Update and Split Trivy #80
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…r not as an argument and then altering the trivy scan command according to if that is true or not
…r for images and fix the processor
…ing errors, but did not create migration for it yet due to some errors I am getting when trying to create the migration due to my environment. Updated the Trivy plugin to fix parsing issues with the changes in the JSON due to a newer version of Trivy being used. Currently finishing the feature for parsing through directories of a project and generating package-lock files for directories that do not have one. Updated the UI for Trivy to say that it is an SCA scanner as well instead of just a container scanner.
…package.json exists. Code still needs to be refactored/cleaned/split
…y. Also migrated the artemisdb model to reflect database changes.
Updating working branch with changes in main branch.
…en node dependencies and trivy as they both rely on the same code. Ensures better code re-usability
…mpliant with coding standards
…orm Users that we detected a missing lock file when we detect their package.json by itself
…the parent param can supply the logging method as it is a shared function
davakos
reviewed
Jan 22, 2024
…in regular functionality as before since trivy was the API argument for container images previously. At the UI level it will still display Trivy Container Image
…and made generate_locks functionality return before attempting to perform more logic if there are no package.jsons found in the first place
…e only for image scanning
Syncing main with feature branch
breedenc
requested changes
Jan 25, 2024
breedenc
reviewed
Jan 25, 2024
…ned up code for including/discluding dev dependency flag for trivy_sca
davakos
reviewed
Jan 25, 2024
breedenc
approved these changes
Jan 25, 2024
davakos
approved these changes
Jan 25, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Updating Trivy from version 0.16.0 to version 0.48.0 to get all the new features Trivy has to offer. This will yield more results for SCA and container scanning from the trivy tool as well as expand the language support Trivy has for lock file scanning.
This PR will also split trivy SCA and Trivy container image scanning into 2 separate plugins for improved user experience. This will change the plugin list on the UI from Trivy (Container Images) to instead have one plugin called Trivy Container Image and another called Trivy SCA. Although the UI will be displaying the plugins as such, the API will still expect "trivy" as an argument to trigger the container image scanning and "trivy_sca" as an argument to trigger the SCA scanning.
This PR also updates the trivy SCA plugin to generate package-lock.json files and NPMRCs in directories where the package.json exists but there is no package-lock.json file for Trivy's SCA capability.
Cryptography dependency was updated as well
Motivation and Context
Trivy was outdated and we were missing out on some language support and more accurate scan results. We also wanted to improve the usability of Trivy by allowing more focused results from SCA and Container image scanning.
How Has This Been Tested?
Types of changes
Checklist
Pic