: &sarif.Message{Text: lo.ToPtr("library/test")},
@@ -383,8 +383,8 @@ func TestReportWriter_Sarif(t *testing.T) {
"security-severity": "9.5",
},
Help: &sarif.MultiformatMessageString{
- Text: lo.ToPtr("Secret AWS Secret Access Key\\nSeverity: CRITICAL\\nMatch: 'AWS_secret_KEY'=\"****************************************\""),
- Markdown: lo.ToPtr("**Secret AWS Secret Access Key**\\n| Severity | Match |\\n| --- | --- |\\n|CRITICAL|'AWS_secret_KEY'=\"****************************************\"|"),
+ Text: lo.ToPtr("Secret AWS Secret Access Key\nSeverity: CRITICAL\nMatch: 'AWS_secret_KEY'=\"****************************************\""),
+ Markdown: lo.ToPtr("**Secret AWS Secret Access Key**\n| Severity | Match |\n| --- | --- |\n|CRITICAL|'AWS_secret_KEY'=\"****************************************\"|"),
},
},
},
@@ -395,7 +395,7 @@ func TestReportWriter_Sarif(t *testing.T) {
RuleID: lo.ToPtr("aws-secret-access-key"),
RuleIndex: lo.ToPtr[uint](0),
Level: lo.ToPtr("error"),
- Message: sarif.Message{Text: lo.ToPtr("Artifact: library/test\\nType: \\nSecret AWS Secret Access Key\\nSeverity: CRITICAL\\nMatch: 'AWS_secret_KEY'=\"****************************************\"")},
+ Message: sarif.Message{Text: lo.ToPtr("Artifact: library/test\nType: \nSecret AWS Secret Access Key\nSeverity: CRITICAL\nMatch: 'AWS_secret_KEY'=\"****************************************\"")},
Locations: []*sarif.Location{
{
Message: &sarif.Message{Text: lo.ToPtr("library/test")},
@@ -464,8 +464,8 @@ func TestReportWriter_Sarif(t *testing.T) {
ShortDescription: sarif.NewMultiformatMessageString("GPL-3.0 in alpine-base"),
FullDescription: sarif.NewMultiformatMessageString("GPL-3.0 in alpine-base"),
DefaultConfiguration: sarif.NewReportingConfiguration().WithLevel("error"),
- Help: sarif.NewMultiformatMessageString("License GPL-3.0\\nClassification: restricted\\nPkgName: alpine-base\\nPath: ").
- WithMarkdown("**License GPL-3.0**\\n| PkgName | Classification | Path |\\n| --- | --- | --- |\\n|alpine-base|restricted||"),
+ Help: sarif.NewMultiformatMessageString("License GPL-3.0\nClassification: restricted\nPkgName: alpine-base\nPath: ").
+ WithMarkdown("**License GPL-3.0**\n| PkgName | Classification | Path |\n| --- | --- | --- |\n|alpine-base|restricted||"),
Properties: map[string]interface{}{
"tags": []interface{}{
"license",
@@ -484,7 +484,7 @@ func TestReportWriter_Sarif(t *testing.T) {
RuleID: lo.ToPtr("alpine-base:GPL-3.0"),
RuleIndex: lo.ToPtr(uint(0)),
Level: lo.ToPtr("error"),
- Message: sarif.Message{Text: lo.ToPtr("Artifact: OS Packages\\nLicense GPL-3.0\\nPkgName: restricted\\n Classification: alpine-base\\n Path: ")},
+ Message: sarif.Message{Text: lo.ToPtr("Artifact: OS Packages\nLicense GPL-3.0\nPkgName: restricted\n Classification: alpine-base\n Path: ")},
Locations: []*sarif.Location{
{
Message: sarif.NewTextMessage(""),
diff --git a/pkg/result/filter_test.go b/pkg/result/filter_test.go
index db9770d886d1..4edd86348c9b 100644
--- a/pkg/result/filter_test.go
+++ b/pkg/result/filter_test.go
@@ -154,13 +154,11 @@ func TestFilter(t *testing.T) {
VulnerabilityID: "CVE-2019-0001",
PkgName: "foo",
PkgIdentifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGolang,
- Namespace: "github.com/aquasecurity",
- Name: "foo",
- Version: "1.2.3",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGolang,
+ Namespace: "github.com/aquasecurity",
+ Name: "foo",
+ Version: "1.2.3",
},
},
InstalledVersion: "1.2.3",
@@ -173,13 +171,11 @@ func TestFilter(t *testing.T) {
VulnerabilityID: "CVE-2019-0001",
PkgName: "bar",
PkgIdentifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGolang,
- Namespace: "github.com/aquasecurity",
- Name: "bar",
- Version: "4.5.6",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGolang,
+ Namespace: "github.com/aquasecurity",
+ Name: "bar",
+ Version: "4.5.6",
},
},
InstalledVersion: "4.5.6",
@@ -209,13 +205,11 @@ func TestFilter(t *testing.T) {
VulnerabilityID: "CVE-2019-0001",
PkgName: "bar",
PkgIdentifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGolang,
- Namespace: "github.com/aquasecurity",
- Name: "bar",
- Version: "4.5.6",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGolang,
+ Namespace: "github.com/aquasecurity",
+ Name: "bar",
+ Version: "4.5.6",
},
},
InstalledVersion: "4.5.6",
diff --git a/pkg/rpc/convert.go b/pkg/rpc/convert.go
index a8a04d0dcbd6..7e2a09f2c7da 100644
--- a/pkg/rpc/convert.go
+++ b/pkg/rpc/convert.go
@@ -3,6 +3,7 @@ package rpc
import (
"time"
+ "github.com/package-url/packageurl-go"
"github.com/samber/lo"
"google.golang.org/protobuf/types/known/structpb"
"google.golang.org/protobuf/types/known/timestamppb"
@@ -11,7 +12,6 @@ import (
"github.com/aquasecurity/trivy/pkg/digest"
ftypes "github.com/aquasecurity/trivy/pkg/fanal/types"
"github.com/aquasecurity/trivy/pkg/log"
- "github.com/aquasecurity/trivy/pkg/purl"
"github.com/aquasecurity/trivy/pkg/types"
"github.com/aquasecurity/trivy/rpc/cache"
"github.com/aquasecurity/trivy/rpc/common"
@@ -82,7 +82,7 @@ func ConvertToRPCPkgIdentifier(pkg ftypes.PkgIdentifier) *common.PkgIdentifier {
var p string
if pkg.PURL != nil {
- p = pkg.PURL.BOMRef() // Use BOMRef() instead of String() so that we won't lose file_path
+ p = pkg.PURL.String()
}
return &common.PkgIdentifier{
Purl: p,
@@ -227,11 +227,11 @@ func ConvertFromRPCPkgIdentifier(pkg *common.PkgIdentifier) ftypes.PkgIdentifier
}
if pkg.Purl != "" {
- pu, err := purl.FromString(pkg.Purl)
+ pu, err := packageurl.FromString(pkg.Purl)
if err != nil {
log.Logger.Error("Failed to parse PURL (%s): %s", pkg.Purl, err)
}
- pkgID.PURL = pu
+ pkgID.PURL = &pu
}
return pkgID
diff --git a/pkg/sbom/cyclonedx/core/cyclonedx.go b/pkg/sbom/cyclonedx/core/cyclonedx.go
index 7ecc4c6362af..fc326145d5c6 100644
--- a/pkg/sbom/cyclonedx/core/cyclonedx.go
+++ b/pkg/sbom/cyclonedx/core/cyclonedx.go
@@ -15,8 +15,8 @@ import (
"github.com/aquasecurity/trivy-db/pkg/vulnsrc/vulnerability"
"github.com/aquasecurity/trivy/pkg/clock"
"github.com/aquasecurity/trivy/pkg/digest"
- ftypes "github.com/aquasecurity/trivy/pkg/fanal/types"
"github.com/aquasecurity/trivy/pkg/log"
+ "github.com/aquasecurity/trivy/pkg/purl"
"github.com/aquasecurity/trivy/pkg/types"
"github.com/aquasecurity/trivy/pkg/uuid"
)
@@ -39,7 +39,7 @@ type Component struct {
Name string
Group string
Version string
- PackageURL *ftypes.PackageURL
+ PackageURL *purl.PackageURL
Licenses []string
Hashes []digest.Digest
Supplier string
@@ -184,11 +184,14 @@ func (c *CycloneDX) BOMRef(component *Component) string {
func (c *CycloneDX) Metadata(ctx context.Context) *cdx.Metadata {
return &cdx.Metadata{
Timestamp: clock.Now(ctx).UTC().Format(timeLayout),
- Tools: &[]cdx.Tool{
- {
- Vendor: ToolVendor,
- Name: ToolName,
- Version: c.appVersion,
+ Tools: &cdx.ToolsChoice{
+ Components: &[]cdx.Component{
+ {
+ Type: cdx.ComponentTypeApplication,
+ Group: ToolVendor,
+ Name: ToolName,
+ Version: c.appVersion,
+ },
},
},
}
@@ -232,7 +235,7 @@ func (c *CycloneDX) Vulnerabilities(uniq map[string]*cdx.Vulnerability) *[]cdx.V
return &vulns
}
-func (c *CycloneDX) PackageURL(p *ftypes.PackageURL) string {
+func (c *CycloneDX) PackageURL(p *purl.PackageURL) string {
if p == nil {
return ""
}
@@ -313,11 +316,20 @@ func IsTrivySBOM(c *cdx.BOM) bool {
return false
}
- for _, tool := range *c.Metadata.Tools {
+ for _, component := range lo.FromPtr(c.Metadata.Tools.Components) {
+ if component.Group == ToolVendor && component.Name == ToolName {
+ return true
+ }
+ }
+
+ // Metadata.Tools array is deprecated (as of CycloneDX v1.5). We check this field for backward compatibility.
+ // cf. https://github.com/CycloneDX/cyclonedx-go/blob/b9654ae9b4705645152d20eb9872b5f3d73eac49/cyclonedx.go#L988
+ for _, tool := range lo.FromPtr(c.Metadata.Tools.Tools) {
if tool.Vendor == ToolVendor && tool.Name == ToolName {
return true
}
}
+
return false
}
diff --git a/pkg/sbom/cyclonedx/core/cyclonedx_test.go b/pkg/sbom/cyclonedx/core/cyclonedx_test.go
index d3b37308140f..87d5a589f9bf 100644
--- a/pkg/sbom/cyclonedx/core/cyclonedx_test.go
+++ b/pkg/sbom/cyclonedx/core/cyclonedx_test.go
@@ -2,6 +2,7 @@ package core_test
import (
"context"
+ "github.com/aquasecurity/trivy/pkg/purl"
"testing"
"time"
@@ -11,7 +12,6 @@ import (
"github.com/aquasecurity/trivy/pkg/clock"
"github.com/aquasecurity/trivy/pkg/digest"
- ftypes "github.com/aquasecurity/trivy/pkg/fanal/types"
"github.com/aquasecurity/trivy/pkg/sbom/cyclonedx/core"
"github.com/aquasecurity/trivy/pkg/uuid"
)
@@ -43,7 +43,7 @@ func TestMarshaler_CoreComponent(t *testing.T) {
Type: cdx.ComponentTypeContainer,
Name: "k8s.gcr.io/kube-apiserver",
Version: "sha256:18e61c783b41758dd391ab901366ec3546b26fae00eef7e223d1f94da808e02f",
- PackageURL: &ftypes.PackageURL{
+ PackageURL: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: "oci",
Name: "kube-apiserver",
@@ -138,7 +138,7 @@ func TestMarshaler_CoreComponent(t *testing.T) {
Value: "golang",
},
},
- PackageURL: &ftypes.PackageURL{
+ PackageURL: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: "golang",
Name: "kubelet",
@@ -157,7 +157,7 @@ func TestMarshaler_CoreComponent(t *testing.T) {
Value: "golang",
},
},
- PackageURL: &ftypes.PackageURL{
+ PackageURL: &purl.PackageURL{
PackageURL: packageurl.PackageURL{
Type: "golang",
Name: "containerd",
@@ -182,11 +182,14 @@ func TestMarshaler_CoreComponent(t *testing.T) {
Version: 1,
Metadata: &cdx.Metadata{
Timestamp: "2021-08-25T12:20:30+00:00",
- Tools: &[]cdx.Tool{
- {
- Name: "trivy",
- Vendor: "aquasecurity",
- Version: "dev",
+ Tools: &cdx.ToolsChoice{
+ Components: &[]cdx.Component{
+ {
+ Type: cdx.ComponentTypeApplication,
+ Name: "trivy",
+ Group: "aquasecurity",
+ Version: "dev",
+ },
},
},
Component: &cdx.Component{
diff --git a/pkg/sbom/cyclonedx/marshal.go b/pkg/sbom/cyclonedx/marshal.go
index 16cb37c2d2fc..287b4fee40cc 100644
--- a/pkg/sbom/cyclonedx/marshal.go
+++ b/pkg/sbom/cyclonedx/marshal.go
@@ -7,6 +7,7 @@ import (
"strings"
cdx "github.com/CycloneDX/cyclonedx-go"
+ "github.com/package-url/packageurl-go"
"github.com/samber/lo"
"golang.org/x/xerrors"
@@ -323,8 +324,11 @@ func pkgComponent(pkg Package) (*core.Component, error) {
// e.g. local Go packages
if pu := pkg.Identifier.PURL; pu != nil {
version = pu.Version
- // use `group` field for GroupID and `name` for ArtifactID for jar files
- if pkg.Type == ftypes.Jar {
+ // Use `group` field for GroupID and `name` for ArtifactID for java files
+ // https://github.com/aquasecurity/trivy/issues/4675
+ // Use `group` field for npm scopes
+ // https://github.com/aquasecurity/trivy/issues/5908
+ if pu.Type == packageurl.TypeMaven || pu.Type == packageurl.TypeNPM {
name = pu.Name
group = pu.Namespace
}
@@ -378,7 +382,7 @@ func pkgComponent(pkg Package) (*core.Component, error) {
Name: name,
Group: group,
Version: version,
- PackageURL: pkg.Identifier.PURL,
+ PackageURL: purl.WithPath(pkg.Identifier.PURL, pkg.FilePath),
Supplier: pkg.Maintainer,
Licenses: pkg.Licenses,
Hashes: lo.Ternary(pkg.Digest == "", nil, []digest.Digest{pkg.Digest}),
diff --git a/pkg/sbom/cyclonedx/marshal_test.go b/pkg/sbom/cyclonedx/marshal_test.go
index 8169baf040bb..a016e5b1e20a 100644
--- a/pkg/sbom/cyclonedx/marshal_test.go
+++ b/pkg/sbom/cyclonedx/marshal_test.go
@@ -63,21 +63,19 @@ func TestMarshaler_Marshal(t *testing.T) {
Epoch: 0,
Arch: "aarch64",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeRPM,
- Namespace: "centos",
- Name: "binutils",
- Version: "2.30-93.el8",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "arch",
- Value: "aarch64",
- },
- {
- Key: "distro",
- Value: "centos-8.3.2011",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeRPM,
+ Namespace: "centos",
+ Name: "binutils",
+ Version: "2.30-93.el8",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "arch",
+ Value: "aarch64",
+ },
+ {
+ Key: "distro",
+ Value: "centos-8.3.2011",
},
},
},
@@ -145,12 +143,10 @@ func TestMarshaler_Marshal(t *testing.T) {
Name: "actionpack",
Version: "7.0.0",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGem,
- Name: "actionpack",
- Version: "7.0.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGem,
+ Name: "actionpack",
+ Version: "7.0.0",
},
},
Indirect: false,
@@ -160,12 +156,10 @@ func TestMarshaler_Marshal(t *testing.T) {
Name: "actioncontroller",
Version: "7.0.0",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGem,
- Name: "actioncontroller",
- Version: "7.0.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGem,
+ Name: "actioncontroller",
+ Version: "7.0.0",
},
},
Indirect: false,
@@ -185,12 +179,10 @@ func TestMarshaler_Marshal(t *testing.T) {
Name: "actionpack",
Version: "7.0.0",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGem,
- Name: "actionpack",
- Version: "7.0.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGem,
+ Name: "actionpack",
+ Version: "7.0.0",
},
},
},
@@ -206,12 +198,10 @@ func TestMarshaler_Marshal(t *testing.T) {
Name: "Newtonsoft.Json",
Version: "9.0.1",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeNuget,
- Name: "Newtonsoft.Json",
- Version: "9.0.1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeNuget,
+ Name: "Newtonsoft.Json",
+ Version: "9.0.1",
},
},
},
@@ -226,13 +216,11 @@ func TestMarshaler_Marshal(t *testing.T) {
Name: "golang.org/x/crypto",
Version: "v0.0.0-20210421170649-83a5a9bb288b",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGolang,
- Namespace: "golang.org/x",
- Name: "crypto",
- Version: "v0.0.0-20210421170649-83a5a9bb288b",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGolang,
+ Namespace: "golang.org/x",
+ Name: "crypto",
+ Version: "v0.0.0-20210421170649-83a5a9bb288b",
},
},
},
@@ -254,11 +242,14 @@ func TestMarshaler_Marshal(t *testing.T) {
Version: 1,
Metadata: &cdx.Metadata{
Timestamp: "2021-08-25T12:20:30+00:00",
- Tools: &[]cdx.Tool{
- {
- Name: "trivy",
- Vendor: "aquasecurity",
- Version: "dev",
+ Tools: &cdx.ToolsChoice{
+ Components: &[]cdx.Component{
+ {
+ Type: cdx.ComponentTypeApplication,
+ Name: "trivy",
+ Group: "aquasecurity",
+ Version: "dev",
+ },
},
},
Component: &cdx.Component{
@@ -667,25 +658,23 @@ func TestMarshaler_Marshal(t *testing.T) {
Epoch: 1,
Arch: "aarch64",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeRPM,
- Namespace: "centos",
- Name: "acl",
- Version: "2.2.53-1.el8",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "arch",
- Value: "aarch64",
- },
- {
- Key: "distro",
- Value: "centos-8.3.2011",
- },
- {
- Key: "epoch",
- Value: "1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeRPM,
+ Namespace: "centos",
+ Name: "acl",
+ Version: "2.2.53-1.el8",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "arch",
+ Value: "aarch64",
+ },
+ {
+ Key: "distro",
+ Value: "centos-8.3.2011",
+ },
+ {
+ Key: "epoch",
+ Value: "1",
},
},
},
@@ -709,21 +698,19 @@ func TestMarshaler_Marshal(t *testing.T) {
Epoch: 0,
Arch: "aarch64",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeRPM,
- Namespace: "centos",
- Name: "glibc",
- Version: "2.28-151.el8",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "arch",
- Value: "aarch64",
- },
- {
- Key: "distro",
- Value: "centos-8.3.2011",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeRPM,
+ Namespace: "centos",
+ Name: "glibc",
+ Version: "2.28-151.el8",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "arch",
+ Value: "aarch64",
+ },
+ {
+ Key: "distro",
+ Value: "centos-8.3.2011",
},
},
},
@@ -748,13 +735,10 @@ func TestMarshaler_Marshal(t *testing.T) {
Name: "actionpack",
Version: "7.0.0",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGem,
- Name: "actionpack",
- Version: "7.0.0",
- },
- FilePath: "tools/project-john/specifications/actionpack.gemspec",
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGem,
+ Name: "actionpack",
+ Version: "7.0.0",
},
},
Layer: ftypes.Layer{
@@ -767,13 +751,10 @@ func TestMarshaler_Marshal(t *testing.T) {
Name: "actionpack",
Version: "7.0.1",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGem,
- Name: "actionpack",
- Version: "7.0.1",
- },
- FilePath: "tools/project-doe/specifications/actionpack.gemspec",
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGem,
+ Name: "actionpack",
+ Version: "7.0.1",
},
},
Layer: ftypes.Layer{
@@ -789,12 +770,10 @@ func TestMarshaler_Marshal(t *testing.T) {
PkgName: "actionpack",
PkgPath: "tools/project-john/specifications/actionpack.gemspec",
PkgIdentifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGem,
- Name: "actionpack",
- Version: "7.0.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGem,
+ Name: "actionpack",
+ Version: "7.0.0",
},
},
InstalledVersion: "7.0.0",
@@ -841,12 +820,10 @@ func TestMarshaler_Marshal(t *testing.T) {
PkgName: "actionpack",
PkgPath: "tools/project-doe/specifications/actionpack.gemspec",
PkgIdentifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGem,
- Name: "actionpack",
- Version: "7.0.1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGem,
+ Name: "actionpack",
+ Version: "7.0.1",
},
},
InstalledVersion: "7.0.1",
@@ -900,11 +877,14 @@ func TestMarshaler_Marshal(t *testing.T) {
Version: 1,
Metadata: &cdx.Metadata{
Timestamp: "2021-08-25T12:20:30+00:00",
- Tools: &[]cdx.Tool{
- {
- Name: "trivy",
- Vendor: "aquasecurity",
- Version: "dev",
+ Tools: &cdx.ToolsChoice{
+ Components: &[]cdx.Component{
+ {
+ Type: cdx.ComponentTypeApplication,
+ Name: "trivy",
+ Group: "aquasecurity",
+ Version: "dev",
+ },
},
},
Component: &cdx.Component{
@@ -1221,12 +1201,10 @@ func TestMarshaler_Marshal(t *testing.T) {
Name: "actioncable",
Version: "6.1.4.1",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGem,
- Name: "actioncable",
- Version: "6.1.4.1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGem,
+ Name: "actioncable",
+ Version: "6.1.4.1",
},
},
},
@@ -1241,20 +1219,37 @@ func TestMarshaler_Marshal(t *testing.T) {
Name: "org.springframework:spring-web",
Version: "5.3.22",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "org.springframework",
- Name: "spring-web",
- Version: "5.3.22",
- },
- FilePath: "spring-web-5.3.22.jar",
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "org.springframework",
+ Name: "spring-web",
+ Version: "5.3.22",
},
},
FilePath: "spring-web-5.3.22.jar",
},
},
},
+ {
+ Target: "yarn.lock",
+ Class: types.ClassLangPkg,
+ Type: ftypes.Yarn,
+ Packages: []ftypes.Package{
+ {
+ ID: "@babel/helper-string-parser@7.23.4",
+ Name: "@babel/helper-string-parser",
+ Version: "7.23.4",
+ Identifier: ftypes.PkgIdentifier{
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeNPM,
+ Namespace: "@babel",
+ Name: "helper-string-parser",
+ Version: "7.23.4",
+ },
+ },
+ },
+ },
+ },
},
},
want: &cdx.BOM{
@@ -1266,11 +1261,14 @@ func TestMarshaler_Marshal(t *testing.T) {
Version: 1,
Metadata: &cdx.Metadata{
Timestamp: "2021-08-25T12:20:30+00:00",
- Tools: &[]cdx.Tool{
- {
- Name: "trivy",
- Vendor: "aquasecurity",
- Version: "dev",
+ Tools: &cdx.ToolsChoice{
+ Components: &[]cdx.Component{
+ {
+ Type: cdx.ComponentTypeApplication,
+ Name: "trivy",
+ Group: "aquasecurity",
+ Version: "dev",
+ },
},
},
Component: &cdx.Component{
@@ -1301,6 +1299,21 @@ func TestMarshaler_Marshal(t *testing.T) {
},
},
},
+ {
+ BOMRef: "3ff14136-e09f-4df9-80ea-000000000004",
+ Type: cdx.ComponentTypeApplication,
+ Name: "yarn.lock",
+ Properties: &[]cdx.Property{
+ {
+ Name: "aquasecurity:trivy:Class",
+ Value: "lang-pkgs",
+ },
+ {
+ Name: "aquasecurity:trivy:Type",
+ Value: "yarn",
+ },
+ },
+ },
{
BOMRef: "pkg:gem/actioncable@6.1.4.1",
Type: "library",
@@ -1332,6 +1345,24 @@ func TestMarshaler_Marshal(t *testing.T) {
},
},
},
+ {
+ BOMRef: "pkg:npm/%40babel/helper-string-parser@7.23.4",
+ Type: "library",
+ Name: "helper-string-parser",
+ Group: "@babel",
+ Version: "7.23.4",
+ PackageURL: "pkg:npm/%40babel/helper-string-parser@7.23.4",
+ Properties: &[]cdx.Property{
+ {
+ Name: "aquasecurity:trivy:PkgID",
+ Value: "@babel/helper-string-parser@7.23.4",
+ },
+ {
+ Name: "aquasecurity:trivy:PkgType",
+ Value: "yarn",
+ },
+ },
+ },
},
Vulnerabilities: &[]cdx.Vulnerability{},
Dependencies: &[]cdx.Dependency{
@@ -1339,6 +1370,7 @@ func TestMarshaler_Marshal(t *testing.T) {
Ref: "3ff14136-e09f-4df9-80ea-000000000002",
Dependencies: &[]string{
"3ff14136-e09f-4df9-80ea-000000000003",
+ "3ff14136-e09f-4df9-80ea-000000000004",
"pkg:maven/org.springframework/spring-web@5.3.22?file_path=spring-web-5.3.22.jar",
},
},
@@ -1348,6 +1380,12 @@ func TestMarshaler_Marshal(t *testing.T) {
"pkg:gem/actioncable@6.1.4.1",
},
},
+ {
+ Ref: "3ff14136-e09f-4df9-80ea-000000000004",
+ Dependencies: &[]string{
+ "pkg:npm/%40babel/helper-string-parser@7.23.4",
+ },
+ },
{
Ref: "pkg:gem/actioncable@6.1.4.1",
Dependencies: lo.ToPtr([]string{}),
@@ -1356,6 +1394,10 @@ func TestMarshaler_Marshal(t *testing.T) {
Ref: "pkg:maven/org.springframework/spring-web@5.3.22?file_path=spring-web-5.3.22.jar",
Dependencies: lo.ToPtr([]string{}),
},
+ {
+ Ref: "pkg:npm/%40babel/helper-string-parser@7.23.4",
+ Dependencies: lo.ToPtr([]string{}),
+ },
},
},
},
@@ -1375,14 +1417,11 @@ func TestMarshaler_Marshal(t *testing.T) {
Name: "org.apache.nifi:nifi-dbcp-base",
Version: "1.20.0",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "org.apache.nifi",
- Name: "nifi-dbcp-base",
- Version: "1.20.0",
- },
- FilePath: "nifi-dbcp-base-1.20.0.jar",
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "org.apache.nifi",
+ Name: "nifi-dbcp-base",
+ Version: "1.20.0",
},
},
FilePath: "nifi-dbcp-base-1.20.0.jar",
@@ -1391,14 +1430,11 @@ func TestMarshaler_Marshal(t *testing.T) {
Name: "org.apache.nifi:nifi-hikari-dbcp-service",
Version: "1.20.0",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "org.apache.nifi",
- Name: "nifi-hikari-dbcp-service",
- Version: "1.20.0",
- },
- FilePath: "nifi-hikari-dbcp-service-1.20.0.jar",
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "org.apache.nifi",
+ Name: "nifi-hikari-dbcp-service",
+ Version: "1.20.0",
},
},
FilePath: "nifi-hikari-dbcp-service-1.20.0.jar",
@@ -1410,13 +1446,11 @@ func TestMarshaler_Marshal(t *testing.T) {
PkgName: "org.apache.nifi:nifi-dbcp-base",
PkgPath: "nifi-dbcp-base-1.20.0.jar",
PkgIdentifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "org.apache.nifi",
- Name: "nifi-dbcp-base",
- Version: "1.20.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "org.apache.nifi",
+ Name: "nifi-dbcp-base",
+ Version: "1.20.0",
},
},
InstalledVersion: "1.20.0",
@@ -1462,13 +1496,11 @@ func TestMarshaler_Marshal(t *testing.T) {
PkgName: "org.apache.nifi:nifi-hikari-dbcp-service",
PkgPath: "nifi-hikari-dbcp-service-1.20.0.jar",
PkgIdentifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "org.apache.nifi",
- Name: "nifi-hikari-dbcp-service",
- Version: "1.20.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "org.apache.nifi",
+ Name: "nifi-hikari-dbcp-service",
+ Version: "1.20.0",
},
},
InstalledVersion: "1.20.0",
@@ -1522,11 +1554,14 @@ func TestMarshaler_Marshal(t *testing.T) {
Version: 1,
Metadata: &cdx.Metadata{
Timestamp: "2021-08-25T12:20:30+00:00",
- Tools: &[]cdx.Tool{
- {
- Name: "trivy",
- Vendor: "aquasecurity",
- Version: "dev",
+ Tools: &cdx.ToolsChoice{
+ Components: &[]cdx.Component{
+ {
+ Type: cdx.ComponentTypeApplication,
+ Name: "trivy",
+ Group: "aquasecurity",
+ Version: "dev",
+ },
},
},
Component: &cdx.Component{
@@ -1680,13 +1715,10 @@ func TestMarshaler_Marshal(t *testing.T) {
Name: "ruby-typeprof",
Version: "0.20.1",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeNPM,
- Name: "ruby-typeprof",
- Version: "0.20.1",
- },
- FilePath: "usr/local/lib/ruby/gems/3.1.0/gems/typeprof-0.21.1/vscode/package.json",
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeNPM,
+ Name: "ruby-typeprof",
+ Version: "0.20.1",
},
},
Licenses: []string{"MIT"},
@@ -1708,11 +1740,14 @@ func TestMarshaler_Marshal(t *testing.T) {
Version: 1,
Metadata: &cdx.Metadata{
Timestamp: "2021-08-25T12:20:30+00:00",
- Tools: &[]cdx.Tool{
- {
- Name: "trivy",
- Vendor: "aquasecurity",
- Version: "dev",
+ Tools: &cdx.ToolsChoice{
+ Components: &[]cdx.Component{
+ {
+ Type: cdx.ComponentTypeApplication,
+ Name: "trivy",
+ Group: "aquasecurity",
+ Version: "dev",
+ },
},
},
Component: &cdx.Component{
@@ -1793,11 +1828,14 @@ func TestMarshaler_Marshal(t *testing.T) {
Version: 1,
Metadata: &cdx.Metadata{
Timestamp: "2021-08-25T12:20:30+00:00",
- Tools: &[]cdx.Tool{
- {
- Name: "trivy",
- Vendor: "aquasecurity",
- Version: "dev",
+ Tools: &cdx.ToolsChoice{
+ Components: &[]cdx.Component{
+ {
+ Type: cdx.ComponentTypeApplication,
+ Name: "trivy",
+ Group: "aquasecurity",
+ Version: "dev",
+ },
},
},
Component: &cdx.Component{
diff --git a/pkg/sbom/cyclonedx/testdata/happy/bom.json b/pkg/sbom/cyclonedx/testdata/happy/bom.json
index 924daef7f405..a7a1a474b8bd 100644
--- a/pkg/sbom/cyclonedx/testdata/happy/bom.json
+++ b/pkg/sbom/cyclonedx/testdata/happy/bom.json
@@ -5,13 +5,16 @@
"version": 1,
"metadata": {
"timestamp": "2022-05-28T10:20:03.79527Z",
- "tools": [
- {
- "vendor": "aquasecurity",
- "name": "trivy",
- "version": "dev"
- }
- ],
+ "tools": {
+ "components": [
+ {
+ "type": "application",
+ "group": "aquasecurity",
+ "name": "trivy",
+ "version": "dev"
+ }
+ ]
+ },
"component": {
"bom-ref": "0f585d64-4815-4b72-92c5-97dae191fa4a",
"type": "container",
@@ -121,8 +124,9 @@
]
},
{
- "bom-ref": "pkg:npm/bootstrap@5.0.2?file_path=app%2Fapp%2Fpackage.json",
+ "bom-ref": "pkg:npm/@example/bootstrap@5.0.2?file_path=app%2Fapp%2Fpackage.json",
"type": "library",
+ "group": "@example",
"name": "bootstrap",
"version": "5.0.2",
"licenses": [
@@ -132,7 +136,7 @@
}
}
],
- "purl": "pkg:npm/bootstrap@5.0.2",
+ "purl": "pkg:npm/@example/bootstrap@5.0.2",
"properties": [
{
"name": "aquasecurity:trivy:FilePath",
@@ -265,7 +269,7 @@
"60e9f57b-d4a6-4f71-ad14-0893ac609182",
"pkg:maven/org.codehaus.mojo/child-project@1.0?file_path=app%2Fmaven%2Ftarget%2Fchild-project-1.0.jar",
"pkg:maven/com.example/example@0.0.1",
- "pkg:npm/bootstrap@5.0.2?file_path=app%2Fapp%2Fpackage.json",
+ "pkg:npm/@example/bootstrap@5.0.2?file_path=app%2Fapp%2Fpackage.json",
"100925ff-7c0a-470f-a725-8fb973b40e7b",
"1a111e6b-a682-470e-8b0e-aaa49d93cd39"
]
diff --git a/pkg/sbom/cyclonedx/testdata/happy/empty-metadata-component-bom.json b/pkg/sbom/cyclonedx/testdata/happy/empty-metadata-component-bom.json
index 63109c739206..2fb29d2647af 100644
--- a/pkg/sbom/cyclonedx/testdata/happy/empty-metadata-component-bom.json
+++ b/pkg/sbom/cyclonedx/testdata/happy/empty-metadata-component-bom.json
@@ -5,13 +5,16 @@
"version": 1,
"metadata": {
"timestamp": "2022-05-28T10:20:03.79527Z",
- "tools": [
- {
- "vendor": "aquasecurity",
- "name": "trivy",
- "version": "dev"
- }
- ]
+ "tools": {
+ "components": [
+ {
+ "type": "application",
+ "group": "aquasecurity",
+ "name": "trivy",
+ "version": "dev"
+ }
+ ]
+ }
},
"dependencies": []
}
\ No newline at end of file
diff --git a/pkg/sbom/cyclonedx/testdata/happy/group-in-name.json b/pkg/sbom/cyclonedx/testdata/happy/group-in-name.json
index e42790df19ca..f7e7e44dc437 100644
--- a/pkg/sbom/cyclonedx/testdata/happy/group-in-name.json
+++ b/pkg/sbom/cyclonedx/testdata/happy/group-in-name.json
@@ -5,13 +5,16 @@
"version": 1,
"metadata": {
"timestamp": "2023-06-20T04:32:10+00:00",
- "tools": [
- {
- "vendor": "aquasecurity",
- "name": "trivy",
- "version": "0.42.1"
- }
- ],
+ "tools": {
+ "components": [
+ {
+ "type": "application",
+ "group": "aquasecurity",
+ "name": "trivy",
+ "version": "dev"
+ }
+ ]
+ },
"component": {
"bom-ref": "b0ae8323-eb7b-4be5-bc5c-4849fd795ec0",
"type": "application",
diff --git a/pkg/sbom/cyclonedx/testdata/happy/independent-library-bom.json b/pkg/sbom/cyclonedx/testdata/happy/independent-library-bom.json
index 0a1b337820c2..164eed844166 100644
--- a/pkg/sbom/cyclonedx/testdata/happy/independent-library-bom.json
+++ b/pkg/sbom/cyclonedx/testdata/happy/independent-library-bom.json
@@ -5,13 +5,16 @@
"version": 1,
"metadata": {
"timestamp": "2022-05-28T10:20:03.79527Z",
- "tools": [
- {
- "vendor": "aquasecurity",
- "name": "trivy",
- "version": "dev"
- }
- ],
+ "tools": {
+ "components": [
+ {
+ "type": "application",
+ "group": "aquasecurity",
+ "name": "trivy",
+ "version": "dev"
+ }
+ ]
+ },
"component": {
"bom-ref": "0f585d64-4815-4b72-92c5-97dae191fa4a",
"type": "application",
diff --git a/pkg/sbom/cyclonedx/testdata/happy/infinite-loop-bom.json b/pkg/sbom/cyclonedx/testdata/happy/infinite-loop-bom.json
index b3d039379709..d1080b4de92a 100644
--- a/pkg/sbom/cyclonedx/testdata/happy/infinite-loop-bom.json
+++ b/pkg/sbom/cyclonedx/testdata/happy/infinite-loop-bom.json
@@ -5,13 +5,16 @@
"version": 1,
"metadata": {
"timestamp": "2023-04-06T05:41:44+00:00",
- "tools": [
- {
- "vendor": "aquasecurity",
- "name": "trivy",
- "version": "dev"
- }
- ],
+ "tools": {
+ "components": [
+ {
+ "type": "application",
+ "group": "aquasecurity",
+ "name": "trivy",
+ "version": "dev"
+ }
+ ]
+ },
"component": {
"bom-ref": "pkg:oci/ubuntu@sha256:67211c14fa74f070d27cc59d69a7fa9aeff8e28ea118ef3babc295a0428a6d21?repository_url=index.docker.io%2Flibrary%2Fubuntu\u0026arch=amd64",
"type": "container",
diff --git a/pkg/sbom/cyclonedx/testdata/happy/kbom.json b/pkg/sbom/cyclonedx/testdata/happy/kbom.json
index a843dbdfd212..3219cf7efaf6 100644
--- a/pkg/sbom/cyclonedx/testdata/happy/kbom.json
+++ b/pkg/sbom/cyclonedx/testdata/happy/kbom.json
@@ -6,13 +6,16 @@
"version": 1,
"metadata": {
"timestamp": "2023-09-29T06:25:00+00:00",
- "tools": [
- {
- "vendor": "aquasecurity",
- "name": "trivy",
- "version": "0.45.1-15-g7bbd0d097"
- }
- ],
+ "tools": {
+ "components": [
+ {
+ "type": "application",
+ "group": "aquasecurity",
+ "name": "trivy",
+ "version": "dev"
+ }
+ ]
+ },
"component": {
"bom-ref": "pkg:k8s/k8s.io%2Fkubernetes@1.27.4",
"type": "platform",
diff --git a/pkg/sbom/cyclonedx/testdata/happy/os-only-bom.json b/pkg/sbom/cyclonedx/testdata/happy/os-only-bom.json
index 820057006668..837c16754211 100644
--- a/pkg/sbom/cyclonedx/testdata/happy/os-only-bom.json
+++ b/pkg/sbom/cyclonedx/testdata/happy/os-only-bom.json
@@ -5,13 +5,16 @@
"version": 1,
"metadata": {
"timestamp": "2022-05-28T10:20:03.79527Z",
- "tools": [
- {
- "vendor": "aquasecurity",
- "name": "trivy",
- "version": "dev"
- }
- ],
+ "tools": {
+ "components": [
+ {
+ "type": "application",
+ "group": "aquasecurity",
+ "name": "trivy",
+ "version": "dev"
+ }
+ ]
+ },
"component": {
"bom-ref": "0f585d64-4815-4b72-92c5-97dae191fa4a",
"type": "container",
diff --git a/pkg/sbom/cyclonedx/testdata/happy/unrelated-bom.json b/pkg/sbom/cyclonedx/testdata/happy/unrelated-bom.json
index 5d9231de109d..aecf8e05abfb 100644
--- a/pkg/sbom/cyclonedx/testdata/happy/unrelated-bom.json
+++ b/pkg/sbom/cyclonedx/testdata/happy/unrelated-bom.json
@@ -5,13 +5,16 @@
"version": 1,
"metadata": {
"timestamp": "2022-05-28T10:20:03.79527Z",
- "tools": [
- {
- "vendor": "aquasecurity",
- "name": "trivy",
- "version": "dev"
- }
- ],
+ "tools": {
+ "components": [
+ {
+ "type": "application",
+ "group": "aquasecurity",
+ "name": "trivy",
+ "version": "dev"
+ }
+ ]
+ },
"component": {
"bom-ref": "0f585d64-4815-4b72-92c5-97dae191fa4a",
"type": "application",
diff --git a/pkg/sbom/cyclonedx/testdata/sad/invalid-purl.json b/pkg/sbom/cyclonedx/testdata/sad/invalid-purl.json
index 58c9e14c8fff..070da15fbb05 100644
--- a/pkg/sbom/cyclonedx/testdata/sad/invalid-purl.json
+++ b/pkg/sbom/cyclonedx/testdata/sad/invalid-purl.json
@@ -5,13 +5,16 @@
"version": 1,
"metadata": {
"timestamp": "2022-05-28T10:20:03.79527Z",
- "tools": [
- {
- "vendor": "aquasecurity",
- "name": "trivy",
- "version": "dev"
- }
- ],
+ "tools": {
+ "components": [
+ {
+ "type": "application",
+ "group": "aquasecurity",
+ "name": "trivy",
+ "version": "dev"
+ }
+ ]
+ },
"component": {
"bom-ref": "0f585d64-4815-4b72-92c5-97dae191fa4a",
"type": "application",
diff --git a/pkg/sbom/cyclonedx/unmarshal.go b/pkg/sbom/cyclonedx/unmarshal.go
index 77babfda26aa..921c3455d121 100644
--- a/pkg/sbom/cyclonedx/unmarshal.go
+++ b/pkg/sbom/cyclonedx/unmarshal.go
@@ -202,7 +202,7 @@ func parsePkgs(components []cdx.Component, seen map[string]struct{}) ([]ftypes.P
}
// Skip unsupported package types
- if purl.Class(pkgURL) == types.ClassUnknown {
+ if pkgURL.Class() == types.ClassUnknown {
continue
}
pkgs = append(pkgs, *pkg)
@@ -290,11 +290,11 @@ func aggregatePkgs(libs []cdx.Component) ([]ftypes.PackageInfo, []ftypes.Applica
return nil, nil, xerrors.Errorf("failed to parse the component: %w", err)
}
- switch purl.Class(pkgURL) {
+ switch pkgURL.Class() {
case types.ClassOSPkg:
osPkgMap[pkgURL.Type] = append(osPkgMap[pkgURL.Type], *pkg)
case types.ClassLangPkg:
- langType := purl.LangType(pkgURL)
+ langType := pkgURL.LangType()
langPkgMap[langType] = append(langPkgMap[langType], *pkg)
}
}
@@ -337,7 +337,7 @@ func toApplication(component cdx.Component) *ftypes.Application {
}
}
-func toPackage(component cdx.Component) (*ftypes.PackageURL, *ftypes.Package, error) {
+func toPackage(component cdx.Component) (*purl.PackageURL, *ftypes.Package, error) {
if component.PackageURL == "" {
log.Logger.Warnf("Skip the component (BOM-Ref: %s) as the PURL is empty", component.BOMRef)
return nil, nil, ErrPURLEmpty
@@ -347,7 +347,7 @@ func toPackage(component cdx.Component) (*ftypes.PackageURL, *ftypes.Package, er
return nil, nil, xerrors.Errorf("failed to parse purl: %w", err)
}
- pkg := purl.ToPackage(p)
+ pkg := p.Package()
// Trivy's marshall loses case-sensitivity in PURL used in SBOM for packages (Go, Npm, PyPI),
// so we have to use an original package name
pkg.Name = packageName(p.Type, pkg.Name, component)
@@ -382,12 +382,9 @@ func toPackage(component cdx.Component) (*ftypes.PackageURL, *ftypes.Package, er
if pkg.FilePath != "" {
p.FilePath = pkg.FilePath
}
- pkg.Identifier = ftypes.PkgIdentifier{
- PURL: p,
- BOMRef: component.BOMRef,
- }
+ pkg.Identifier.BOMRef = component.BOMRef
- if purl.Class(p) == types.ClassOSPkg {
+ if p.Class() == types.ClassOSPkg {
fillSrcPkg(pkg)
}
@@ -422,10 +419,11 @@ func toTrivyCdxComponent(component cdx.Component) ftypes.Component {
}
func packageName(typ, pkgNameFromPurl string, component cdx.Component) string {
- if typ == packageurl.TypeMaven {
- // Jar uses `Group` field for `GroupID`
+ if typ == packageurl.TypeMaven || typ == packageurl.TypeNPM {
+ // Maven uses `Group` field for `GroupID`
+ // Npm uses `Group` field for `Scope`
if component.Group != "" {
- return fmt.Sprintf("%s:%s", component.Group, component.Name)
+ return fmt.Sprintf("%s%s%s", component.Group, packageNameSeparator(typ), component.Name)
} else {
// use name derived from purl if `Group` doesn't exist
return pkgNameFromPurl
@@ -434,6 +432,14 @@ func packageName(typ, pkgNameFromPurl string, component cdx.Component) string {
return component.Name
}
+// packageNameSeparator selects separator to join `group` and `name` fields of the component
+func packageNameSeparator(typ string) string {
+ if typ == packageurl.TypeMaven {
+ return ":"
+ }
+ return "/"
+}
+
// parsePackageLicenses checks all supported license fields and returns a list of licenses.
// https://cyclonedx.org/docs/1.5/json/#components_items_licenses
func parsePackageLicenses(l *cdx.Licenses) []string {
diff --git a/pkg/sbom/cyclonedx/unmarshal_test.go b/pkg/sbom/cyclonedx/unmarshal_test.go
index a61bbf8d0d30..61b24082343e 100644
--- a/pkg/sbom/cyclonedx/unmarshal_test.go
+++ b/pkg/sbom/cyclonedx/unmarshal_test.go
@@ -40,17 +40,15 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
SrcVersion: "1.2.3-r0",
Licenses: []string{"MIT"},
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeApk,
- Namespace: "alpine",
- Name: "musl",
- Version: "1.2.3-r0",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "distro",
- Value: "3.16.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeApk,
+ Namespace: "alpine",
+ Name: "musl",
+ Version: "1.2.3-r0",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "distro",
+ Value: "3.16.0",
},
},
},
@@ -72,13 +70,11 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "pear/log",
Version: "1.13.1",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeComposer,
- Namespace: "pear",
- Name: "log",
- Version: "1.13.1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Namespace: "pear",
+ Name: "log",
+ Version: "1.13.1",
},
BOMRef: "pkg:composer/pear/log@1.13.1",
},
@@ -91,13 +87,11 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "pear/pear_exception",
Version: "v1.0.0",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeComposer,
- Namespace: "pear",
- Name: "pear_exception",
- Version: "v1.0.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Namespace: "pear",
+ Name: "pear_exception",
+ Version: "v1.0.0",
},
BOMRef: "pkg:composer/pear/pear_exception@v1.0.0",
},
@@ -115,13 +109,11 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "github.com/package-url/packageurl-go",
Version: "v0.1.1-0.20220203205134-d70459300c8a",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGolang,
- Namespace: "github.com/package-url",
- Name: "packageurl-go",
- Version: "v0.1.1-0.20220203205134-d70459300c8a",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGolang,
+ Namespace: "github.com/package-url",
+ Name: "packageurl-go",
+ Version: "v0.1.1-0.20220203205134-d70459300c8a",
},
BOMRef: "pkg:golang/github.com/package-url/packageurl-go@v0.1.1-0.20220203205134-d70459300c8a",
},
@@ -138,13 +130,11 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
{
Name: "com.example:example",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "com.example",
- Name: "example",
- Version: "0.0.1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "com.example",
+ Name: "example",
+ Version: "0.0.1",
},
BOMRef: "pkg:maven/com.example/example@0.0.1",
},
@@ -161,14 +151,11 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
{
Name: "org.codehaus.mojo:child-project",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "org.codehaus.mojo",
- Name: "child-project",
- Version: "1.0",
- },
- FilePath: "app/maven/target/child-project-1.0.jar",
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "org.codehaus.mojo",
+ Name: "child-project",
+ Version: "1.0",
},
BOMRef: "pkg:maven/org.codehaus.mojo/child-project@1.0?file_path=app%2Fmaven%2Ftarget%2Fchild-project-1.0.jar",
},
@@ -185,18 +172,16 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
FilePath: "",
Libraries: ftypes.Packages{
{
- Name: "bootstrap",
+ Name: "@example/bootstrap",
Version: "5.0.2",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeNPM,
- Name: "bootstrap",
- Version: "5.0.2",
- },
- FilePath: "app/app/package.json",
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeNPM,
+ Namespace: "@example",
+ Name: "bootstrap",
+ Version: "5.0.2",
},
- BOMRef: "pkg:npm/bootstrap@5.0.2?file_path=app%2Fapp%2Fpackage.json",
+ BOMRef: "pkg:npm/@example/bootstrap@5.0.2?file_path=app%2Fapp%2Fpackage.json",
},
Licenses: []string{"MIT"},
Layer: ftypes.Layer{
@@ -230,12 +215,10 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "docker",
Version: "24.0.4",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGolang,
- Name: "docker",
- Version: "24.0.4",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGolang,
+ Name: "docker",
+ Version: "24.0.4",
},
BOMRef: "pkg:golang/docker@24.0.4",
},
@@ -253,12 +236,10 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "k8s.io/apiserver",
Version: "1.27.4",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: purl.TypeK8s,
- Name: "k8s.io/apiserver",
- Version: "1.27.4",
- },
+ PURL: &packageurl.PackageURL{
+ Type: purl.TypeK8s,
+ Name: "k8s.io/apiserver",
+ Version: "1.27.4",
},
BOMRef: "pkg:k8s/k8s.io%2Fapiserver@1.27.4",
},
@@ -267,12 +248,10 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "k8s.io/controller-manager",
Version: "1.27.4",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: purl.TypeK8s,
- Name: "k8s.io/controller-manager",
- Version: "1.27.4",
- },
+ PURL: &packageurl.PackageURL{
+ Type: purl.TypeK8s,
+ Name: "k8s.io/controller-manager",
+ Version: "1.27.4",
},
BOMRef: "pkg:k8s/k8s.io%2Fcontroller-manager@1.27.4",
},
@@ -281,12 +260,10 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "k8s.io/kube-proxy",
Version: "1.27.4",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: purl.TypeK8s,
- Name: "k8s.io/kube-proxy",
- Version: "1.27.4",
- },
+ PURL: &packageurl.PackageURL{
+ Type: purl.TypeK8s,
+ Name: "k8s.io/kube-proxy",
+ Version: "1.27.4",
},
BOMRef: "pkg:k8s/k8s.io%2Fkube-proxy@1.27.4",
},
@@ -295,12 +272,10 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "k8s.io/kube-scheduler",
Version: "1.27.4",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: purl.TypeK8s,
- Name: "k8s.io/kube-scheduler",
- Version: "1.27.4",
- },
+ PURL: &packageurl.PackageURL{
+ Type: purl.TypeK8s,
+ Name: "k8s.io/kube-scheduler",
+ Version: "1.27.4",
},
BOMRef: "pkg:k8s/k8s.io%2Fkube-scheduler@1.27.4",
},
@@ -309,12 +284,10 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "k8s.io/kubelet",
Version: "1.27.4",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: purl.TypeK8s,
- Name: "k8s.io/kubelet",
- Version: "1.27.4",
- },
+ PURL: &packageurl.PackageURL{
+ Type: purl.TypeK8s,
+ Name: "k8s.io/kubelet",
+ Version: "1.27.4",
},
BOMRef: "pkg:k8s/k8s.io%2Fkubelet@1.27.4",
},
@@ -323,12 +296,10 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "k8s.io/kubernetes",
Version: "1.27.4",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: purl.TypeK8s,
- Name: "k8s.io/kubernetes",
- Version: "1.27.4",
- },
+ PURL: &packageurl.PackageURL{
+ Type: purl.TypeK8s,
+ Name: "k8s.io/kubernetes",
+ Version: "1.27.4",
},
BOMRef: "pkg:k8s/k8s.io%2Fkubernetes@1.27.4",
},
@@ -362,17 +333,15 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
"GFDL-1.3",
},
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeDebian,
- Namespace: "ubuntu",
- Name: "libc6",
- Version: "2.35-0ubuntu3.1",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "distro",
- Value: "ubuntu-22.04",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeDebian,
+ Namespace: "ubuntu",
+ Name: "libc6",
+ Version: "2.35-0ubuntu3.1",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "distro",
+ Value: "ubuntu-22.04",
},
},
},
@@ -393,21 +362,19 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
SrcRelease: "1",
SrcEpoch: 1,
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeDebian,
- Namespace: "ubuntu",
- Name: "libcrypt1",
- Version: "4.4.27-1",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "distro",
- Value: "ubuntu-22.04",
- },
- {
- Key: "epoch",
- Value: "1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeDebian,
+ Namespace: "ubuntu",
+ Name: "libcrypt1",
+ Version: "4.4.27-1",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "distro",
+ Value: "ubuntu-22.04",
+ },
+ {
+ Key: "epoch",
+ Value: "1",
},
},
},
@@ -441,17 +408,15 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
SrcVersion: "1.2.3-r0",
Licenses: []string{"MIT"},
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeApk,
- Namespace: "alpine",
- Name: "musl",
- Version: "1.2.3-r0",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "distro",
- Value: "3.16.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeApk,
+ Namespace: "alpine",
+ Name: "musl",
+ Version: "1.2.3-r0",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "distro",
+ Value: "3.16.0",
},
},
},
@@ -470,13 +435,11 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "pear/log",
Version: "1.13.1",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeComposer,
- Namespace: "pear",
- Name: "log",
- Version: "1.13.1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Namespace: "pear",
+ Name: "log",
+ Version: "1.13.1",
},
BOMRef: "pkg:composer/pear/log@1.13.1",
},
@@ -487,13 +450,11 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "pear/pear_exception",
Version: "v1.0.0",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeComposer,
- Namespace: "pear",
- Name: "pear_exception",
- Version: "v1.0.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Namespace: "pear",
+ Name: "pear_exception",
+ Version: "v1.0.0",
},
BOMRef: "pkg:composer/pear/pear_exception@v1.0.0",
},
@@ -516,13 +477,11 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "pear/log",
Version: "1.13.1",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeComposer,
- Namespace: "pear",
- Name: "log",
- Version: "1.13.1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Namespace: "pear",
+ Name: "log",
+ Version: "1.13.1",
},
BOMRef: "pkg:composer/pear/log@1.13.1",
},
@@ -545,13 +504,11 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "pear/log",
Version: "1.13.1",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeComposer,
- Namespace: "pear",
- Name: "log",
- Version: "1.13.1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Namespace: "pear",
+ Name: "log",
+ Version: "1.13.1",
},
BOMRef: "pkg:composer/pear/log@1.13.1",
},
@@ -561,13 +518,11 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "pear/pear_exception",
Version: "v1.0.0",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeComposer,
- Namespace: "pear",
- Name: "pear_exception",
- Version: "v1.0.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Namespace: "pear",
+ Name: "pear_exception",
+ Version: "v1.0.0",
},
BOMRef: "pkg:composer/pear/pear_exception@v1.0.0",
},
@@ -590,13 +545,11 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "pear/core",
Version: "1.13.1",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeComposer,
- Namespace: "pear",
- Name: "core",
- Version: "1.13.1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Namespace: "pear",
+ Name: "core",
+ Version: "1.13.1",
},
BOMRef: "pkg:composer/pear/core@1.13.1",
},
@@ -605,13 +558,11 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "pear/log",
Version: "1.13.1",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeComposer,
- Namespace: "pear",
- Name: "log",
- Version: "1.13.1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Namespace: "pear",
+ Name: "log",
+ Version: "1.13.1",
},
BOMRef: "pkg:composer/pear/log@1.13.1",
},
@@ -621,13 +572,11 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "pear/pear_exception",
Version: "v1.0.0",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeComposer,
- Namespace: "pear",
- Name: "pear_exception",
- Version: "v1.0.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Namespace: "pear",
+ Name: "pear_exception",
+ Version: "v1.0.0",
},
BOMRef: "pkg:composer/pear/pear_exception@v1.0.0",
},
@@ -649,14 +598,11 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "org.springframework:spring-web",
Version: "5.3.22",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "org.springframework",
- Name: "spring-web",
- Version: "5.3.22",
- },
- FilePath: "spring-web-5.3.22.jar",
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "org.springframework",
+ Name: "spring-web",
+ Version: "5.3.22",
},
BOMRef: "pkg:maven/org.springframework/spring-web@5.3.22?file_path=spring-web-5.3.22.jar",
},
diff --git a/pkg/sbom/spdx/marshal_test.go b/pkg/sbom/spdx/marshal_test.go
index abd356d6ec7e..616108886264 100644
--- a/pkg/sbom/spdx/marshal_test.go
+++ b/pkg/sbom/spdx/marshal_test.go
@@ -62,21 +62,19 @@ func TestMarshaler_Marshal(t *testing.T) {
Epoch: 0,
Arch: "aarch64",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeRPM,
- Namespace: "centos",
- Name: "binutils",
- Version: "2.30-93.el8",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "arch",
- Value: "aarch64",
- },
- {
- Key: "distro",
- Value: "centos-8.3.2011",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeRPM,
+ Namespace: "centos",
+ Name: "binutils",
+ Version: "2.30-93.el8",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "arch",
+ Value: "aarch64",
+ },
+ {
+ Key: "distro",
+ Value: "centos-8.3.2011",
},
},
},
@@ -101,12 +99,10 @@ func TestMarshaler_Marshal(t *testing.T) {
Name: "actionpack",
Version: "7.0.1",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGem,
- Name: "actionpack",
- Version: "7.0.1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGem,
+ Name: "actionpack",
+ Version: "7.0.1",
},
},
},
@@ -114,12 +110,10 @@ func TestMarshaler_Marshal(t *testing.T) {
Name: "actioncontroller",
Version: "7.0.1",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGem,
- Name: "actioncontroller",
- Version: "7.0.1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGem,
+ Name: "actioncontroller",
+ Version: "7.0.1",
},
},
},
@@ -134,12 +128,10 @@ func TestMarshaler_Marshal(t *testing.T) {
Name: "actionpack",
Version: "7.0.1",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGem,
- Name: "actionpack",
- Version: "7.0.1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGem,
+ Name: "actionpack",
+ Version: "7.0.1",
},
},
},
@@ -351,25 +343,23 @@ func TestMarshaler_Marshal(t *testing.T) {
Epoch: 1,
Arch: "aarch64",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeRPM,
- Namespace: "centos",
- Name: "acl",
- Version: "2.2.53-1.el8",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "arch",
- Value: "aarch64",
- },
- {
- Key: "distro",
- Value: "centos-8.3.2011",
- },
- {
- Key: "epoch",
- Value: "1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeRPM,
+ Namespace: "centos",
+ Name: "acl",
+ Version: "2.2.53-1.el8",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "arch",
+ Value: "aarch64",
+ },
+ {
+ Key: "distro",
+ Value: "centos-8.3.2011",
+ },
+ {
+ Key: "epoch",
+ Value: "1",
},
},
},
@@ -393,12 +383,10 @@ func TestMarshaler_Marshal(t *testing.T) {
Name: "actionpack",
Version: "7.0.1",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGem,
- Name: "actionpack",
- Version: "7.0.1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGem,
+ Name: "actionpack",
+ Version: "7.0.1",
},
},
Layer: ftypes.Layer{
@@ -411,12 +399,10 @@ func TestMarshaler_Marshal(t *testing.T) {
Name: "actionpack",
Version: "7.0.1",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGem,
- Name: "actionpack",
- Version: "7.0.1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGem,
+ Name: "actionpack",
+ Version: "7.0.1",
},
},
Layer: ftypes.Layer{
@@ -634,12 +620,10 @@ func TestMarshaler_Marshal(t *testing.T) {
Name: "actioncable",
Version: "6.1.4.1",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGem,
- Name: "actioncable",
- Version: "6.1.4.1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGem,
+ Name: "actioncable",
+ Version: "6.1.4.1",
},
},
},
@@ -736,12 +720,10 @@ func TestMarshaler_Marshal(t *testing.T) {
Name: "ruby-typeprof",
Version: "0.20.1",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeNPM,
- Name: "ruby-typeprof",
- Version: "0.20.1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeNPM,
+ Name: "ruby-typeprof",
+ Version: "0.20.1",
},
},
Licenses: []string{"MIT"},
@@ -976,13 +958,11 @@ func TestMarshaler_Marshal(t *testing.T) {
Name: "golang.org/x/crypto",
Version: "v0.0.1",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGolang,
- Namespace: "golang.org/x",
- Name: "crypto",
- Version: "v0.0.1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGolang,
+ Namespace: "golang.org/x",
+ Name: "crypto",
+ Version: "v0.0.1",
},
},
},
diff --git a/pkg/sbom/spdx/unmarshal.go b/pkg/sbom/spdx/unmarshal.go
index 5ce4237ac20a..1723476a323d 100644
--- a/pkg/sbom/spdx/unmarshal.go
+++ b/pkg/sbom/spdx/unmarshal.go
@@ -177,12 +177,12 @@ func (s *SPDX) parsePackages(pkgs map[common.ElementID]*spdx.Package) error {
} else if err != nil {
return xerrors.Errorf("failed to parse package: %w", err)
}
- switch purl.Class(pkgURL) {
+ switch pkgURL.Class() {
case types.ClassOSPkg:
osPkgs = append(osPkgs, *pkg)
case types.ClassLangPkg:
// Language-specific packages
- pkgType := purl.LangType(pkgURL)
+ pkgType := pkgURL.LangType()
app, ok := apps[pkgType]
if !ok {
app.Type = pkgType
@@ -246,12 +246,13 @@ func parseOS(pkg spdx.Package) ftypes.OS {
}
}
-func parsePkg(spdxPkg spdx.Package, packageFilePaths map[string]string) (*ftypes.Package, *ftypes.PackageURL, error) {
- pkg, pkgURL, err := parseExternalReferences(spdxPkg.PackageExternalReferences)
+func parsePkg(spdxPkg spdx.Package, packageFilePaths map[string]string) (*ftypes.Package, *purl.PackageURL, error) {
+ pkgURL, err := parseExternalReferences(spdxPkg.PackageExternalReferences)
if err != nil {
return nil, nil, xerrors.Errorf("external references error: %w", err)
}
+ pkg := pkgURL.Package()
if spdxPkg.PackageLicenseDeclared != "NONE" {
pkg.Licenses = strings.Split(spdxPkg.PackageLicenseDeclared, ",")
}
@@ -278,7 +279,7 @@ func parsePkg(spdxPkg spdx.Package, packageFilePaths map[string]string) (*ftypes
return pkg, pkgURL, nil
}
-func parseExternalReferences(refs []*spdx.PackageExternalReference) (*ftypes.Package, *ftypes.PackageURL, error) {
+func parseExternalReferences(refs []*spdx.PackageExternalReference) (*purl.PackageURL, error) {
for _, ref := range refs {
// Extract the package information from PURL
if ref.RefType != RefTypePurl || ref.Category != CategoryPackageManager {
@@ -287,15 +288,11 @@ func parseExternalReferences(refs []*spdx.PackageExternalReference) (*ftypes.Pac
packageURL, err := purl.FromString(ref.Locator)
if err != nil {
- return nil, nil, xerrors.Errorf("failed to parse purl from string: %w", err)
+ return nil, xerrors.Errorf("failed to parse purl from string: %w", err)
}
- pkg := purl.ToPackage(packageURL)
- pkg.Identifier = ftypes.PkgIdentifier{
- PURL: packageURL,
- }
- return pkg, packageURL, nil
+ return packageURL, nil
}
- return nil, nil, errUnknownPackageFormat
+ return nil, errUnknownPackageFormat
}
func lookupAttributionTexts(attributionTexts []string, key string) string {
diff --git a/pkg/sbom/spdx/unmarshal_test.go b/pkg/sbom/spdx/unmarshal_test.go
index dfa09a0c86fa..2d6ee258c378 100644
--- a/pkg/sbom/spdx/unmarshal_test.go
+++ b/pkg/sbom/spdx/unmarshal_test.go
@@ -40,17 +40,15 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
SrcVersion: "1.2.3-r0",
Licenses: []string{"MIT"},
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeApk,
- Namespace: "alpine",
- Name: "musl",
- Version: "1.2.3-r0",
- Qualifiers: packageurl.Qualifiers{
- {
- Key: "distro",
- Value: "3.16.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeApk,
+ Namespace: "alpine",
+ Name: "musl",
+ Version: "1.2.3-r0",
+ Qualifiers: packageurl.Qualifiers{
+ {
+ Key: "distro",
+ Value: "3.16.0",
},
},
},
@@ -71,13 +69,11 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "pear/log",
Version: "1.13.1",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeComposer,
- Namespace: "pear",
- Name: "log",
- Version: "1.13.1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Namespace: "pear",
+ Name: "log",
+ Version: "1.13.1",
},
},
Layer: ftypes.Layer{
@@ -89,13 +85,11 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "pear/pear_exception",
Version: "v1.0.0",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeComposer,
- Namespace: "pear",
- Name: "pear_exception",
- Version: "v1.0.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Namespace: "pear",
+ Name: "pear_exception",
+ Version: "v1.0.0",
},
},
Layer: ftypes.Layer{
@@ -112,13 +106,11 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "github.com/package-url/packageurl-go",
Version: "v0.1.1-0.20220203205134-d70459300c8a",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeGolang,
- Namespace: "github.com/package-url",
- Name: "packageurl-go",
- Version: "v0.1.1-0.20220203205134-d70459300c8a",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeGolang,
+ Namespace: "github.com/package-url",
+ Name: "packageurl-go",
+ Version: "v0.1.1-0.20220203205134-d70459300c8a",
},
},
Layer: ftypes.Layer{
@@ -133,13 +125,11 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
{
Name: "org.codehaus.mojo:child-project",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "org.codehaus.mojo",
- Name: "child-project",
- Version: "1.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "org.codehaus.mojo",
+ Name: "child-project",
+ Version: "1.0",
},
},
Version: "1.0",
@@ -156,12 +146,10 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "bootstrap",
Version: "5.0.2",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeNPM,
- Name: "bootstrap",
- Version: "5.0.2",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeNPM,
+ Name: "bootstrap",
+ Version: "5.0.2",
},
},
Licenses: []string{"MIT"},
@@ -188,12 +176,10 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Version: "21.1.1",
Licenses: []string{"ISC"},
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeNPM,
- Name: "yargs-parser",
- Version: "21.1.1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeNPM,
+ Name: "yargs-parser",
+ Version: "21.1.1",
},
},
FilePath: "node_modules/yargs-parser/package.json",
@@ -217,12 +203,10 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Version: "21.1.1",
Licenses: []string{"ISC"},
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeNPM,
- Name: "yargs-parser",
- Version: "21.1.1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeNPM,
+ Name: "yargs-parser",
+ Version: "21.1.1",
},
},
FilePath: "node_modules/yargs-parser/package.json",
@@ -245,13 +229,11 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "pear/log",
Version: "1.13.1",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeComposer,
- Namespace: "pear",
- Name: "log",
- Version: "1.13.1",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Namespace: "pear",
+ Name: "log",
+ Version: "1.13.1",
},
},
},
@@ -260,13 +242,11 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "pear/pear_exception",
Version: "v1.0.0",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeComposer,
- Namespace: "pear",
- Name: "pear_exception",
- Version: "v1.0.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeComposer,
+ Namespace: "pear",
+ Name: "pear_exception",
+ Version: "v1.0.0",
},
},
},
@@ -288,13 +268,11 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "co.elastic.apm:apm-agent",
Version: "1.36.0",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "co.elastic.apm",
- Name: "apm-agent",
- Version: "1.36.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "co.elastic.apm",
+ Name: "apm-agent",
+ Version: "1.36.0",
},
},
},
@@ -303,13 +281,11 @@ func TestUnmarshaler_Unmarshal(t *testing.T) {
Name: "co.elastic.apm:apm-agent-cached-lookup-key",
Version: "1.36.0",
Identifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "co.elastic.apm",
- Name: "apm-agent-cached-lookup-key",
- Version: "1.36.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "co.elastic.apm",
+ Name: "apm-agent-cached-lookup-key",
+ Version: "1.36.0",
},
},
},
diff --git a/pkg/vex/csaf.go b/pkg/vex/csaf.go
new file mode 100644
index 000000000000..87684064b9d4
--- /dev/null
+++ b/pkg/vex/csaf.go
@@ -0,0 +1,85 @@
+package vex
+
+import (
+ csaf "github.com/csaf-poc/csaf_distribution/v3/csaf"
+ "github.com/package-url/packageurl-go"
+ "github.com/samber/lo"
+ "go.uber.org/zap"
+
+ "github.com/aquasecurity/trivy/pkg/log"
+ "github.com/aquasecurity/trivy/pkg/purl"
+ "github.com/aquasecurity/trivy/pkg/types"
+)
+
+type CSAF struct {
+ advisory csaf.Advisory
+ logger *zap.SugaredLogger
+}
+
+func newCSAF(advisory csaf.Advisory) VEX {
+ return &CSAF{
+ advisory: advisory,
+ logger: log.Logger.With(zap.String("VEX format", "CSAF")),
+ }
+}
+
+func (v *CSAF) Filter(vulns []types.DetectedVulnerability) []types.DetectedVulnerability {
+ return lo.Filter(vulns, func(vuln types.DetectedVulnerability, _ int) bool {
+ found, ok := lo.Find(v.advisory.Vulnerabilities, func(item *csaf.Vulnerability) bool {
+ return string(*item.CVE) == vuln.VulnerabilityID
+ })
+ if !ok {
+ return true
+ }
+
+ return v.affected(found, vuln.PkgIdentifier.PURL)
+ })
+}
+
+func (v *CSAF) affected(vuln *csaf.Vulnerability, pkgURL *packageurl.PackageURL) bool {
+ if pkgURL == nil || vuln.ProductStatus == nil {
+ return true
+ }
+
+ var status Status
+ switch {
+ case v.matchPURL(vuln.ProductStatus.KnownNotAffected, pkgURL):
+ status = StatusNotAffected
+ case v.matchPURL(vuln.ProductStatus.Fixed, pkgURL):
+ status = StatusFixed
+ }
+
+ if status != "" {
+ v.logger.Infow("Filtered out the detected vulnerability",
+ zap.String("vulnerability-id", string(*vuln.CVE)),
+ zap.String("status", string(status)))
+ return false
+ }
+
+ return true
+}
+
+// matchPURL returns true if the given PackageURL is found in the ProductTree.
+func (v *CSAF) matchPURL(products *csaf.Products, pkgURL *packageurl.PackageURL) bool {
+ for _, product := range lo.FromPtr(products) {
+ helpers := v.advisory.ProductTree.CollectProductIdentificationHelpers(lo.FromPtr(product))
+ purls := lo.FilterMap(helpers, func(helper *csaf.ProductIdentificationHelper, _ int) (*purl.PackageURL, bool) {
+ if helper == nil || helper.PURL == nil {
+ return nil, false
+ }
+ p, err := purl.FromString(string(*helper.PURL))
+ if err != nil {
+ v.logger.Errorw("Invalid PURL", zap.String("purl", string(*helper.PURL)), zap.Error(err))
+ return nil, false
+ }
+ return p, true
+ })
+ for _, p := range purls {
+ if p.Match(pkgURL) {
+ return true
+ }
+ }
+ }
+
+ return false
+}
diff --git a/pkg/vex/cyclonedx.go b/pkg/vex/cyclonedx.go
new file mode 100644
index 000000000000..dbe65b5820a8
--- /dev/null
+++ b/pkg/vex/cyclonedx.go
@@ -0,0 +1,94 @@
+package vex
+
+import (
+ cdx "github.com/CycloneDX/cyclonedx-go"
+ "github.com/samber/lo"
+ "go.uber.org/zap"
+
+ ftypes "github.com/aquasecurity/trivy/pkg/fanal/types"
+ "github.com/aquasecurity/trivy/pkg/log"
+ "github.com/aquasecurity/trivy/pkg/types"
+)
+
+type CycloneDX struct {
+ sbom *ftypes.CycloneDX
+ statements []Statement
+ logger *zap.SugaredLogger
+}
+
+type Statement struct {
+ VulnerabilityID string
+ Affects []string
+ Status Status
+ Justification string // TODO: define a type
+}
+
+func newCycloneDX(cdxSBOM *ftypes.CycloneDX, vex *cdx.BOM) *CycloneDX {
+ var stmts []Statement
+ for _, vuln := range lo.FromPtr(vex.Vulnerabilities) {
+ affects := lo.Map(lo.FromPtr(vuln.Affects), func(item cdx.Affects, index int) string {
+ return item.Ref
+ })
+
+ analysis := lo.FromPtr(vuln.Analysis)
+ stmts = append(stmts, Statement{
+ VulnerabilityID: vuln.ID,
+ Affects: affects,
+ Status: cdxStatus(analysis.State),
+ Justification: string(analysis.Justification),
+ })
+ }
+ return &CycloneDX{
+ sbom: cdxSBOM,
+ statements: stmts,
+ logger: log.Logger.With(zap.String("VEX format", "CycloneDX")),
+ }
+}
+
+func (v *CycloneDX) Filter(vulns []types.DetectedVulnerability) []types.DetectedVulnerability {
+ return lo.Filter(vulns, func(vuln types.DetectedVulnerability, _ int) bool {
+ stmt, ok := lo.Find(v.statements, func(item Statement) bool {
+ return item.VulnerabilityID == vuln.VulnerabilityID
+ })
+ if !ok {
+ return true
+ }
+ return v.affected(vuln, stmt)
+ })
+}
+
+func (v *CycloneDX) affected(vuln types.DetectedVulnerability, stmt Statement) bool {
+ for _, affect := range stmt.Affects {
+ // Affect must be BOM-Link at the moment
+ link, err := cdx.ParseBOMLink(affect)
+ if err != nil {
+ v.logger.Warnw("Unable to parse BOM-Link", zap.String("affect", affect))
+ continue
+ }
+ if v.sbom.SerialNumber != link.SerialNumber() || v.sbom.Version != link.Version() {
+ v.logger.Warnw("URN doesn't match with SBOM", zap.String("serial number", link.SerialNumber()),
+ zap.Int("version", link.Version()))
+ continue
+ }
+ if vuln.PkgIdentifier.Match(link.Reference()) && (stmt.Status == StatusNotAffected || stmt.Status == StatusFixed) {
+ v.logger.Infow("Filtered out the detected vulnerability", zap.String("vulnerability-id", vuln.VulnerabilityID),
+ zap.String("status", string(stmt.Status)), zap.String("justification", stmt.Justification))
+ return false
+ }
+ }
+ return true
+}
+
+func cdxStatus(s cdx.ImpactAnalysisState) Status {
+ switch s {
+ case cdx.IASResolved, cdx.IASResolvedWithPedigree:
+ return StatusFixed
+ case cdx.IASExploitable:
+ return StatusAffected
+ case cdx.IASInTriage:
+ return StatusUnderInvestigation
+ case cdx.IASFalsePositive, cdx.IASNotAffected:
+ return StatusNotAffected
+ }
+ return StatusUnknown
+}
diff --git a/pkg/vex/openvex.go b/pkg/vex/openvex.go
new file mode 100644
index 000000000000..796439291b95
--- /dev/null
+++ b/pkg/vex/openvex.go
@@ -0,0 +1,46 @@
+package vex
+
+import (
+ openvex "github.com/openvex/go-vex/pkg/vex"
+ "github.com/samber/lo"
+ "go.uber.org/zap"
+
+ "github.com/aquasecurity/trivy/pkg/log"
+ "github.com/aquasecurity/trivy/pkg/types"
+)
+
+type OpenVEX struct {
+ vex openvex.VEX
+ logger *zap.SugaredLogger
+}
+
+func newOpenVEX(vex openvex.VEX) VEX {
+ return &OpenVEX{
+ vex: vex,
+ logger: log.Logger.With(zap.String("VEX format", "OpenVEX")),
+ }
+}
+
+func (v *OpenVEX) Filter(vulns []types.DetectedVulnerability) []types.DetectedVulnerability {
+ return lo.Filter(vulns, func(vuln types.DetectedVulnerability, _ int) bool {
+ var stmts []openvex.Statement
+ if vuln.PkgIdentifier.PURL != nil {
+ matchedStmts := v.vex.Matches(vuln.VulnerabilityID, vuln.PkgIdentifier.PURL.String(), nil)
+ stmts = append(stmts, matchedStmts...)
+ }
+ if len(stmts) == 0 {
+ return true
+ }
+
+ // Take the latest statement for a given vulnerability and product
+ // as a sequence of statements can be overridden by the newer one.
+ // cf. https://github.com/openvex/spec/blob/fa5ba0c0afedb008dc5ebad418548cacf16a3ca7/OPENVEX-SPEC.md#the-vex-statement
+ stmt := stmts[len(stmts)-1]
+ if stmt.Status == openvex.StatusNotAffected || stmt.Status == openvex.StatusFixed {
+ v.logger.Infow("Filtered out the detected vulnerability", zap.String("vulnerability-id", vuln.VulnerabilityID),
+ zap.String("status", string(stmt.Status)), zap.String("justification", string(stmt.Justification)))
+ return false
+ }
+ return true
+ })
+}
diff --git a/pkg/vex/testdata/csaf-affected.json b/pkg/vex/testdata/csaf-affected.json
new file mode 100644
index 000000000000..56e9bb4d8a53
--- /dev/null
+++ b/pkg/vex/testdata/csaf-affected.json
@@ -0,0 +1,93 @@
+{
+ "document": {
+ "category": "csaf_vex",
+ "csaf_version": "2.0",
+ "notes": [
+ {
+ "category": "summary",
+ "text": "Example Company VEX document. Unofficial content for demonstration purposes only.",
+ "title": "Author comment"
+ }
+ ],
+ "publisher": {
+ "category": "vendor",
+ "name": "Example Company ProductCERT",
+ "namespace": "https://psirt.example.com"
+ },
+ "title": "Example VEX Document Use Case 1 - Affected",
+ "tracking": {
+ "current_release_date": "2022-03-03T11:00:00.000Z",
+ "generator": {
+ "date": "2022-03-03T11:00:00.000Z",
+ "engine": {
+ "name": "Secvisogram",
+ "version": "1.11.0"
+ }
+ },
+ "id": "2022-EVD-UC-01-A-001",
+ "initial_release_date": "2022-03-03T11:00:00.000Z",
+ "revision_history": [
+ {
+ "date": "2022-03-03T11:00:00.000Z",
+ "number": "1",
+ "summary": "Initial version."
+ }
+ ],
+ "status": "final",
+ "version": "1"
+ }
+ },
+ "product_tree": {
+ "branches": [
+ {
+ "branches": [
+ {
+ "branches": [
+ {
+ "category": "product_version",
+ "name": "1.0",
+ "product": {
+ "name": "Example Company DEF 1.0",
+ "product_id": "CSAFPID-0001",
+ "product_identification_helper": {
+ "purl": "pkg:maven/org.example.company/def@1.0"
+ }
+ }
+ }
+ ],
+ "category": "product_name",
+ "name": "DEF"
+ }
+ ],
+ "category": "vendor",
+ "name": "Example Company"
+ }
+ ]
+ },
+ "vulnerabilities": [
+ {
+ "cve": "CVE-2021-44228",
+ "notes": [
+ {
+ "category": "description",
+ "text": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.",
+ "title": "CVE description"
+ }
+ ],
+ "product_status": {
+ "known_affected": [
+ "CSAFPID-0001"
+ ]
+ },
+ "remediations": [
+ {
+ "category": "vendor_fix",
+ "details": "Customers should update to version 1.1 of product DEF which fixes the issue.",
+ "product_ids": [
+ "CSAFPID-0001"
+ ]
+ }
+ ]
+ }
+ ]
+}
diff --git a/pkg/vex/testdata/csaf-not-affected.json b/pkg/vex/testdata/csaf-not-affected.json
new file mode 100644
index 000000000000..dce0b4a712d6
--- /dev/null
+++ b/pkg/vex/testdata/csaf-not-affected.json
@@ -0,0 +1,93 @@
+{
+ "document": {
+ "category": "csaf_vex",
+ "csaf_version": "2.0",
+ "notes": [
+ {
+ "category": "summary",
+ "text": "Example Company VEX document. Unofficial content for demonstration purposes only.",
+ "title": "Author comment"
+ }
+ ],
+ "publisher": {
+ "category": "vendor",
+ "name": "Example Company ProductCERT",
+ "namespace": "https://psirt.example.com"
+ },
+ "title": "AquaSecurity example VEX document",
+ "tracking": {
+ "current_release_date": "2022-03-03T11:00:00.000Z",
+ "generator": {
+ "date": "2022-03-03T11:00:00.000Z",
+ "engine": {
+ "name": "Secvisogram",
+ "version": "1.11.0"
+ }
+ },
+ "id": "2022-EVD-UC-01-A-001",
+ "initial_release_date": "2022-03-03T11:00:00.000Z",
+ "revision_history": [
+ {
+ "date": "2022-03-03T11:00:00.000Z",
+ "number": "1",
+ "summary": "Initial version."
+ }
+ ],
+ "status": "final",
+ "version": "1"
+ }
+ },
+ "product_tree": {
+ "branches": [
+ {
+ "branches": [
+ {
+ "branches": [
+ {
+ "category": "product_version",
+ "name": "2.6.0",
+ "product": {
+ "name": "Spring Boot 2.6.0",
+ "product_id": "SPB-00260",
+ "product_identification_helper": {
+ "purl": "pkg:maven/org.springframework.boot/spring-boot@2.6.0"
+ }
+ }
+ }
+ ],
+ "category": "product_name",
+ "name": "Spring Boot"
+ }
+ ],
+ "category": "vendor",
+ "name": "Spring"
+ }
+ ]
+ },
+ "vulnerabilities": [
+ {
+ "cve": "CVE-2021-44228",
+ "notes": [
+ {
+ "category": "description",
+ "text": "Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.",
+ "title": "CVE description"
+ }
+ ],
+ "product_status": {
+ "known_not_affected": [
+ "SPB-00260"
+ ]
+ },
+ "threats": [
+ {
+ "category": "impact",
+ "details": "Class with vulnerable code was removed before shipping.",
+ "product_ids": [
+ "SPB-00260"
+ ]
+ }
+ ]
+ }
+ ]
+}
diff --git a/pkg/vex/testdata/unknown.json b/pkg/vex/testdata/unknown.json
index e0415f90563c..9e26dfeeb6e6 100644
--- a/pkg/vex/testdata/unknown.json
+++ b/pkg/vex/testdata/unknown.json
@@ -1 +1 @@
-{unknown}
\ No newline at end of file
+{}
\ No newline at end of file
diff --git a/pkg/vex/vex.go b/pkg/vex/vex.go
index 1042e0886515..644b00d62b3a 100644
--- a/pkg/vex/vex.go
+++ b/pkg/vex/vex.go
@@ -5,16 +5,12 @@ import (
"io"
"os"
- cdx "github.com/CycloneDX/cyclonedx-go"
+ csaf "github.com/csaf-poc/csaf_distribution/v3/csaf"
"github.com/hashicorp/go-multierror"
openvex "github.com/openvex/go-vex/pkg/vex"
- "github.com/samber/lo"
"github.com/sirupsen/logrus"
- "go.uber.org/zap"
"golang.org/x/xerrors"
- ftypes "github.com/aquasecurity/trivy/pkg/fanal/types"
- "github.com/aquasecurity/trivy/pkg/log"
"github.com/aquasecurity/trivy/pkg/sbom"
"github.com/aquasecurity/trivy/pkg/sbom/cyclonedx"
"github.com/aquasecurity/trivy/pkg/types"
@@ -27,130 +23,6 @@ type VEX interface {
Filter([]types.DetectedVulnerability) []types.DetectedVulnerability
}
-type Statement struct {
- VulnerabilityID string
- Affects []string
- Status Status
- Justification string // TODO: define a type
-}
-
-type OpenVEX struct {
- vex openvex.VEX
- logger *zap.SugaredLogger
-}
-
-func newOpenVEX(vex openvex.VEX) VEX {
- logger := log.Logger.With(zap.String("VEX format", "OpenVEX"))
-
- return &OpenVEX{
- vex: vex,
- logger: logger,
- }
-}
-
-func (v *OpenVEX) Filter(vulns []types.DetectedVulnerability) []types.DetectedVulnerability {
- return lo.Filter(vulns, func(vuln types.DetectedVulnerability, _ int) bool {
- var stmts []openvex.Statement
- if vuln.PkgIdentifier.PURL != nil {
- matchedStmts := v.vex.Matches(vuln.VulnerabilityID, vuln.PkgIdentifier.PURL.String(), nil)
- if len(matchedStmts) > 0 {
- stmts = append(stmts, matchedStmts...)
- }
- }
- if len(stmts) == 0 {
- return true
- }
-
- // Take the latest statement for a given vulnerability and product
- // as a sequence of statements can be overridden by the newer one.
- // cf. https://github.com/openvex/spec/blob/fa5ba0c0afedb008dc5ebad418548cacf16a3ca7/OPENVEX-SPEC.md#the-vex-statement
- stmt := stmts[len(stmts)-1]
- if stmt.Status == openvex.StatusNotAffected || stmt.Status == openvex.StatusFixed {
- v.logger.Infow("Filtered out the detected vulnerability", zap.String("vulnerability-id", vuln.VulnerabilityID),
- zap.String("status", string(stmt.Status)), zap.String("justification", string(stmt.Justification)))
- return false
- }
- return true
- })
-}
-
-type CycloneDX struct {
- sbom *ftypes.CycloneDX
- statements []Statement
- logger *zap.SugaredLogger
-}
-
-func newCycloneDX(cdxSBOM *ftypes.CycloneDX, vex *cdx.BOM) *CycloneDX {
- var stmts []Statement
- for _, vuln := range lo.FromPtr(vex.Vulnerabilities) {
- affects := lo.Map(lo.FromPtr(vuln.Affects), func(item cdx.Affects, index int) string {
- return item.Ref
- })
-
- analysis := lo.FromPtr(vuln.Analysis)
-
- stmts = append(stmts, Statement{
- VulnerabilityID: vuln.ID,
- Affects: affects,
- Status: cdxStatus(analysis.State),
- Justification: string(analysis.Justification),
- })
- }
- return &CycloneDX{
- sbom: cdxSBOM,
- statements: stmts,
- logger: log.Logger.With(zap.String("VEX format", "CycloneDX")),
- }
-}
-
-func (v *CycloneDX) Filter(vulns []types.DetectedVulnerability) []types.DetectedVulnerability {
- return lo.Filter(vulns, func(vuln types.DetectedVulnerability, _ int) bool {
- stmt, ok := lo.Find(v.statements, func(item Statement) bool {
- return item.VulnerabilityID == vuln.VulnerabilityID
- })
- if !ok {
- return true
- }
- return v.affected(vuln, stmt)
- })
-}
-
-func (v *CycloneDX) affected(vuln types.DetectedVulnerability, stmt Statement) bool {
- for _, affect := range stmt.Affects {
- // Affect must be BOM-Link at the moment
- link, err := cdx.ParseBOMLink(affect)
- if err != nil {
- v.logger.Warnw("Unable to parse BOM-Link", zap.String("affect", affect))
- continue
- }
- if v.sbom.SerialNumber != link.SerialNumber() || v.sbom.Version != link.Version() {
- v.logger.Warnw("URN doesn't match with SBOM", zap.String("serial number", link.SerialNumber()),
- zap.Int("version", link.Version()))
- continue
- }
- if vuln.PkgIdentifier.Match(link.Reference()) && (stmt.Status == StatusNotAffected || stmt.Status == StatusFixed) {
- v.logger.Infow("Filtered out the detected vulnerability", zap.String("vulnerability-id", vuln.VulnerabilityID),
- zap.String("status", string(stmt.Status)), zap.String("justification", stmt.Justification))
- return false
- }
- }
- return true
-}
-
-func cdxStatus(s cdx.ImpactAnalysisState) Status {
- switch s {
- case cdx.IASResolved, cdx.IASResolvedWithPedigree:
- return StatusFixed
- case cdx.IASExploitable:
- return StatusAffected
- case cdx.IASInTriage:
- return StatusUnderInvestigation
- case cdx.IASFalsePositive, cdx.IASNotAffected:
- return StatusNotAffected
- }
- return StatusUnknown
-}
-
func New(filePath string, report types.Report) (VEX, error) {
if filePath == "" {
return nil, nil
@@ -162,7 +34,6 @@ func New(filePath string, report types.Report) (VEX, error) {
defer f.Close()
var errs error
-
// Try CycloneDX JSON
if ok, err := sbom.IsCycloneDXJSON(f); err != nil {
errs = multierror.Append(errs, err)
@@ -173,7 +44,14 @@ func New(filePath string, report types.Report) (VEX, error) {
// Try OpenVEX
if v, err := decodeOpenVEX(f); err != nil {
errs = multierror.Append(errs, err)
- } else {
+ } else if v != nil {
+ return v, nil
+ }
+
+ // Try CSAF
+ if v, err := decodeCSAF(f); err != nil {
+ errs = multierror.Append(errs, err)
+ } else if v != nil {
return v, nil
}
@@ -210,3 +88,17 @@ func decodeOpenVEX(r io.ReadSeeker) (VEX, error) {
}
return newOpenVEX(openVEX), nil
}
+
+func decodeCSAF(r io.ReadSeeker) (VEX, error) {
+ if _, err := r.Seek(0, io.SeekStart); err != nil {
+ return nil, xerrors.Errorf("seek error: %w", err)
+ }
+ var adv csaf.Advisory
+ if err := json.NewDecoder(r).Decode(&adv); err != nil {
+ return nil, err
+ }
+ if adv.Vulnerabilities == nil {
+ return nil, nil
+ }
+ return newCSAF(adv), nil
+}
diff --git a/pkg/vex/vex_test.go b/pkg/vex/vex_test.go
index 16abcf2a7ffa..004a0d14d842 100644
--- a/pkg/vex/vex_test.go
+++ b/pkg/vex/vex_test.go
@@ -1,10 +1,11 @@
package vex_test
import (
- "github.com/package-url/packageurl-go"
"os"
"testing"
+ "github.com/package-url/packageurl-go"
+
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
@@ -28,10 +29,11 @@ func TestVEX_Filter(t *testing.T) {
vulns []types.DetectedVulnerability
}
tests := []struct {
- name string
- fields fields
- args args
- want []types.DetectedVulnerability
+ name string
+ fields fields
+ args args
+ want []types.DetectedVulnerability
+ wantErr string
}{
{
name: "OpenVEX",
@@ -45,13 +47,11 @@ func TestVEX_Filter(t *testing.T) {
PkgName: "spring-boot",
InstalledVersion: "2.6.0",
PkgIdentifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "org.springframework.boot",
- Name: "spring-boot",
- Version: "2.6.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "org.springframework.boot",
+ Name: "spring-boot",
+ Version: "2.6.0",
},
},
},
@@ -71,13 +71,11 @@ func TestVEX_Filter(t *testing.T) {
PkgName: "spring-boot",
InstalledVersion: "2.6.0",
PkgIdentifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "org.springframework.boot",
- Name: "spring-boot",
- Version: "2.6.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "org.springframework.boot",
+ Name: "spring-boot",
+ Version: "2.6.0",
},
},
},
@@ -86,13 +84,11 @@ func TestVEX_Filter(t *testing.T) {
PkgName: "spring-boot",
InstalledVersion: "2.6.0",
PkgIdentifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "org.springframework.boot",
- Name: "spring-boot",
- Version: "2.6.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "org.springframework.boot",
+ Name: "spring-boot",
+ Version: "2.6.0",
},
},
},
@@ -104,13 +100,11 @@ func TestVEX_Filter(t *testing.T) {
PkgName: "spring-boot",
InstalledVersion: "2.6.0",
PkgIdentifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "org.springframework.boot",
- Name: "spring-boot",
- Version: "2.6.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "org.springframework.boot",
+ Name: "spring-boot",
+ Version: "2.6.0",
},
},
},
@@ -134,13 +128,11 @@ func TestVEX_Filter(t *testing.T) {
PkgName: "jackson-databind",
InstalledVersion: "2.8.0",
PkgIdentifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "com.fasterxml.jackson.core",
- Name: "jackson-databind",
- Version: "2.8.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "com.fasterxml.jackson.core",
+ Name: "jackson-databind",
+ Version: "2.8.0",
},
},
},
@@ -149,13 +141,11 @@ func TestVEX_Filter(t *testing.T) {
PkgName: "jackson-databind",
InstalledVersion: "2.8.0",
PkgIdentifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "com.fasterxml.jackson.core",
- Name: "jackson-databind",
- Version: "2.8.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "com.fasterxml.jackson.core",
+ Name: "jackson-databind",
+ Version: "2.8.0",
},
},
},
@@ -167,13 +157,11 @@ func TestVEX_Filter(t *testing.T) {
PkgName: "jackson-databind",
InstalledVersion: "2.8.0",
PkgIdentifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "com.fasterxml.jackson.core",
- Name: "jackson-databind",
- Version: "2.8.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "com.fasterxml.jackson.core",
+ Name: "jackson-databind",
+ Version: "2.8.0",
},
},
},
@@ -197,13 +185,11 @@ func TestVEX_Filter(t *testing.T) {
PkgName: "jackson-databind",
InstalledVersion: "2.8.0",
PkgIdentifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
- Type: packageurl.TypeMaven,
- Namespace: "com.fasterxml.jackson.core",
- Name: "jackson-databind",
- Version: "2.8.0",
- },
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "com.fasterxml.jackson.core",
+ Name: "jackson-databind",
+ Version: "2.8.0",
},
},
},
@@ -215,23 +201,95 @@ func TestVEX_Filter(t *testing.T) {
PkgName: "jackson-databind",
InstalledVersion: "2.8.0",
PkgIdentifier: ftypes.PkgIdentifier{
- PURL: &ftypes.PackageURL{
- PackageURL: packageurl.PackageURL{
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "com.fasterxml.jackson.core",
+ Name: "jackson-databind",
+ Version: "2.8.0",
+ },
+ },
+ },
+ },
+ },
+ {
+ name: "CSAF (not affected vuln)",
+ fields: fields{
+ filePath: "testdata/csaf-not-affected.json",
+ },
+ args: args{
+ vulns: []types.DetectedVulnerability{
+ {
+ VulnerabilityID: "CVE-2021-44228",
+ PkgName: "spring-boot",
+ InstalledVersion: "2.6.0",
+ PkgIdentifier: ftypes.PkgIdentifier{
+ PURL: &packageurl.PackageURL{
Type: packageurl.TypeMaven,
- Namespace: "com.fasterxml.jackson.core",
- Name: "jackson-databind",
- Version: "2.8.0",
+ Namespace: "org.springframework.boot",
+ Name: "spring-boot",
+ Version: "2.6.0",
+ },
+ },
+ },
+ },
+ },
+ want: []types.DetectedVulnerability{},
+ },
+ {
+ name: "CSAF (affected vuln)",
+ fields: fields{
+ filePath: "testdata/csaf-affected.json",
+ },
+ args: args{
+ vulns: []types.DetectedVulnerability{
+ {
+ VulnerabilityID: "CVE-2021-44228",
+ PkgName: "def",
+ InstalledVersion: "1.0",
+ PkgIdentifier: ftypes.PkgIdentifier{
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "org.example.company",
+ Name: "def",
+ Version: "1.0",
},
},
},
},
},
+ want: []types.DetectedVulnerability{
+ {
+ VulnerabilityID: "CVE-2021-44228",
+ PkgName: "def",
+ InstalledVersion: "1.0",
+ PkgIdentifier: ftypes.PkgIdentifier{
+ PURL: &packageurl.PackageURL{
+ Type: packageurl.TypeMaven,
+ Namespace: "org.example.company",
+ Name: "def",
+ Version: "1.0",
+ },
+ },
+ },
+ },
+ },
+ {
+ name: "unknown format",
+ fields: fields{
+ filePath: "testdata/unknown.json",
+ },
+ args: args{},
+ wantErr: "unable to load VEX",
},
}
for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
v, err := vex.New(tt.fields.filePath, tt.fields.report)
+ if tt.wantErr != "" {
+ require.ErrorContains(t, err, tt.wantErr)
+ return
+ }
require.NoError(t, err)
assert.Equal(t, tt.want, v.Filter(tt.args.vulns))
})