Skip to content

Commit 271f1da

Browse files
author
Henrik Teichmann
committed
feat: Add skip-vex-repo-update option, add VEX settings to Helm values.yaml, fix tests
Signed-off-by: Henrik Teichmann <teichmann@strato-rz.de>
1 parent 6e9eb68 commit 271f1da

File tree

9 files changed

+45
-25
lines changed

9 files changed

+45
-25
lines changed

‎README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,8 @@ Configuration of the adapter is done via environment variables at startup.
102102
| `SCANNER_TRIVY_GITHUB_TOKEN` | N/A | The GitHub access token to download [Trivy DB] (see [GitHub rate limiting][gh-rate-limit]) |
103103
| `SCANNER_TRIVY_INSECURE` | `false` | The flag to skip verifying registry certificate |
104104
| `SCANNER_TRIVY_TIMEOUT` | `5m0s` | The duration to wait for scan completion |
105-
| `SCANNER_TRIVY_VEX_SOURCE` | N/A | Enable VEX, possible values are `oci` and `repo` [EXPERIMENTAL]
105+
| `SCANNER_TRIVY_VEX_SOURCE` | N/A | Enable VEX, possible values are `oci` and `repo` [EXPERIMENTAL] |
106+
| `SCANNER_TRIVY_SKIP_VEX_REPO_UPDATE` | `false` | Skip updating the VEX repository [EXPERIMENTAL] |
106107
| `SCANNER_STORE_REDIS_NAMESPACE` | `harbor.scanner.trivy:store` | The namespace for keys in the Redis store |
107108
| `SCANNER_STORE_REDIS_SCAN_JOB_TTL` | `1h` | The time to live for persisting scan jobs and associated scan reports |
108109
| `SCANNER_JOB_QUEUE_REDIS_NAMESPACE` | `harbor.scanner.trivy:job-queue` | The namespace for keys in the scan jobs queue backed by Redis |

‎helm/harbor-scanner-trivy/templates/statefulset.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,8 @@ spec:
123123
value: "/certs/tls.key"
124124
- name: "SCANNER_TRIVY_VEX_SOURCE"
125125
value: {{ .Values.scanner.trivy.VEXSource | default "" | quote }}
126+
- name: "SCANNER_TRIVY_SKIP_VEX_REPO_UPDATE"
127+
value: {{ .Values.scanner.trivy.skipVEXRepoUpdate | default false | quote }}
126128
{{- end }}
127129
ports:
128130
- name: api-server

‎helm/harbor-scanner-trivy/values.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,10 @@ scanner:
150150
# # https://cwe.mitre.org/data/definitions/352.html
151151
# input.CweIDs[_] == "CWE-352"
152152
# }
153+
## VEXSource the VEX source for vulnerability filtering. Possible values are `oci` and `repo`.
154+
VEXSource: ""
155+
## skipVEXRepoUpdate the flag to skip updating the VEX repository
156+
skipVEXRepoUpdate: false
153157
store:
154158
## redisNamespace the namespace for keys in the Redis store
155159
redisNamespace: "harbor.scanner.trivy:store"

‎pkg/etc/config.go‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,10 @@ type Trivy struct {
3838
JavaDBRepository string `env:"SCANNER_TRIVY_JAVA_DB_REPOSITORY"`
3939
OfflineScan bool `env:"SCANNER_TRIVY_OFFLINE_SCAN" envDefault:"false"`
4040
GitHubToken string `env:"SCANNER_TRIVY_GITHUB_TOKEN"`
41-
Insecure bool `env:"SCANNER_TRIVY_INSECURE" envDefault:"false"`
42-
VEXSource string `env:"SCANNER_TRIVY_VEX_SOURCE"`
43-
Timeout time.Duration `env:"SCANNER_TRIVY_TIMEOUT" envDefault:"5m0s"`
41+
Insecure bool `env:"SCANNER_TRIVY_INSECURE" envDefault:"false"`
42+
VEXSource string `env:"SCANNER_TRIVY_VEX_SOURCE"`
43+
SkipVEXRepoUpdate bool `env:"SCANNER_TRIVY_SKIP_VEX_REPO_UPDATE" envDefault:"false"`
44+
Timeout time.Duration `env:"SCANNER_TRIVY_TIMEOUT" envDefault:"5m0s"`
4445
}
4546

4647
type API struct {

‎pkg/etc/config_test.go‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -159,8 +159,9 @@ func TestGetConfig(t *testing.T) {
159159
"SCANNER_TRIVY_SKIP_UPDATE": "true",
160160
"SCANNER_TRIVY_OFFLINE_SCAN": "true",
161161
"SCANNER_TRIVY_GITHUB_TOKEN": "<GITHUB_TOKEN>",
162-
"SCANNER_TRIVY_TIMEOUT": "15m30s",
163-
"SCANNER_TRIVY_VEX_SOURCE": "oci",
162+
"SCANNER_TRIVY_TIMEOUT": "15m30s",
163+
"SCANNER_TRIVY_VEX_SOURCE": "oci",
164+
"SCANNER_TRIVY_SKIP_VEX_REPO_UPDATE": "true",
164165

165166
"SCANNER_STORE_REDIS_NAMESPACE": "store.ns",
166167
"SCANNER_STORE_REDIS_SCAN_JOB_TTL": "2h45m15s",
@@ -200,9 +201,10 @@ func TestGetConfig(t *testing.T) {
200201
SkipJavaDBUpdate: false,
201202
OfflineScan: true,
202203
Insecure: true,
203-
GitHubToken: "<GITHUB_TOKEN>",
204-
Timeout: parseDuration(t, "15m30s"),
205-
VEXSource: "oci",
204+
GitHubToken: "<GITHUB_TOKEN>",
205+
Timeout: parseDuration(t, "15m30s"),
206+
VEXSource: "oci",
207+
SkipVEXRepoUpdate: true,
206208
},
207209
RedisPool: RedisPool{
208210
URL: "redis://harbor-harbor-redis:6379",

‎pkg/http/api/v1/handler.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -315,8 +315,9 @@ func (h *requestHandler) GetMetadata(res http.ResponseWriter, _ *http.Request) {
315315
"env.SCANNER_TRIVY_VULN_TYPE": h.config.Trivy.VulnType,
316316
"env.SCANNER_TRIVY_SECURITY_CHECKS": h.config.Trivy.Scanners,
317317
"env.SCANNER_TRIVY_SEVERITY": h.config.Trivy.Severity,
318-
"env.SCANNER_TRIVY_TIMEOUT": h.config.Trivy.Timeout.String(),
319-
"env.SCANNER_TRIVY_VEX_SOURCE": h.config.Trivy.VEXSource,
318+
"env.SCANNER_TRIVY_TIMEOUT": h.config.Trivy.Timeout.String(),
319+
"env.SCANNER_TRIVY_VEX_SOURCE": h.config.Trivy.VEXSource,
320+
"env.SCANNER_TRIVY_SKIP_VEX_REPO_UPDATE": strconv.FormatBool(h.config.Trivy.SkipVEXRepoUpdate),
320321
}
321322

322323
vi, err := h.wrapper.GetVersion()

‎pkg/http/api/v1/handler_test.go‎

Lines changed: 17 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -710,16 +710,17 @@ func TestRequestHandler_GetMetadata(t *testing.T) {
710710
},
711711
config: etc.Config{
712712
Trivy: etc.Trivy{
713-
SkipDBUpdate: false,
714-
SkipJavaDBUpdate: false,
715-
IgnoreUnfixed: true,
716-
DebugMode: true,
717-
Insecure: true,
718-
VulnType: "os,library",
719-
Scanners: "vuln",
720-
Severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
721-
Timeout: 5 * time.Minute,
722-
VEXSource: "oci",
713+
SkipDBUpdate: false,
714+
SkipJavaDBUpdate: false,
715+
IgnoreUnfixed: true,
716+
DebugMode: true,
717+
Insecure: true,
718+
VulnType: "os,library",
719+
Scanners: "vuln",
720+
Severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
721+
Timeout: 5 * time.Minute,
722+
VEXSource: "oci",
723+
SkipVEXRepoUpdate: true,
723724
},
724725
},
725726
expectedHTTPCode: http.StatusOK,
@@ -775,7 +776,8 @@ func TestRequestHandler_GetMetadata(t *testing.T) {
775776
"env.SCANNER_TRIVY_SECURITY_CHECKS": "vuln",
776777
"env.SCANNER_TRIVY_SEVERITY": "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
777778
"env.SCANNER_TRIVY_TIMEOUT": "5m0s",
778-
"env.SCANNER_TRIVY_VEX_SOURCE": "oci"
779+
"env.SCANNER_TRIVY_VEX_SOURCE": "oci",
780+
"env.SCANNER_TRIVY_SKIP_VEX_REPO_UPDATE": "true"
779781
}
780782
}`,
781783
},
@@ -854,7 +856,8 @@ func TestRequestHandler_GetMetadata(t *testing.T) {
854856
"env.SCANNER_TRIVY_SECURITY_CHECKS": "vuln",
855857
"env.SCANNER_TRIVY_SEVERITY": "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
856858
"env.SCANNER_TRIVY_TIMEOUT": "5m0s",
857-
"env.SCANNER_TRIVY_VEX_SOURCE": "repo"
859+
"env.SCANNER_TRIVY_VEX_SOURCE": "repo",
860+
"env.SCANNER_TRIVY_SKIP_VEX_REPO_UPDATE": "false"
858861
}
859862
}`,
860863
},
@@ -926,7 +929,8 @@ func TestRequestHandler_GetMetadata(t *testing.T) {
926929
"env.SCANNER_TRIVY_SECURITY_CHECKS": "vuln",
927930
"env.SCANNER_TRIVY_SEVERITY": "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
928931
"env.SCANNER_TRIVY_TIMEOUT": "5m0s",
929-
"env.SCANNER_TRIVY_VEX_SOURCE": ""
932+
"env.SCANNER_TRIVY_VEX_SOURCE": "",
933+
"env.SCANNER_TRIVY_SKIP_VEX_REPO_UPDATE": "false"
930934
}
931935
}`,
932936
},

‎pkg/trivy/wrapper.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -223,6 +223,9 @@ func (w *wrapper) prepareScanCmd(target ScanTarget, outputFile string, opt ScanO
223223
args = append(args, "--vex", w.config.VEXSource)
224224
}
225225

226+
if w.config.SkipVEXRepoUpdate {
227+
args = append(args, "--skip-vex-repo-update")
228+
}
226229

227230
targetName, err := target.Name()
228231
if err != nil {

‎test/integration/api/rest_api_test.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -417,7 +417,9 @@ func TestRestAPI(t *testing.T) {
417417
"env.SCANNER_TRIVY_VULN_TYPE": "os",
418418
"env.SCANNER_TRIVY_SEVERITY": "LOW,MEDIUM,HIGH,CRITICAL",
419419
"env.SCANNER_TRIVY_SECURITY_CHECKS": "vuln",
420-
"env.SCANNER_TRIVY_TIMEOUT": "5m0s"
420+
"env.SCANNER_TRIVY_TIMEOUT": "5m0s",
421+
"env.SCANNER_TRIVY_VEX_SOURCE": "",
422+
"env.SCANNER_TRIVY_SKIP_VEX_REPO_UPDATE": "false"
421423
}
422424
}`,
423425
now.UTC().Format(time.RFC3339)),

0 commit comments

Comments
 (0)