-
Notifications
You must be signed in to change notification settings - Fork 2.2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(julia): Add Julia language analyzer support
- Loading branch information
1 parent
ad977a4
commit 1024114
Showing
26 changed files
with
816 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -75,6 +75,7 @@ jobs: | |
| dart | ||
| swift | ||
| bitnami | ||
| julia | ||
| os | ||
| lang | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -142,6 +142,7 @@ language: | |
| - go | ||
| - elixir | ||
| - dart | ||
| - julia | ||
|
|
||
| vuln: | ||
|
|
||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| # Rust | ||
|
|
||
| ## Features | ||
|
|
||
| Trivy supports [Pkg.jl](https://pkgdocs.julialang.org/v1/), which is the Julia package manager. | ||
| The following table provides an outline of the features Trivy offers. | ||
|
|
||
| | Package manager | File | Transitive dependencies | Dev dependencies | License | Dependency graph | Position | | ||
| | --------------- | ------------- | :---------------------: | :--------------- | :-----: | :--------------: | :------: | | ||
| | Pkg.jl | Manifest.toml | ✅ | Excluded[^1] | - | ✅ | ✅ | | ||
|
|
||
| ### Pkg.jl | ||
|
|
||
| Trivy searches for `Manifest.toml` to detect dependencies. | ||
|
|
||
| Trivy also supports dependency trees; however, to display an accurate tree, it needs to know whether each package is a direct dependency of the project. | ||
| Since this information is not included in `Manifest.toml`, Trivy parses `Project.toml`, which should be located next to `Project.toml`. | ||
| If you want to see the dependency tree, please ensure that `Project.toml` is present. | ||
|
|
||
| Scanning `Manifest.toml` and `Project.toml` together also removes developer dependencies. | ||
|
|
||
| Dependency extensions are currently ignored. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,96 @@ | ||
| # Language-specific Packages | ||
|
|
||
| `Trivy` automatically detects the following files and scans vulnerabilities in the application dependencies. | ||
|
|
||
| ## Supported languages | ||
|
|
||
| | Language | File | Image[^7] | Rootfs[^8] | Filesystem[^9] | Repository[^10] | Dev dependencies | Dependency location[^11] | | ||
| | -------------------- | ------------------------------------------------------------------------------------------ | :-------: | :--------: | :------------: | :-------------: | ---------------- | :----------------------: | | ||
| | Ruby | Gemfile.lock | - | - | ✅ | ✅ | included | - | | ||
| | | gemspec | ✅ | ✅ | - | - | included | - | | ||
| | [Python](python.md) | Pipfile.lock | - | - | ✅ | ✅ | excluded | ✅ | | ||
| | | poetry.lock | - | - | ✅ | ✅ | excluded | - | | ||
| | | requirements.txt | - | - | ✅ | ✅ | included | - | | ||
| | | egg package[^1] | ✅ | ✅ | - | - | excluded | - | | ||
| | | wheel package[^2] | ✅ | ✅ | - | - | excluded | - | | ||
| | [PHP](php.md) | composer.lock | ✅ | ✅ | ✅ | ✅ | excluded | ✅ | | ||
| | [Node.js](nodejs.md) | package-lock.json | - | - | ✅ | ✅ | excluded | ✅ | | ||
| | | yarn.lock | - | - | ✅ | ✅ | included | ✅ | | ||
| | | pnpm-lock.yaml | - | - | ✅ | ✅ | excluded | - | | ||
| | | package.json | ✅ | ✅ | - | - | excluded | - | | ||
| | .NET | packages.lock.json | ✅ | ✅ | ✅ | ✅ | included | ✅ | | ||
| | | packages.config | ✅ | ✅ | ✅ | ✅ | excluded | - | | ||
| | | .deps.json | ✅ | ✅ | ✅ | ✅ | excluded | ✅ | | ||
| | [Java](java.md) | JAR/WAR/PAR/EAR[^3] | ✅ | ✅ | - | - | included | - | | ||
| | | pom.xml[^4] | - | - | ✅ | ✅ | excluded | - | | ||
| | | *gradle.lockfile | - | - | ✅ | ✅ | excluded | - | | ||
| | [Go](golang.md) | Binaries built by Go[^5] | ✅ | ✅ | - | - | excluded | - | | ||
| | | go.mod[^6] | - | - | ✅ | ✅ | included | - | | ||
| | [Rust](rust.md) | Cargo.lock | ✅ | ✅ | ✅ | ✅ | excluded[^13] | ✅ | | ||
| | | Binaries built with [cargo-auditable](https://github.com/rust-secure-code/cargo-auditable) | ✅ | ✅ | - | - | excluded[^13] | - | | ||
| | C/C++ | conan.lock[^12] | - | - | ✅ | ✅ | excluded[^13] | - | | ||
| | Elixir | mix.lock[^12] | - | - | ✅ | ✅ | excluded | ✅ | | ||
| | Dart | pubspec.lock | ✅ | ✅ | - | - | included | - | | ||
| | Julia | Manifest.toml | ✅ | ✅ | ✅ | ✅ | excluded[^14] | ✅ | | ||
|
|
||
| The path of these files does not matter. | ||
|
|
||
| Example: [Dockerfile](https://github.com/aquasecurity/trivy-ci-test/blob/main/Dockerfile) | ||
|
|
||
| [^1]: `*.egg-info`, `*.egg-info/PKG-INFO`, `*.egg` and `EGG-INFO/PKG-INFO` | ||
| [^2]: `.dist-info/META-DATA` | ||
| [^3]: `*.jar`, `*.war`, `*.par` and `*.ear` | ||
| [^4]: It requires Internet access when the POM doesn't exist in your local repository | ||
| [^5]: UPX-compressed binaries don't work | ||
| [^6]: If smaller than go 1.17, go.sum is also required | ||
| [^7]: ✅ means "enabled" and `-` means "disabled" in the image scanning | ||
| [^8]: ✅ means "enabled" and `-` means "disabled" in the rootfs scanning | ||
| [^9]: ✅ means "enabled" and `-` means "disabled" in the filesystem scanning | ||
| [^10]: ✅ means "enabled" and `-` means "disabled" in the git repository scanning | ||
| [^11]: ✅ means that Trivy detects line numbers where each dependency is declared in the scanned file. Only supported in [json](../../../configuration/reporting.md#json) and [sarif](../../../configuration/reporting.md#sarif) formats. SARIF uses `startline == 1 and endline == 1` for unsupported file types | ||
| [^12]: To scan a filename other than the default filename use [file-patterns](../../../configuration/others.md#file-patterns) | ||
| [^13]: When you scan `Cargo.lock` and `Cargo.toml` together. See about it [here](./rust.md#cargo). | ||
| [^14]: When you scan `Project.toml` and `Manifest.toml` together. See about it [here](./julia.md#pkgjl). | ||
|
|
||
| ## Data Sources | ||
|
|
||
| | Language | Source | Commercial Use | Delay[^1] | | ||
| | -------- | --------------------------------------------------- | :------------: | :-------: | | ||
| | PHP | [PHP Security Advisories Database][php] | ✅ | - | | ||
| | | [GitHub Advisory Database (Composer)][php-ghsa] | ✅ | - | | ||
| | Python | [GitHub Advisory Database (pip)][python-ghsa] | ✅ | - | | ||
| | | [Open Source Vulnerabilities (PyPI)][python-osv] | ✅ | - | | ||
| | Ruby | [Ruby Advisory Database][ruby] | ✅ | - | | ||
| | | [GitHub Advisory Database (RubyGems)][ruby-ghsa] | ✅ | - | | ||
| | Node.js | [Ecosystem Security Working Group][nodejs] | ✅ | - | | ||
| | | [GitHub Advisory Database (npm)][nodejs-ghsa] | ✅ | - | | ||
| | Java | [GitLab Advisories Community][gitlab] | ✅ | 1 month | | ||
| | | [GitHub Advisory Database (Maven)][java-ghsa] | ✅ | - | | ||
| | Go | [GitHub Advisory Database (Go)][go-ghsa] | ✅ | - | | ||
| | | [The Go Vulnerability Database][go] | ✅ | - | | ||
| | Rust | [Open Source Vulnerabilities (crates.io)][rust-osv] | ✅ | - | | ||
| | .NET | [GitHub Advisory Database (NuGet)][dotnet-ghsa] | ✅ | - | | ||
| | C/C++ | [GitLab Advisories Community][gitlab] | ✅ | 1 month | | ||
| | Dart | [GitHub Advisory Database (Pub)][pub-ghsa] | ✅ | - | | ||
| | Elixir | [GitHub Advisory Database (Erlang)][erlang-ghsa] | ✅ | | | ||
|
|
||
| [^1]: Intentional delay between vulnerability disclosure and registration in the DB | ||
|
|
||
| [php-ghsa]: https://github.com/advisories?query=ecosystem%3Acomposer | ||
| [python-ghsa]: https://github.com/advisories?query=ecosystem%3Apip | ||
| [ruby-ghsa]: https://github.com/advisories?query=ecosystem%3Arubygems | ||
| [nodejs-ghsa]: https://github.com/advisories?query=ecosystem%3Anpm | ||
| [java-ghsa]: https://github.com/advisories?query=ecosystem%3Amaven | ||
| [dotnet-ghsa]: https://github.com/advisories?query=ecosystem%3Anuget | ||
| [pub-ghsa]: https://github.com/advisories?query=ecosystem%3Apub | ||
| [erlang-ghsa]: https://github.com/advisories?query=ecosystem%3Aerlang | ||
| [go-ghsa]: https://github.com/advisories?query=ecosystem%3Ago | ||
|
|
||
| [php]: https://github.com/FriendsOfPHP/security-advisories | ||
| [ruby]: https://github.com/rubysec/ruby-advisory-db | ||
| [nodejs]: https://github.com/nodejs/security-wg | ||
| [gitlab]: https://gitlab.com/gitlab-org/advisories-community | ||
| [go]: https://github.com/golang/vulndb | ||
|
|
||
| [python-osv]: https://osv.dev/list?q=&ecosystem=PyPI | ||
| [rust-osv]: https://osv.dev/list?q=&ecosystem=crates.io |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.