From a4e981b4ec3ac3636950d30ab2b7393fd2e67cd5 Mon Sep 17 00:00:00 2001 From: Teppei Fukuda Date: Thu, 17 Aug 2023 11:00:34 +0300 Subject: [PATCH] docs: add coverage (#4954) * docs: add coverage * add more pages * add dart, dotnet, elixir languages. * add C, ruby, cocoapods. Update links * rename headers for dart and elixir * docs: add Google Distroless and Photon OS * docs: add IaC * docs: put vulnerability into a single page * fixed broken links * docs: add coverage overview * update some links * add note about arch for Rocky linux * docs: fix typo * fix typo * docs: add footnotes * docs: add a link to coverage in the license section * docs: add a conversion table * docs: get aligned --------- Co-authored-by: DmitriyLewen --- docs/docs/advanced/air-gap.md | 2 +- docs/docs/configuration/db.md | 2 +- docs/docs/coverage/iac/azure-arm.md | 33 ++++ docs/docs/coverage/iac/cloudformation.md | 24 +++ docs/docs/coverage/iac/docker.md | 24 +++ docs/docs/coverage/iac/helm.md | 60 ++++++ docs/docs/coverage/iac/index.md | 21 ++ docs/docs/coverage/iac/kubernetes.md | 31 +++ docs/docs/coverage/iac/terraform.md | 45 +++++ docs/docs/coverage/index.md | 8 + docs/docs/coverage/language/c.md | 23 +++ docs/docs/coverage/language/dart.md | 26 +++ docs/docs/coverage/language/dotnet.md | 34 ++++ docs/docs/coverage/language/elixir.md | 27 +++ .../language/golang.md | 27 ++- docs/docs/coverage/language/index.md | 66 +++++++ .../language/java.md | 29 ++- .../language/nodejs.md | 26 ++- .../language/php.md | 16 +- .../language/python.md | 39 +++- docs/docs/coverage/language/ruby.md | 30 +++ .../language/rust.md | 31 ++- docs/docs/coverage/language/swift.md | 10 + docs/docs/coverage/os/alma.md | 73 +++++++ docs/docs/coverage/os/alpine.md | 59 ++++++ docs/docs/coverage/os/amazon.md | 72 +++++++ docs/docs/coverage/os/cbl-mariner.md | 66 +++++++ docs/docs/coverage/os/centos.md | 38 ++++ docs/docs/coverage/os/chainguard.md | 32 ++++ docs/docs/coverage/os/debian.md | 74 +++++++ docs/docs/coverage/os/google-distroless.md | 34 ++++ docs/docs/coverage/os/index.md | 39 ++++ docs/docs/coverage/os/oracle.md | 70 +++++++ docs/docs/coverage/os/photon.md | 54 ++++++ docs/docs/coverage/os/rhel.md | 84 ++++++++ docs/docs/coverage/os/rocky.md | 70 +++++++ docs/docs/coverage/os/suse.md | 40 ++++ docs/docs/coverage/os/ubuntu.md | 65 +++++++ docs/docs/coverage/os/wolfi.md | 31 +++ docs/docs/scanner/license.md | 7 +- .../scanner/misconfiguration/custom/index.md | 9 +- docs/docs/scanner/misconfiguration/index.md | 51 ----- .../misconfiguration/policy/builtin.md | 20 +- docs/docs/scanner/vulnerability.md | 180 ++++++++++++++++++ docs/docs/scanner/vulnerability/index.md | 51 ----- .../scanner/vulnerability/language/index.md | 92 --------- docs/docs/scanner/vulnerability/os.md | 136 ------------- docs/docs/supply-chain/sbom.md | 18 +- docs/docs/target/container_image.md | 2 +- docs/docs/target/filesystem.md | 2 +- docs/docs/target/repository.md | 4 +- docs/docs/target/rootfs.md | 2 +- docs/docs/target/vm.md | 2 +- docs/getting-started/coverage.md | 58 ------ docs/getting-started/faq.md | 2 +- docs/index.md | 2 +- mkdocs.yml | 54 ++++-- pkg/purl/purl.go | 4 + 58 files changed, 1736 insertions(+), 495 deletions(-) create mode 100644 docs/docs/coverage/iac/azure-arm.md create mode 100644 docs/docs/coverage/iac/cloudformation.md create mode 100644 docs/docs/coverage/iac/docker.md create mode 100644 docs/docs/coverage/iac/helm.md create mode 100644 docs/docs/coverage/iac/index.md create mode 100644 docs/docs/coverage/iac/kubernetes.md create mode 100644 docs/docs/coverage/iac/terraform.md create mode 100644 docs/docs/coverage/index.md create mode 100644 docs/docs/coverage/language/c.md create mode 100644 docs/docs/coverage/language/dart.md create mode 100644 docs/docs/coverage/language/dotnet.md create mode 100644 docs/docs/coverage/language/elixir.md rename docs/docs/{scanner/vulnerability => coverage}/language/golang.md (68%) create mode 100644 docs/docs/coverage/language/index.md rename docs/docs/{scanner/vulnerability => coverage}/language/java.md (71%) rename docs/docs/{scanner/vulnerability => coverage}/language/nodejs.md (61%) rename docs/docs/{scanner/vulnerability => coverage}/language/php.md (50%) rename docs/docs/{scanner/vulnerability => coverage}/language/python.md (64%) create mode 100644 docs/docs/coverage/language/ruby.md rename docs/docs/{scanner/vulnerability => coverage}/language/rust.md (52%) create mode 100644 docs/docs/coverage/language/swift.md create mode 100644 docs/docs/coverage/os/alma.md create mode 100644 docs/docs/coverage/os/alpine.md create mode 100644 docs/docs/coverage/os/amazon.md create mode 100644 docs/docs/coverage/os/cbl-mariner.md create mode 100644 docs/docs/coverage/os/centos.md create mode 100644 docs/docs/coverage/os/chainguard.md create mode 100644 docs/docs/coverage/os/debian.md create mode 100644 docs/docs/coverage/os/google-distroless.md create mode 100644 docs/docs/coverage/os/index.md create mode 100644 docs/docs/coverage/os/oracle.md create mode 100644 docs/docs/coverage/os/photon.md create mode 100644 docs/docs/coverage/os/rhel.md create mode 100644 docs/docs/coverage/os/rocky.md create mode 100644 docs/docs/coverage/os/suse.md create mode 100644 docs/docs/coverage/os/ubuntu.md create mode 100644 docs/docs/coverage/os/wolfi.md create mode 100644 docs/docs/scanner/vulnerability.md delete mode 100644 docs/docs/scanner/vulnerability/index.md delete mode 100644 docs/docs/scanner/vulnerability/language/index.md delete mode 100644 docs/docs/scanner/vulnerability/os.md delete mode 100644 docs/getting-started/coverage.md diff --git a/docs/docs/advanced/air-gap.md b/docs/docs/advanced/air-gap.md index 506b4b2b12c..8793defbb5c 100644 --- a/docs/docs/advanced/air-gap.md +++ b/docs/docs/advanced/air-gap.md @@ -139,4 +139,4 @@ $ trivy conf --skip-policy-update /path/to/conf [allowlist]: ../references/troubleshooting.md [oras]: https://oras.land/cli/ -[^1]: This is only required to scan `jar` files. More information about `Java index db` [here](../scanner/vulnerability/language/java.md) +[^1]: This is only required to scan `jar` files. More information about `Java index db` [here](../coverage/language/java.md) diff --git a/docs/docs/configuration/db.md b/docs/docs/configuration/db.md index 2aeddf20cd9..b90b130ee81 100644 --- a/docs/docs/configuration/db.md +++ b/docs/docs/configuration/db.md @@ -8,7 +8,7 @@ | License | | The vulnerability database and the Java index database are needed only for vulnerability scanning. -See [here](../scanner/vulnerability/index.md) for the detail. +See [here](../scanner/vulnerability.md) for the detail. ## Vulnerability Database diff --git a/docs/docs/coverage/iac/azure-arm.md b/docs/docs/coverage/iac/azure-arm.md new file mode 100644 index 00000000000..609c6e0c305 --- /dev/null +++ b/docs/docs/coverage/iac/azure-arm.md @@ -0,0 +1,33 @@ +# Azure ARM Template +Trivy supports the scanners listed in the table below. + +| Scanner | Supported | +| :----------------: | :-------: | +| [Misconfiguration] | ✓ | +| [Secret] | ✓ | + +It supports the following configurations: + +| Format | Supported | +| :----------: | :-------: | +| ARM template | ✓ | +| Bicep | ✓[^1] | + +To scan Bicep codes, you need to convert them into ARM templates first. + +``` +az bicep build -f main.bicep +or +bicep build main.bicep +``` + +## Misconfiguration +Trivy recursively searches directories and scans all found Azure ARM templates. + +## Secret +The secret scan is performed on plain text files, with no special treatment for Azure ARM templates. + +[Misconfiguration]: ../../scanner/misconfiguration/index.md +[Secret]: ../../scanner/secret.md + +[^1]: Bicep is not natively supported. It needs to be converted into Azure ARM templates. \ No newline at end of file diff --git a/docs/docs/coverage/iac/cloudformation.md b/docs/docs/coverage/iac/cloudformation.md new file mode 100644 index 00000000000..f0ba21acdb2 --- /dev/null +++ b/docs/docs/coverage/iac/cloudformation.md @@ -0,0 +1,24 @@ +# CloudFormation +Trivy supports the scanners listed in the table below. + +| Scanner | Supported | +| :----------------: | :-------: | +| [Misconfiguration] | ✓ | +| [Secret] | ✓ | + +It supports the following formats. + +| Format | Supported | +| :----: | :-------: | +| JSON | ✓ | +| YAML | ✓ | + +## Misconfiguration +Trivy recursively searches directories and scans all found CloudFormation files. +It evaluates properties, functions, and other elements within CloudFormation files to detect misconfigurations. + +## Secret +The secret scan is performed on plain text files, with no special treatment for CloudFormation. + +[Misconfiguration]: ../../scanner/misconfiguration/index.md +[Secret]: ../../scanner/secret.md \ No newline at end of file diff --git a/docs/docs/coverage/iac/docker.md b/docs/docs/coverage/iac/docker.md new file mode 100644 index 00000000000..8b554e62302 --- /dev/null +++ b/docs/docs/coverage/iac/docker.md @@ -0,0 +1,24 @@ +# Docker +Trivy supports the scanners listed in the table below. + +| Scanner | Supported | +| :----------------: | :-------: | +| [Misconfiguration] | ✓ | +| [Secret] | ✓ | + +It supports the following configurations. + +| Config | Supported | +| :-----------: | :-------: | +| Dockerfile | ✓ | +| Containerfile | ✓ | +| Compose | - | + +## Misconfiguration +Trivy recursively searches directories and scans all found Docker files. + +## Secret +The secret scan is performed on plain text files, with no special treatment for Dockerfile. + +[Misconfiguration]: ../../scanner/misconfiguration/index.md +[Secret]: ../../scanner/secret.md \ No newline at end of file diff --git a/docs/docs/coverage/iac/helm.md b/docs/docs/coverage/iac/helm.md new file mode 100644 index 00000000000..4f9f87de860 --- /dev/null +++ b/docs/docs/coverage/iac/helm.md @@ -0,0 +1,60 @@ +# Helm +Trivy supports two types of Helm scanning, templates and packaged charts. +The following scanners are supported. + +| Format | [Misconfiguration] | [Secret] | +| -------- | :----------------: | :------: | +| Template | ✓ | ✓ | +| Chart | ✓ | - | + +## Misconfiguration +Trivy recursively searches directories and scans all found Helm files. + +It evaluates variables, functions, and other elements within Helm templates and resolve the chart to Kubernetes manifests then run the Kubernetes checks. +See [here](../../scanner/misconfiguration/policy/builtin.md) for more details on the built-in policies. + +### Value overrides +There are a number of options for overriding values in Helm charts. +When override values are passed to the Helm scanner, the values will be used during the Manifest rendering process and will become part of the scanned artifact. + +#### Setting inline value overrides +Overrides can be set inline on the command line + +```bash +trivy conf --helm-set securityContext.runAsUser=0 ./charts/mySql +``` + +#### Setting value file overrides +Overrides can be in a file that has the key=value set. + +```yaml +# Example override file (overrides.yaml) + +securityContext: + runAsUser: 0 +``` + +```bash +trivy conf --helm-values overrides.yaml ./charts/mySql +``` + +#### Setting value as explicit string +the `--helm-set-string` is the same as `--helm-set` but explicitly retains the value as a string + +```bash +trivy config --helm-set-string name=false ./infrastructure/tf +``` + +#### Setting specific values from files +Specific override values can come from specific files + +```bash +trivy conf --helm-set-file environment=dev.values.yaml ./charts/mySql +``` + +## Secret +The secret scan is performed on plain text files, with no special treatment for Helm. +Secret scanning is not conducted on the contents of packaged Charts, such as tar or tar.gz. + +[Misconfiguration]: ../../scanner/misconfiguration/index.md +[Secret]: ../../scanner/secret.md \ No newline at end of file diff --git a/docs/docs/coverage/iac/index.md b/docs/docs/coverage/iac/index.md new file mode 100644 index 00000000000..7fd9a475643 --- /dev/null +++ b/docs/docs/coverage/iac/index.md @@ -0,0 +1,21 @@ +# Infrastructure as Code + +## Scanner +Trivy scans Infrastructure as Code (IaC) files for + +- [Misconfigurations][misconf] +- [Secrets][secret] + +## Supported configurations + +| Config type | File patterns | +| ----------------------------------- | ----------------------------- | +| [Kubernetes](kubernetes.md) | *.yml, *.yaml, *.json | +| [Docker](docker.md) | Dockerfile, Containerfile | +| [Terraform](terraform.md) | *.tf, *.tf.json, *.tfvars, | +| [CloudFormation](cloudformation.md) | *.yml, *.yaml, *.json | +| [Azure ARM Template](azure-arm.md) | *.json | +| [Helm](helm.md) | *.yaml, *.tpl, *.tar.gz, etc. | + +[misconf]: ../../scanner/misconfiguration/index.md +[secret]: ../../scanner/secret.md diff --git a/docs/docs/coverage/iac/kubernetes.md b/docs/docs/coverage/iac/kubernetes.md new file mode 100644 index 00000000000..61b5163438c --- /dev/null +++ b/docs/docs/coverage/iac/kubernetes.md @@ -0,0 +1,31 @@ +# Kubernetes +Trivy supports the scanners listed in the table below. + +| Scanner | Supported | +| :----------------: | :-------: | +| [Misconfiguration] | ✓ | +| [Secret] | ✓ | + +In addition to raw YAML and JSON, it supports the following templates: + +| Template | Supported | +| :-------------: | :-------: | +| [Helm](helm.md) | ✓ | +| Kustomize | ✓[^1] | + +!!! note + Trivy does not support Kustomize overlays, so it scans files defined in the base. + Or, you can scan the output of `kustomize build`. + +## Misconfiguration +Trivy recursively searches directories and scans all found Kubernetes files. + +## Secret +The secret scan is performed on plain text files, with no special treatment for Kubernetes. +This means that Base64 encoded secrets are not scanned, and only secrets written in plain text are detected. + + +[Misconfiguration]: ../../scanner/misconfiguration/index.md +[Secret]: ../../scanner/secret.md + +[^1]: Kustomize is not natively supported. \ No newline at end of file diff --git a/docs/docs/coverage/iac/terraform.md b/docs/docs/coverage/iac/terraform.md new file mode 100644 index 00000000000..7d41ea76360 --- /dev/null +++ b/docs/docs/coverage/iac/terraform.md @@ -0,0 +1,45 @@ +# Terraform +Trivy supports the scanners listed in the table below. + +| Scanner | Supported | +| :--------------: | :-------: | +| Misconfiguration | ✓ | +| Secret | ✓ | + +It supports the following formats: + +| Format | Supported | +| :-------: | :-------: | +| JSON | ✓ | +| HCL | ✓ | +| Plan JSON | ✓ | + +Trivy can scan the results of `terraform plan`. +You can scan by passing the file generated as shown below to Trivy: + +``` +$ terraform plan --out tfplan.binary +$ terraform show -json tfplan.binary > tfplan.json +``` + +## Misconfiguration +Trivy recursively searches directories and scans all found Terraform files. +It also evaluates variables, imports, and other elements within Terraform files to detect misconfigurations. + +### Value Overrides +You can provide `tf-vars` files to Trivy to override default values specified in the Terraform HCL code. + +```bash +trivy conf --tf-vars dev.terraform.tfvars ./infrastructure/tf +``` + +### Exclude Downloaded Terraform Modules +By default, downloaded modules are also scanned. +If you don't want to scan modules downloaded into the `.terraform` directory, you can use the `--tf-exclude-downloaded-modules` flag. + +```bash +trivy conf --tf-exclude-downloaded-modules ./configs +``` + +## Secret +The secret scan is performed on plain text files, with no special treatment for Terraform. \ No newline at end of file diff --git a/docs/docs/coverage/index.md b/docs/docs/coverage/index.md new file mode 100644 index 00000000000..dbb06339c65 --- /dev/null +++ b/docs/docs/coverage/index.md @@ -0,0 +1,8 @@ +# Scanning Coverage +Trivy can detect security issues in many different platforms, languages and configuration files. +This section gives a general overview of that coverage, and can help answer the frequently asked question "Does Trivy support X?". +For more detailed information about the specific platforms and languages, check the relevant documentation. + +- [OS Packages](os/index.md) +- [Language-specific Packages](language/index.md) +- [IaC files](iac/index.md) \ No newline at end of file diff --git a/docs/docs/coverage/language/c.md b/docs/docs/coverage/language/c.md new file mode 100644 index 00000000000..6efe1e87e62 --- /dev/null +++ b/docs/docs/coverage/language/c.md @@ -0,0 +1,23 @@ +# C/C++ + +Trivy supports [Conan][conan] C/C++ Package Manager. + +The following scanners are supported. + +| Package manager | SBOM | Vulnerability | License | +| --------------- | :---: | :-----------: | :-----: | +| Conan | ✓ | ✓ | - | + +The following table provides an outline of the features Trivy offers. + +| Package manager | File | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position | +| --------------- | -------------- | :---------------------: | :--------------: | :----------------------------------: | :------: | +| Conan | conan.lock[^1] | ✓ | Excluded | ✓ | ✓ | + +## Conan +In order to detect dependencies, Trivy searches for `conan.lock`[^1]. + +[conan]: https://docs.conan.io/1/index.html +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies + +[^1]: `conan.lock` is default name. To scan a custom filename use [file-patterns](../../configuration/skipping.md#file-patterns) \ No newline at end of file diff --git a/docs/docs/coverage/language/dart.md b/docs/docs/coverage/language/dart.md new file mode 100644 index 00000000000..f7bba0a3951 --- /dev/null +++ b/docs/docs/coverage/language/dart.md @@ -0,0 +1,26 @@ +# Dart + +Trivy supports [Dart][dart]. + +The following scanners are supported. + +| Package manager | SBOM | Vulnerability | License | +|-------------------------| :---: | :-----------: |:-------:| +| [Dart][dart-repository] | ✓ | ✓ | - | + +The following table provides an outline of the features Trivy offers. + + +| Package manager | File | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position | +|-------------------------|--------------|:-----------------------:|:----------------:|:------------------------------------:|:--------:| +| [Dart][dart-repository] | pubspec.lock | ✓ | Included | - | - | + +## Dart +In order to detect dependencies, Trivy searches for `pubspec.lock`. + +Trivy marks indirect dependencies, but `pubspec.lock` file doesn't have options to separate root and dev transitive dependencies. +So Trivy includes all dependencies in report. + +[dart]: https://dart.dev/ +[dart-repository]: https://pub.dev/ +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies diff --git a/docs/docs/coverage/language/dotnet.md b/docs/docs/coverage/language/dotnet.md new file mode 100644 index 00000000000..b8373612972 --- /dev/null +++ b/docs/docs/coverage/language/dotnet.md @@ -0,0 +1,34 @@ +# .NET + +Trivy supports `.NET core` and `NuGet` package managers. + +The following scanners are supported. + +| Artifact | SBOM | Vulnerability | License | +|-----------|:----:|:-------------:|:-------:| +| .Net Core | ✓ | ✓ | - | +| NuGet | ✓ | ✓ | - | + +The following table provides an outline of the features Trivy offers. + +| Package manager | File | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position | +|:---------------:|--------------------|:-----------------------:|:----------------:|:------------------------------------:|:--------:| +| .Net Core | *.deps.json | ✓ | Excluded | - | ✓ | +| NuGet | packages.config | ✓ | Excluded | - | - | +| NuGet | packages.lock.json | ✓ | Included | ✓ | ✓ | + +### *.deps.json +Trivy parses `*.deps.json` files. Trivy currently excludes dev dependencies from the report. + +### packages.config +Trivy only finds dependency names and versions from `packages.config` files. To build dependency graph, it is better to use `packages.lock.json` files. + +### packages.lock.json +Don't forgot to [enable][enable-lock] lock files in your project. + +!!! tip + Please make sure your lock file is up-to-date after modifying dependencies. + + +[enable-lock]: https://learn.microsoft.com/en-us/nuget/consume-packages/package-references-in-project-files#enabling-the-lock-file +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies diff --git a/docs/docs/coverage/language/elixir.md b/docs/docs/coverage/language/elixir.md new file mode 100644 index 00000000000..c447dc4ec1b --- /dev/null +++ b/docs/docs/coverage/language/elixir.md @@ -0,0 +1,27 @@ +# Elixir + +Trivy supports [Hex][hex] repository for [Elixir][elixir]. + +The following scanners are supported. + +| Package manager | SBOM | Vulnerability | License | +|-----------------| :---: | :-----------: |:-------:| +| [hex][hex] | ✓ | ✓ | - | + +The following table provides an outline of the features Trivy offers. + + +| Package manager | File | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position | +|-----------------|--------------|:-----------------------:|:----------------:|:------------------------------------:|:--------:| +| [hex][hex] | mix.lock[^1] | ✓ | Excluded | - | ✓ | + +## Hex +In order to detect dependencies, Trivy searches for `mix.lock`[^1]. + +[Configure](https://hexdocs.pm/mix/Mix.Project.html#module-configuration) your project to use `mix.lock`[^1] file. + +[elixir]: https://elixir-lang.org/ +[hex]: https://hex.pm/ +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies + +[^1]: `mix.lock` is default name. To scan a custom filename use [file-patterns](../../configuration/skipping.md#file-patterns) \ No newline at end of file diff --git a/docs/docs/scanner/vulnerability/language/golang.md b/docs/docs/coverage/language/golang.md similarity index 68% rename from docs/docs/scanner/vulnerability/language/golang.md rename to docs/docs/coverage/language/golang.md index fbae09da1a3..31796bf531f 100644 --- a/docs/docs/scanner/vulnerability/language/golang.md +++ b/docs/docs/coverage/language/golang.md @@ -2,12 +2,20 @@ ## Features Trivy supports two types of Go scanning, Go Modules and binaries built by Go. -The following table provides an outline of the features Trivy offers. -| Artifact | Offline[^1] | Dev dependencies | License | Dependency graph | -|----------|:-----------:|:-----------------|:-------:|:----------------:| -| Modules | ✅ | Include | ✅[^2] | ✅[^2] | -| Binaries | ✅ | Exclude | - | - | +The following scanners are supported. + +| Artifact | SBOM | Vulnerability | License | +| -------- | :---: | :-----------: | :-----: | +| Modules | ✓ | ✓ | ✓[^2] | +| Binaries | ✓ | ✓ | - | + +The table below provides an outline of the features Trivy offers. + +| Artifact | Offline[^1] | Dev dependencies | [Dependency graph][dependency-graph] | +|----------|:-----------:|:-----------------|:----------------------------------:| +| Modules | ✅ | Include | ✅[^2] | +| Binaries | ✅ | Exclude | - | !!! note Trivy scans only dependencies of the Go project. @@ -18,7 +26,7 @@ The following table provides an outline of the features Trivy offers. Depending on Go versions, the required files are different. | Version | Required files | Offline | -|---------|:--------------:|:-------:| +| ------- | :------------: | :-----: | | \>=1.17 | go.mod | ✅ | | <1.17 | go.mod, go.sum | ✅ | @@ -63,5 +71,10 @@ Also, you can scan your local binaries. $ trivy fs ./your_binary ``` +!!! note + It doesn't work with UPX-compressed binaries. + [^1]: It doesn't require the Internet access. -[^2]: Need to download modules to local cache beforehand \ No newline at end of file +[^2]: Need to download modules to local cache beforehand + +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies \ No newline at end of file diff --git a/docs/docs/coverage/language/index.md b/docs/docs/coverage/language/index.md new file mode 100644 index 00000000000..ef45c8d25b1 --- /dev/null +++ b/docs/docs/coverage/language/index.md @@ -0,0 +1,66 @@ +# Programming Language + +Trivy supports programming languages for + +- [SBOM][sbom] +- [Vulnerabilities][vuln] +- [Licenses][license] + +## Supported languages +The files analyzed vary depending on the target. +This is because Trivy primarily categorizes targets into two groups: + +- Pre-build +- Post-build + +If the target is a pre-build project, like a code repository, Trivy will analyze files used for building, such as lock files. +On the other hand, when the target is a post-build artifact, like a container image, Trivy will analyze installed package metadata like `.gemspec`, binary files, and so on. + +| Language | File | Image[^5] | Rootfs[^6] | Filesystem[^7] | Repository[^8] | +| -------------------- | ------------------------------------------------------------------------------------------ | :-------: | :--------: | :------------: | :------------: | +| [Ruby](ruby.md) | Gemfile.lock | - | - | ✅ | ✅ | +| | gemspec | ✅ | ✅ | - | - | +| [Python](python.md) | Pipfile.lock | - | - | ✅ | ✅ | +| | poetry.lock | - | - | ✅ | ✅ | +| | requirements.txt | - | - | ✅ | ✅ | +| | egg package[^1] | ✅ | ✅ | - | - | +| | wheel package[^2] | ✅ | ✅ | - | - | +| | conda package[^3] | ✅ | ✅ | - | - | +| [PHP](php.md) | composer.lock | ✅ | ✅ | ✅ | ✅ | +| [Node.js](nodejs.md) | package-lock.json | - | - | ✅ | ✅ | +| | yarn.lock | - | - | ✅ | ✅ | +| | pnpm-lock.yaml | - | - | ✅ | ✅ | +| | package.json | ✅ | ✅ | - | - | +| [.NET](dotnet.md) | packages.lock.json | ✅ | ✅ | ✅ | ✅ | +| | packages.config | ✅ | ✅ | ✅ | ✅ | +| | .deps.json | ✅ | ✅ | ✅ | ✅ | +| [Java](java.md) | JAR/WAR/PAR/EAR[^4] | ✅ | ✅ | - | - | +| | pom.xml | - | - | ✅ | ✅ | +| | *gradle.lockfile | - | - | ✅ | ✅ | +| [Go](golang.md) | Binaries built by Go | ✅ | ✅ | - | - | +| | go.mod | - | - | ✅ | ✅ | +| [Rust](rust.md) | Cargo.lock | ✅ | ✅ | ✅ | ✅ | +| | Binaries built with [cargo-auditable](https://github.com/rust-secure-code/cargo-auditable) | ✅ | ✅ | - | - | +| [C/C++](c.md) | conan.lock | - | - | ✅ | ✅ | +| [Elixir](elixir.md) | mix.lock[^10] | - | - | ✅ | ✅ | +| [Dart](dart.md) | pubspec.lock | - | - | ✅ | ✅ | +| [Swift](swift.md) | Podfile.lock | - | - | ✅ | ✅ | + +The path of these files does not matter. + +Example: [Dockerfile](https://github.com/aquasecurity/trivy-ci-test/blob/main/Dockerfile) + +[sbom]: ../../supply-chain/sbom.md +[vuln]: ../../scanner/vulnerability.md +[license]: ../../scanner/license.md + +[^1]: `*.egg-info`, `*.egg-info/PKG-INFO`, `*.egg` and `EGG-INFO/PKG-INFO` +[^2]: `.dist-info/META-DATA` +[^3]: `envs/*/conda-meta/*.json` +[^4]: `*.jar`, `*.war`, `*.par` and `*.ear` +[^5]: ✅ means "enabled" and `-` means "disabled" in the image scanning +[^6]: ✅ means "enabled" and `-` means "disabled" in the rootfs scanning +[^7]: ✅ means "enabled" and `-` means "disabled" in the filesystem scanning +[^8]: ✅ means "enabled" and `-` means "disabled" in the git repository scanning +[^9]: ✅ means that Trivy detects line numbers where each dependency is declared in the scanned file. Only supported in [json](../../configuration/reporting.md#json) and [sarif](../../configuration/reporting.md#sarif) formats. SARIF uses `startline == 1 and endline == 1` for unsupported file types +[^10]: To scan a filename other than the default filename use [file-patterns](../../configuration/skipping.md#file-patterns) diff --git a/docs/docs/scanner/vulnerability/language/java.md b/docs/docs/coverage/language/java.md similarity index 71% rename from docs/docs/scanner/vulnerability/language/java.md rename to docs/docs/coverage/language/java.md index fb768e5526e..f17084cd0d8 100644 --- a/docs/docs/scanner/vulnerability/language/java.md +++ b/docs/docs/coverage/language/java.md @@ -1,14 +1,21 @@ # Java - Trivy supports three types of Java scanning: `JAR/WAR/PAR/EAR`, `pom.xml` and `*gradle.lockfile` files. -The following table provides an outline of the features Trivy offers. +Each artifact supports the following scanners: + +| Artifact | SBOM | Vulnerability | License | +| ---------------- | :---: | :-----------: | :-----: | +| JAR/WAR/PAR/EAR | ✓ | ✓ | - | +| pom.xml | ✓ | ✓ | ✓ | +| *gradle.lockfile | ✓ | ✓ | - | -| Artifact | Internet access | Dev dependencies | License | -|------------------|:---------------------:|:-----------------|:-------:| -| JAR/WAR/PAR/EAR | Trivy Java DB | Include | - | -| pom.xml | Maven repository [^1] | Exclude | ✅ | -| *gradle.lockfile | - | Exclude | - | +The following table provides an outline of the features Trivy offers. + +| Artifact | Internet access | Dev dependencies | [Dependency graph][dependency-graph] | +|------------------|:---------------------:|:----------------:|:------------------------------------:| +| JAR/WAR/PAR/EAR | Trivy Java DB | Include | - | +| pom.xml | Maven repository [^1] | Exclude | - | +| *gradle.lockfile | - | Exclude | - | These may be enabled or disabled depending on the target. See [here](./index.md) for the detail. @@ -18,7 +25,7 @@ To find information about your JAR[^2] file, Trivy parses `pom.properties` and ` If those files don't exist or don't contain enough information - Trivy will try to find this JAR[^2] file in [trivy-java-db](https://github.com/aquasecurity/trivy-java-db). The Java DB will be automatically downloaded/updated when any JAR[^2] file is found. -It is stored in [the cache directory](../../../configuration/cache.md#cache-directory). +It is stored in [the cache directory](../../configuration/cache.md#cache-directory). !!! warning "EXPERIMENTAL" Finding JARs in `trivy-java-db` is an experimental function. @@ -39,7 +46,7 @@ If your machine doesn't have the necessary files - Trivy tries to find the infor !!! Note Trivy only takes information about packages. We don't take a list of vulnerabilities for packages from the `maven repository`. - Information about data sources for Java you can see [here](./index.md#data-sources). + Information about data sources for Java you can see [here](../../scanner/vulnerability.md#data-sources_1). You can disable connecting to the maven repository with the `--offline-scan` flag. The `--offline-scan` flag does not affect the Trivy database. @@ -59,4 +66,6 @@ It doesn't require the internet access. [^3]: `ArtifactID`, `GroupID` and `Version` [^4]: e.g. when parent pom.xml file has `../pom.xml` path [^5]: When you use dependency path in `relativePath` field in pom.xml file -[^6]: `/Users//.m2/repository` (for Linux and Mac) and `C:/Users//.m2/repository` (for Windows) by default \ No newline at end of file +[^6]: `/Users//.m2/repository` (for Linux and Mac) and `C:/Users//.m2/repository` (for Windows) by default + +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies \ No newline at end of file diff --git a/docs/docs/scanner/vulnerability/language/nodejs.md b/docs/docs/coverage/language/nodejs.md similarity index 61% rename from docs/docs/scanner/vulnerability/language/nodejs.md rename to docs/docs/coverage/language/nodejs.md index f39c4cad2b1..b8ab6aadc91 100644 --- a/docs/docs/scanner/vulnerability/language/nodejs.md +++ b/docs/docs/coverage/language/nodejs.md @@ -1,18 +1,27 @@ # Node.js Trivy supports three types of Node.js package managers: `npm`, `Yarn` and `pnpm`. + +The following scanners are supported. + +| Artifact | SBOM | Vulnerability | License | +| -------- | :---: | :-----------: | :-----: | +| npm | ✓ | ✓ | ✓ | +| Yarn | ✓ | ✓ | - | +| pnpm | ✓ | ✓ | - | + The following table provides an outline of the features Trivy offers. -| Package manager | File | Transitive dependencies | Dev dependencies | Dependency graph | Position | License | -|:---------------:|-------------------|:-----------------------:|:-----------------:|:----------------:|:--------:|:-------:| -| npm | package-lock.json | ✅ | [Excluded](#npm) | ✅ | ✅ | ✅ | -| Yarn | yarn.lock | ✅ | [Excluded](#yarn) | ✅ | ✅ | - | -| pnpm | pnpm-lock.yaml | ✅ | Excluded | ✅ | - | - | +| Package manager | File | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position | +|:---------------:|-------------------|:-----------------------:|:-----------------:|:------------------------------------:|:--------:| +| npm | package-lock.json | ✓ | [Excluded](#npm) | ✓ | ✓ | +| Yarn | yarn.lock | ✓ | [Excluded](#yarn) | ✓ | ✓ | +| pnpm | pnpm-lock.yaml | ✓ | Excluded | ✓ | - | In addition, Trivy scans installed packages with `package.json`. | File | Dependency graph | Position | License | -|--------------|:----------------:|:--------:|:-------:| +| ------------ | :--------------: | :------: | :-----: | | package.json | - | - | ✅ | These may be enabled or disabled depending on the target. @@ -38,7 +47,7 @@ To exclude devDependencies, `package.json` also needs to be present next to `yar By default, Trivy doesn't report development dependencies. Use the `--include-dev-deps` flag to include them. ### pnpm -Trivy parses `pnpm-lock.yaml`, then finds production dependencies and builds a [tree] of dependencies with vulnerabilities. +Trivy parses `pnpm-lock.yaml`, then finds production dependencies and builds a [tree][dependency-graph] of dependencies with vulnerabilities. ## Packages Trivy parses the manifest files of installed packages in container image scanning and so on. @@ -47,5 +56,4 @@ Trivy parses the manifest files of installed packages in container image scannin Trivy searches for `package.json` files under `node_modules` and identifies installed packages. It only extracts package names, versions and licenses for those packages. - -[tree]: ../../../configuration/reporting.md#show-origins-of-vulnerable-dependencies \ No newline at end of file +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies \ No newline at end of file diff --git a/docs/docs/scanner/vulnerability/language/php.md b/docs/docs/coverage/language/php.md similarity index 50% rename from docs/docs/scanner/vulnerability/language/php.md rename to docs/docs/coverage/language/php.md index 129e91b4c23..6fa138c3529 100644 --- a/docs/docs/scanner/vulnerability/language/php.md +++ b/docs/docs/coverage/language/php.md @@ -1,12 +1,19 @@ # PHP Trivy supports [Composer][composer], which is a tool for dependency management in PHP. + +The following scanners are supported. + +| Package manager | SBOM | Vulnerability | License | +| --------------- | :---: | :-----------: | :-----: | +| Composer | ✓ | ✓ | ✓ | + The following table provides an outline of the features Trivy offers. -| Package Manager | File | Transitive dependencies | Dev dependencies | Dependency graph | Position | License | -|-----------------|---------------|:-----------------------:|:----------------:|:----------------:|:--------:|:-------:| -| Composer | composer.lock | ✅ | Excluded | ✅ | ✅ | ✅ | +| Package manager | File | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position | +|-----------------|---------------|:-----------------------:|:----------------:|:------------------------------------:|:--------:| +| Composer | composer.lock | ✓ | Excluded | ✓ | ✓ | ## Composer In order to detect dependencies, Trivy searches for `composer.lock`. @@ -15,4 +22,5 @@ Trivy also supports dependency trees; however, to display an accurate tree, it n Since this information is not included in `composer.lock`, Trivy parses `composer.json`, which should be located next to `composer.lock`. If you want to see the dependency tree, please ensure that `composer.json` is present. -[composer]: https://getcomposer.org/ \ No newline at end of file +[composer]: https://getcomposer.org/ +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies \ No newline at end of file diff --git a/docs/docs/scanner/vulnerability/language/python.md b/docs/docs/coverage/language/python.md similarity index 64% rename from docs/docs/scanner/vulnerability/language/python.md rename to docs/docs/coverage/language/python.md index afdc95a183b..b598bd964a7 100644 --- a/docs/docs/scanner/vulnerability/language/python.md +++ b/docs/docs/coverage/language/python.md @@ -1,20 +1,37 @@ # Python Trivy supports three types of Python package managers: `pip`, `Pipenv` and `Poetry`. +The following scanners are supported for package managers. + +| Package manager | SBOM | Vulnerability | License | +| --------------- | :---: | :-----------: | :-----: | +| pip | ✓ | ✓ | - | +| Pipenv | ✓ | ✓ | - | +| Poetry | ✓ | ✓ | - | + +In addition, Trivy supports three formats of Python packages: `egg`, `wheel` and `conda`. +The following scanners are supported for Python packages. + +| Packaging | SBOM | Vulnerability | License | +| --------- | :---: | :-----------: | :-----: | +| Egg | ✓ | ✓ | ✓ | +| Wheel | ✓ | ✓ | ✓ | +| Conda | ✓ | - | - | + + The following table provides an outline of the features Trivy offers. -| Package manager | File | Transitive dependencies | Dev dependencies | Dependency graph | Position | License | -|-----------------|------------------|:-----------------------:|:----------------:|:----------------:|:--------:|:-------:| -| pip | requirements.txt | - | Include | - | - | - | -| Pipenv | Pipfile.lock | ✅ | Include | - | ✅ | - | -| Poetry | poetry.lock | ✅ | Exclude | ✅ | | - | +| Package manager | File | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position | +|-----------------|------------------|:-----------------------:|:----------------:|:------------------------------------:|:--------:| +| pip | requirements.txt | - | Include | - | - | +| Pipenv | Pipfile.lock | ✓ | Include | - | ✓ | +| Poetry | poetry.lock | ✓ | Exclude | ✓ | | -In addition, Trivy supports two formats of Python packages: `egg` and `wheel`. -| Packaging | License | -|-----------|:-------:| -| Egg | ✅ | -| Wheel | ✅ | +| Packaging | Dependency graph | +| --------- | :--------------: | +| Egg | ✓ | +| Wheel | ✓ | These may be enabled or disabled depending on the target. See [here](./index.md) for the detail. @@ -73,3 +90,5 @@ Trivy looks for `*.egg-info`, `*.egg-info/PKG-INFO`, `*.egg` and `EGG-INFO/PKG-I ### Wheel Trivy looks for `.dist-info/META-DATA` to identify Python packages. + +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies diff --git a/docs/docs/coverage/language/ruby.md b/docs/docs/coverage/language/ruby.md new file mode 100644 index 00000000000..70dd1b2e818 --- /dev/null +++ b/docs/docs/coverage/language/ruby.md @@ -0,0 +1,30 @@ +# Ruby + +Trivy supports [Bundler][bundler] and [RubyGems][rubygems]. +The following scanners are supported for Cargo. + +| Package manager | SBOM | Vulnerability | License | +|-----------------|:----:|:-------------:|:-------:| +| Bundler | ✓ | ✓ | - | +| RubyGems | ✓ | ✓ | ✓ | + + +The following table provides an outline of the features Trivy offers. + +| Package manager | File | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position | +|-----------------|--------------|:-----------------------:|:-----------------|:------------------------------------:|:--------:| +| Bundler | Gemfile.lock | ✓ | Included | ✓ | ✓ | +| RubyGems | .gemspec | - | Included | - | - | + + +### Bundler +Trivy searches for `Gemfile.lock` to detect dependencies. + + +### RubyGems +`.gemspec` files doesn't contains transitive dependencies. You need to scan each `.gemspec` file separately. + +[bundler]: https://bundler.io +[rubygems]: https://rubygems.org/ +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies + diff --git a/docs/docs/scanner/vulnerability/language/rust.md b/docs/docs/coverage/language/rust.md similarity index 52% rename from docs/docs/scanner/vulnerability/language/rust.md rename to docs/docs/coverage/language/rust.md index 7e164fa2c9b..ddcda798d4c 100644 --- a/docs/docs/scanner/vulnerability/language/rust.md +++ b/docs/docs/coverage/language/rust.md @@ -1,18 +1,29 @@ # Rust -## Features Trivy supports [Cargo](https://doc.rust-lang.org/stable/cargo/), which is the Rust package manager. -The following table provides an outline of the features Trivy offers. +The following scanners are supported for Cargo. -| Package manager | File | Transitive dependencies | Dev dependencies | License | Dependency graph | Position | -|-----------------|------------|:-----------------------:|:-----------------|:-------:|:----------------:|:--------:| -| Cargo | Cargo.lock | ✅ | Excluded[^1] | - | ✅ | ✅ | +| Package manager | SBOM | Vulnerability | License | +| --------------- | :---: | :-----------: | :-----: | +| Cargo | ✓ | ✓ | - | In addition, it supports binaries built with [cargo-auditable](https://github.com/rust-secure-code/cargo-auditable). -| Artifact | Transitive dependencies | Dev dependencies | License | Dependency graph | Position | -|----------|:-----------------------:|:-----------------|:-------:|:----------------:|:--------:| -| Binaries | ✅ | Excluded | - | - | - | +| Artifact | SBOM | Vulnerability | License | +| -------- | :---: | :-----------: | :-----: | +| Binaries | ✓ | ✓ | - | + +## Features +The following table provides an outline of the features Trivy offers. + +| Package manager | File | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position | +|-----------------|------------|:-----------------------:|:-----------------|:------------------------------------:|:--------:| +| Cargo | Cargo.lock | ✓ | Excluded[^1] | ✓ | ✓ | + + +| Artifact | Transitive dependencies | Dev dependencies | Dependency graph | Position | +| -------- | :---------------------: | :--------------- | :--------------: | :------: | +| Binaries | ✓ | Excluded | - | - | ### Cargo @@ -28,4 +39,6 @@ Scan `Cargo.lock` and `Cargo.toml` together also removes developer dependencies. Trivy scans binaries built with [cargo-auditable](https://github.com/rust-secure-code/cargo-auditable). If such a binary exists, Trivy will identify it as being built with cargo-audit and scan it. -[^1]: When you scan Cargo.lock and Cargo.toml together. \ No newline at end of file +[^1]: When you scan Cargo.lock and Cargo.toml together. + +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies \ No newline at end of file diff --git a/docs/docs/coverage/language/swift.md b/docs/docs/coverage/language/swift.md new file mode 100644 index 00000000000..226dee08054 --- /dev/null +++ b/docs/docs/coverage/language/swift.md @@ -0,0 +1,10 @@ +# Swift + +Trivy supports [CocoaPods][cocoapods] for Swift packages. +The following scanners are supported. + +| Package manager | SBOM | Vulnerability | License | +| --------------- | :---: | :-----------: | :-----: | +| CocoaPods | ✓ | - | - | + +[cocoapods]: https://cocoapods.org/ \ No newline at end of file diff --git a/docs/docs/coverage/os/alma.md b/docs/docs/coverage/os/alma.md new file mode 100644 index 00000000000..4c0f7dd39ed --- /dev/null +++ b/docs/docs/coverage/os/alma.md @@ -0,0 +1,73 @@ +# AlmaLinux +Trivy supports the following scanners for OS packages. + +| Scanner | Supported | +| :-----------: | :-------: | +| SBOM | ✓ | +| Vulnerability | ✓ | +| License | ✓ | + +Please see [here](index.md#supported-os) for supported versions. + +The table below outlines the features offered by Trivy. + +| Feature | Supported | +|:------------------------------------:|:---------:| +| Unfixed vulnerabilities | - | +| [Dependency graph][dependency-graph] | ✓ | + +## SBOM +Trivy detects packages that have been installed through package managers such as `dnf` and `yum`. + +## Vulnerability +AlmaLinux offers its own security advisories, and these are utilized when scanning AlmaLinux for vulnerabilities. + +### Data Source +See [here](../../scanner/vulnerability.md#data-sources). + +### Fixed Version +When looking at fixed versions, it's crucial to consider the patches supplied by AlmaLinux. +For example, for CVE-2023-0464, the fixed version for AlmaLinux 9 is listed as `3.0.7-16.el9_2` in [their advisory][ALSA-2023:3722]. +Note that this is different from the upstream fixed version, which is `3.0.9`, `3.1.1`, and son on. +Typically, only the upstream information gets listed on [NVD], so it's important not to get confused. + +### Severity +Trivy calculates the severity of an issue based on the severity provided by AlmaLinux. +If the severity is not provided or defined yet by AlmaLinux, the severity from the NVD is taken into account. + +Using CVE-2023-0464 as an example, while it is rated as "High" in NVD, AlmaLinux has marked as ["moderate"][ALSA-2023:3722]. +As a result, Trivy will display it as "Medium". + +The table below is the mapping of AlmaLinux's severity to Trivy's severity levels. + +| AlmaLinux | Trivy | +| :-------: | :------: | +| Low | Low | +| Moderate | Medium | +| Important | High | +| Critical | Critical | + +### Status +Trivy supports the following [vulnerability statuses] for AlmaLinux. + +| Status | Supported | +| :-----------------: | :-------: | +| Fixed | ✓ | +| Affected | ✓ | +| Under Investigation | | +| Will Not Fix | | +| Fix Deferred | | +| End of Life | | + + +## License +Trivy identifies licenses by examining the metadata of RPM packages. + +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies + +[errata]: https://errata.almalinux.org/ + +[ALSA-2023:3722]: https://errata.almalinux.org/9/ALSA-2023-3722.html +[NVD]: https://nvd.nist.gov/vuln/detail/CVE-2023-0464 + +[vulnerability statuses]: ../../configuration/filtering.md#by-status \ No newline at end of file diff --git a/docs/docs/coverage/os/alpine.md b/docs/docs/coverage/os/alpine.md new file mode 100644 index 00000000000..baa2de10c3c --- /dev/null +++ b/docs/docs/coverage/os/alpine.md @@ -0,0 +1,59 @@ +# Alpine Linux +Trivy supports the following scanners for OS packages. + +| Scanner | Supported | +| :-----------: | :-------: | +| SBOM | ✓ | +| Vulnerability | ✓ | +| License | ✓ | + +Please see [here](index.md#supported-os) for supported versions. + +The table below outlines the features offered by Trivy. + +| Feature | Supported | +|:------------------------------------:|:---------:| +| Unfixed vulnerabilities | - | +| [Dependency graph][dependency-graph] | ✓ | + +## SBOM +Trivy detects packages that have been installed through `apk`. + +## Vulnerability +Alpine Linux offers its own security advisories, and these are utilized when scanning Alpine for vulnerabilities. + +### Data Source +See [here](../../scanner/vulnerability.md#data-sources). + +### Fixed Version +When looking at fixed versions, it's crucial to consider the patches supplied by Alpine. +For example, for CVE-2023-0464, the fixed version for Alpine Linux is listed as `3.1.0-r1` in [the secfixes][CVE-2023-0464]. +Note that this is different from the upstream fixed version, which is `3.1.1`. +Typically, only the upstream information gets listed on [NVD], so it's important not to get confused. + +### Severity +For Alpine vulnerabilities, the severity is determined using the values set by NVD. + +### Status +Trivy supports the following [vulnerability statuses] for Alpine. + +| Status | Supported | +| :-----------------: | :-------: | +| Fixed | ✓ | +| Affected | ✓ | +| Under Investigation | | +| Will Not Fix | | +| Fix Deferred | | +| End of Life | | + +## License +Trivy identifies licenses by examining the metadata of APK packages. + + +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies +[secdb]: https://secdb.alpinelinux.org/ + +[CVE-2023-0464]: https://gitlab.alpinelinux.org/alpine/aports/-/blob/dad5b7380ab3be705951ce6fd2d7bba513d6a744/main/openssl/APKBUILD#L36-37 +[NVD]: https://nvd.nist.gov/vuln/detail/CVE-2023-0464 + +[vulnerability statuses]: ../../configuration/filtering.md#by-status \ No newline at end of file diff --git a/docs/docs/coverage/os/amazon.md b/docs/docs/coverage/os/amazon.md new file mode 100644 index 00000000000..4cbc8ad370b --- /dev/null +++ b/docs/docs/coverage/os/amazon.md @@ -0,0 +1,72 @@ +# Amazon Linux +Trivy supports the following scanners for OS packages. + +| Scanner | Supported | +| :-----------: | :-------: | +| SBOM | ✓ | +| Vulnerability | ✓ | +| License | ✓ | + +Please see [here](index.md#supported-os) for supported versions. + +The table below outlines the features offered by Trivy. + +| Feature | Supported | +|:------------------------------------:|:---------:| +| Unfixed vulnerabilities | - | +| [Dependency graph][dependency-graph] | ✓ | + +## SBOM +Trivy detects packages that have been installed through package managers such as `dnf` and `yum`. + +## Vulnerability +Amazon Linux offers its own security advisories, and these are utilized when scanning Amazon Linux for vulnerabilities. + +### Data Source +See [here](../../scanner/vulnerability.md#data-sources). + +### Fixed Version +When looking at fixed versions, it's crucial to consider the patches supplied by Amazon. +For example, for CVE-2023-0464, the fixed version for Amazon Linux 2023 is listed as `3.0.8-1.amzn2023.0.2` in [ALAS2023-2023-181]. +Note that this is different from the upstream fixed version, which is `3.0.9`, `3.1.1`, and so on. +Typically, only the upstream information gets listed on [NVD], so it's important not to get confused. + +### Severity +Trivy determines vulnerability severity based on the severity metric provided by Amazon. +For example, the security patch for [CVE-2023-0464] in Amazon Linux 2023 is provided as [ALAS2023-2023-181]. +Its severity is rated as "Medium". +Thus, even though it's evaluated as "HIGH" in the NVD, Trivy displays it with a severity of "MEDIUM". + +The table below is the mapping of Amazon's severity to Trivy's severity levels. + +| Amazon | Trivy | +| :-------: | :------: | +| Low | Low | +| Medium | Medium | +| Important | High | +| Critical | Critical | + +### Status +Trivy supports the following [vulnerability statuses] for Amazon Linux. + +| Status | Supported | +| :-----------------: | :-------: | +| Fixed | ✓ | +| Affected | ✓ | +| Under Investigation | | +| Will Not Fix | | +| Fix Deferred | | +| End of Life | | + +## License +Trivy identifies licenses by examining the metadata of RPM packages. + + +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies +[center]: https://alas.aws.amazon.com/ + +[CVE-2023-0464]: https://alas.aws.amazon.com/cve/html/CVE-2023-0464.html +[ALAS2023-2023-181]: https://alas.aws.amazon.com/AL2023/ALAS-2023-181.html +[NVD]: https://nvd.nist.gov/vuln/detail/CVE-2023-0464 + +[vulnerability statuses]: ../../configuration/filtering.md#by-status \ No newline at end of file diff --git a/docs/docs/coverage/os/cbl-mariner.md b/docs/docs/coverage/os/cbl-mariner.md new file mode 100644 index 00000000000..0ca42bbb999 --- /dev/null +++ b/docs/docs/coverage/os/cbl-mariner.md @@ -0,0 +1,66 @@ +# CBL-Mariner +Trivy supports the following scanners for OS packages. + +| Version | SBOM | Vulnerability | License | +| ---------------- | :---: | :-----------: | :-----: | +| 1.0 | ✔ | ✔ | ✔ | +| 1.0 (Distroless) | ✔ | ✔ | | +| 2.0 | ✔ | ✔ | ✔ | +| 2.0 (Distroless) | ✔ | ✔ | | + + +The following table provides an outline of the targets Trivy supports. + +| Version | Container image | Virtual machine | Arch | +| ------- | :-------------: | :-------------: | :----------: | +| 1.0 | ✔ | ✔ | amd64, arm64 | +| 2.0 | ✔ | ✔ | amd64, arm64 | + +The table below outlines the features offered by Trivy. + +| Feature | Supported | +|:------------------------------------:|:---------:| +| Detect unfixed vulnerabilities | ✓ | +| [Dependency graph][dependency-graph] | ✓ | + +## SBOM +Trivy detects packages that have been installed through package managers such as `dnf` and `yum`. + +## Vulnerability +CBL-Mariner offers its own security advisories, and these are utilized when scanning CBL-Mariner for vulnerabilities. + +### Data Source +See [here](../../scanner/vulnerability.md#data-sources). + +### Fixed Version +Trivy takes fixed versions from [CBL-Mariner OVAL][oval]. + +### Severity +Trivy calculates the severity of an issue based on the severity provided in [CBL-Mariner OVAL][oval]. + +### Status +Trivy supports the following [vulnerability statuses] for CBL-Mariner. + +| Status | Supported | +| :-----------------: | :-------: | +| Fixed | ✓ | +| Affected | ✓ | +| Under Investigation | | +| Will Not Fix | | +| Fix Deferred | | +| End of Life | | + + +## License +Trivy identifies licenses by examining the metadata of RPM packages. + +!!! note + License detection is not supported for CBL-Mariner Distroless. + + +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies +[cbl-mariner]: https://github.com/microsoft/CBL-Mariner + +[oval]: https://github.com/microsoft/CBL-MarinerVulnerabilityData/ + +[vulnerability statuses]: ../../configuration/filtering.md#by-status diff --git a/docs/docs/coverage/os/centos.md b/docs/docs/coverage/os/centos.md new file mode 100644 index 00000000000..be881ae26fb --- /dev/null +++ b/docs/docs/coverage/os/centos.md @@ -0,0 +1,38 @@ +# CentOS +Trivy supports the following scanners for OS packages. + +| Scanner | Supported | +| :-----------: | :-------: | +| SBOM | ✓ | +| Vulnerability | ✓ | +| License | ✓ | + +Please see [here](index.md#supported-os) for supported versions. + +The table below outlines the features offered by Trivy. + +| Feature | Supported | +| :-----------------------------------: | :-------: | +| Unfixed vulnerabilities | ✓ | +| [Dependency graph][dependency-graph] | ✓ | + +## SBOM +Same as [RHEL](rhel.md#sbom). + +## Vulnerability +CentOS does not provide straightforward machine-readable security advisories. +As a result, Trivy utilizes the security advisories from [Red Hat Enterprise Linux (RHEL)](rhel.md#vulnerability) for detecting vulnerabilities in CentOS. +This approach might lead to situations where, even though Trivy displays a fixed version, CentOS might not have the patch available yet. +Since patches released for RHEL often become available in CentOS after some time, it's usually just a matter of waiting. + +!!! note + The case for CentOS Stream, which is not supported by Trivy, is entirely different from CentOS. + +As Trivy relies on Red Hat's advisories, please refer to [Red Hat](rhel.md) for details regarding vulnerability severity and status. + + +## License +Same as [RHEL](rhel.md#license). + + +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies \ No newline at end of file diff --git a/docs/docs/coverage/os/chainguard.md b/docs/docs/coverage/os/chainguard.md new file mode 100644 index 00000000000..41a6610aea3 --- /dev/null +++ b/docs/docs/coverage/os/chainguard.md @@ -0,0 +1,32 @@ +# Chainguard +Trivy supports the following scanners for OS packages. + +| Scanner | Supported | +| :-----------: | :-------: | +| SBOM | ✓ | +| Vulnerability | ✓ | +| License | ✓ | + +The table below outlines the features offered by Trivy. + +| Feature | Supported | +| :-----------------------------------: | :-------: | +| Detect unfixed vulnerabilities | - | +| [Dependency graph][dependency-graph] | ✓ | + +## SBOM +Same as [Alpine Linux](alpine.md#sbom). + +## Vulnerability +Chainguard offers its own security advisories, and these are utilized when scanning Chainguard for vulnerabilities. +Everything else is the same as [Alpine Linux](alpine.md#vulnerability). + +### Data Source +See [here](../../scanner/vulnerability.md#data-sources). + +## License +Same as [Alpine Linux](alpine.md#license). + + +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies +[secdb]: https://packages.cgr.dev/chainguard/security.json \ No newline at end of file diff --git a/docs/docs/coverage/os/debian.md b/docs/docs/coverage/os/debian.md new file mode 100644 index 00000000000..a5e28e01e63 --- /dev/null +++ b/docs/docs/coverage/os/debian.md @@ -0,0 +1,74 @@ +# Debian +Trivy supports the following scanners for OS packages. + +| Scanner | Supported | +| :-----------: | :-------: | +| SBOM | ✓ | +| Vulnerability | ✓ | +| License | ✓ | + +Please see [here](index.md#supported-os) for supported versions. + +The table below outlines the features offered by Trivy. + +| Feature | Supported | +| :-----------------------------------: | :-------: | +| Unfixed vulnerabilities | ✓ | +| [Dependency graph][dependency-graph] | ✓ | + +## SBOM +Trivy detects packages that have been installed through package managers such as `apt` and `dpkg`. +While there are some exceptions, like Go binaries and JAR files, it's important to note that binaries that have been custom-built using `make` or tools installed via `curl` are generally not detected. + +## Vulnerability +Debian offers its own security advisories, and these are utilized when scanning Debian for vulnerabilities. + +### Data Source +See [here](../../scanner/vulnerability.md#data-sources). + +### Fixed Version +When looking at fixed versions, it's crucial to consider the patches supplied by Debian. +For example, for CVE-2023-3269, the fixed version for Debian 12 (bookworm) is listed as `6.1.37-1` in [the Security Tracker][CVE-2023-3269]. +This patch is provided in [DSA-5448-1]. +Note that this is different from the upstream fixed version, which is `6.5`. +Typically, only the upstream information gets listed on [NVD], so it's important not to get confused. + +### Severity +Trivy calculates the severity of an issue based on the 'Urgency' metric found in the Security Tracker. +If 'Urgency' isn't provided by Debian, the severity from the NVD is taken into account. + +Using CVE-2019-15052 as an example, while it is rated as "Critical" in NVD, Debian has marked its "Urgency" as ["Low"][CVE-2019-15052]. +As a result, Trivy will display it as "Low". + +### Status +Trivy supports the following [vulnerability statuses] for Debian. + +| Status | Supported | +| :-----------------: | :-------: | +| Fixed | ✓ | +| Affected | ✓ | +| Under Investigation | | +| Will Not Fix | | +| Fix Deferred | ✓ | +| End of Life | ✓ | + +## License +To identify the license of a package, Trivy checks the copyright file located at `/usr/share/doc/*/copyright`. + +However, this method has its limitations as the file isn't machine-readable, leading to situations where the license isn't detected. +In such scenarios, the `--license-full` flag can be passed. +It compares the contents of known licenses with the copyright file to discern the license in question. +Please be aware that using this flag can increase memory usage, so it's disabled by default for efficiency. + + +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies + +[debian-tracker]: https://security-tracker.debian.org/tracker/ +[debian-oval]: https://www.debian.org/security/oval/ + +[CVE-2023-3269]: https://security-tracker.debian.org/tracker/CVE-2023-3269 +[CVE-2019-15052]: https://security-tracker.debian.org/tracker/CVE-2019-15052 +[DSA-5448-1]: https://security-tracker.debian.org/tracker/DSA-5448-1 +[NVD]: https://nvd.nist.gov/vuln/detail/CVE-2023-3269 + +[vulnerability statuses]: ../../configuration/filtering.md#by-status \ No newline at end of file diff --git a/docs/docs/coverage/os/google-distroless.md b/docs/docs/coverage/os/google-distroless.md new file mode 100644 index 00000000000..cfe5dd3f4e2 --- /dev/null +++ b/docs/docs/coverage/os/google-distroless.md @@ -0,0 +1,34 @@ +# Google Distroless +Trivy supports the following scanners for OS packages. + +| Scanner | Supported | +| :-----------: | :-------: | +| SBOM | ✓ | +| Vulnerability | ✓ | +| License | ✓ | + +Please see [here](index.md#supported-os) for supported versions. + +The table below outlines the features offered by Trivy. + +| Feature | Supported | +| :----------------------------------: | :-------: | +| Unfixed vulnerabilities | - | +| [Dependency graph][dependency-graph] | ✓ | + +## SBOM +Trivy detects packages pre-installed in distroless images. + +## Vulnerability +Google Distroless is based on [Debian]; see there for details. + +## License +Google Distroless is based on [Debian]; see there for details. + +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies + +[metadata]: https://packages.vmware.com/photon/photon_cve_metadata/ + +[vulnerability statuses]: ../../configuration/filtering.md#by-status + +[Debian]: debian.md \ No newline at end of file diff --git a/docs/docs/coverage/os/index.md b/docs/docs/coverage/os/index.md new file mode 100644 index 00000000000..825f7ba1b35 --- /dev/null +++ b/docs/docs/coverage/os/index.md @@ -0,0 +1,39 @@ +# OS + +## Scanner +Trivy supports operating systems for + +- [SBOM][sbom] +- [Vulnerabilities][vuln] +- [Licenses][license] + +## Supported OS + +| OS | Supported Versions | Package Managers | +|-----------------------------------------------|-------------------------------------|------------------| +| [Alpine Linux](alpine.md) | 2.2 - 2.7, 3.0 - 3.18, edge | apk | +| [Wolfi Linux](wolfi.md) | (n/a) | apk | +| [Chainguard](chainguard.md) | (n/a) | apk | +| [Red Hat Enterprise Linux](rhel.md) | 6, 7, 8 | dnf/yum/rpm | +| [CentOS](centos.md)[^1] | 6, 7, 8 | dnf/yum/rpm | +| [AlmaLinux](alma.md) | 8, 9 | dnf/yum/rpm | +| [Rocky Linux](rocky.md) | 8, 9 | dnf/yum/rpm | +| [Oracle Linux](oracle.md) | 5, 6, 7, 8 | dnf/yum/rpm | +| [CBL-Mariner](cbl-mariner.md) | 1.0, 2.0 | dnf/yum/rpm | +| [Amazon Linux](amazon.md) | 1, 2, 2023 | dnf/yum/rpm | +| [openSUSE Leap](suse.md) | 42, 15 | zypper/rpm | +| [SUSE Enterprise Linux](suse.md) | 11, 12, 15 | zypper/rpm | +| [Photon OS](photon.md) | 1.0, 2.0, 3.0, 4.0 | tndf/yum/rpm | +| [Debian GNU/Linux](debian.md) | 7, 8, 9, 10, 11, 12 | apt/dpkg | +| [Ubuntu](ubuntu.md) | All versions supported by Canonical | apt/dpkg | +| [Google Distroless](google-distroless.md)[^2] | Any | apt/dpkg | + +Each page gives more details. + +[^1]: CentOS Stream is not supported +[^2]: https://github.com/GoogleContainerTools/distroless + + +[sbom]: ../../supply-chain/sbom.md +[vuln]: ../../scanner/vulnerability.md +[license]: ../../scanner/license.md \ No newline at end of file diff --git a/docs/docs/coverage/os/oracle.md b/docs/docs/coverage/os/oracle.md new file mode 100644 index 00000000000..3799918b9a3 --- /dev/null +++ b/docs/docs/coverage/os/oracle.md @@ -0,0 +1,70 @@ +# Oracle Linux +Trivy supports the following scanners for OS packages. + +| Scanner | Supported | +| :-----------: | :-------: | +| SBOM | ✓ | +| Vulnerability | ✓ | +| License | ✓ | + +Please see [here](index.md#supported-os) for supported versions. + +The table below outlines the features offered by Trivy. + +| Feature | Supported | +| :-----------------------------------: | :-------: | +| Unfixed vulnerabilities | - | +| [Dependency graph][dependency-graph] | ✓ | + +## SBOM +Trivy detects packages that have been installed through package managers such as `dnf` and `yum`. + +## Vulnerability +Oracle Linux offers its own security advisories, and these are utilized when scanning Oracle Linux for vulnerabilities. + +### Data Source +See [here](../../scanner/vulnerability.md#data-sources). + +### Fixed Version +Trivy takes fixed versions from [Oracle security advisories][alerts]. + +### Severity +Trivy determines vulnerability severity based on the severity metric provided in [Oracle security advisories][alerts]. +For example, the security patch for [CVE-2023-0464][CVE-2023-0464] is provided as [ELSA-2023-2645][ELSA-2023-2645]. +Its severity is rated as "MODERATE". +Thus, even though it's evaluated as "HIGH" in the NVD, Trivy displays it with a severity of "MEDIUM". + +The table below is the mapping of Oracle's threat to Trivy's severity levels. + +| Oracle | Trivy | +| :-------: | :------: | +| Low | Low | +| Moderate | Medium | +| Important | High | +| Critical | Critical | + +### Status +Trivy supports the following [vulnerability statuses] for Oracle Linux. + +| Status | Supported | +| :-----------------: | :-------: | +| Fixed | ✓ | +| Affected | ✓ | +| Under Investigation | | +| Will Not Fix | | +| Fix Deferred | | +| End of Life | | + +## License +Trivy identifies licenses by examining the metadata of RPM packages. + +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies + +[oval]: https://linux.oracle.com/security/oval/ +[alerts]: https://www.oracle.com/security-alerts/ + +[CVE-2023-0464]: https://linux.oracle.com/cve/CVE-2023-0464.html +[ELSA-2023-2645]: https://linux.oracle.com/errata/ELSA-2023-2645.html +[NVD]: https://nvd.nist.gov/vuln/detail/CVE-2023-0464 + +[vulnerability statuses]: ../../configuration/filtering.md#by-status \ No newline at end of file diff --git a/docs/docs/coverage/os/photon.md b/docs/docs/coverage/os/photon.md new file mode 100644 index 00000000000..532dbc16924 --- /dev/null +++ b/docs/docs/coverage/os/photon.md @@ -0,0 +1,54 @@ +# Photon OS +Trivy supports the following scanners for OS packages. + +| Scanner | Supported | +| :-----------: | :-------: | +| SBOM | ✓ | +| Vulnerability | ✓ | +| License | ✓ | + +Please see [here](index.md#supported-os) for supported versions. + +The table below outlines the features offered by Trivy. + +| Feature | Supported | +|:------------------------------------:|:---------:| +| Unfixed vulnerabilities | - | +| [Dependency graph][dependency-graph] | ✓ | + +## SBOM +Trivy detects packages that have been installed through package managers such as `tdnf` and `yum`. + +## Vulnerability +Photon OS offers its own security advisories, and these are utilized when scanning Photon OS for vulnerabilities. + +### Data Source +See [here](../../scanner/vulnerability.md#data-sources). + +### Fixed Version +Trivy takes fixed versions from [Photon CVE metadata][metadata]. + +### Severity +Trivy determines the severity of vulnerabilities based on the CVSSv3 score provided by Photon OS. +See [here](../../scanner/vulnerability.md#severity-selection) for the conversion table from CVSS score to severity. + +### Status +Trivy supports the following [vulnerability statuses] for Photon OS. + +| Status | Supported | +| :-----------------: | :-------: | +| Fixed | ✓ | +| Affected | ✓ | +| Under Investigation | | +| Will Not Fix | | +| Fix Deferred | | +| End of Life | | + +## License +Trivy identifies licenses by examining the metadata of RPM packages. + +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies + +[metadata]: https://packages.vmware.com/photon/photon_cve_metadata/ + +[vulnerability statuses]: ../../configuration/filtering.md#by-status \ No newline at end of file diff --git a/docs/docs/coverage/os/rhel.md b/docs/docs/coverage/os/rhel.md new file mode 100644 index 00000000000..8300005a496 --- /dev/null +++ b/docs/docs/coverage/os/rhel.md @@ -0,0 +1,84 @@ +# Red Hat Enterprise Linux +Trivy supports the following scanners for OS packages. + +| Scanner | Supported | +| :-----------: | :-------: | +| SBOM | ✓ | +| Vulnerability | ✓ | +| License | ✓ | + +Please see [here](index.md#supported-os) for supported versions. + +The table below outlines the features offered by Trivy. + +| Feature | Supported | +| :----------------------------------: | :-------: | +| Unfixed vulnerabilities | ✓ | +| [Dependency graph][dependency-graph] | ✓ | + +## SBOM +Trivy detects packages that have been installed through package managers such as `dnf` and `yum`. + +## Vulnerability +Red Hat offers its own security advisories, and these are utilized when scanning Red Hat Enterprise Linux (RHEL) for vulnerabilities. + +### Data Source +See [here](../../scanner/vulnerability.md#data-sources). + +### Fixed Version +When looking at fixed versions, it's crucial to consider the patches supplied by Red Hat. +For example, for CVE-2023-0464, the fixed version for RHEL 9 is listed as `3.0.7-16.el9_2` in [their advisory][CVE-2023-0464]. +This patch is provided in [RHSA-2023:3722]. +Note that this is different from the upstream fixed version, which is `3.0.9`, `3.1.1`, and so on. +Typically, only the upstream information gets listed on [NVD], so it's important not to get confused. + +### Severity +Trivy calculates the severity of a vulnerability based on the 'Impact' metric provided by Red Hat. +If the impact is not provided or defined yet by Red Hat, the severity from the NVD is taken into account. + +Using CVE-2023-0464 as an example, while it is rated as "HIGH" in NVD, Red Hat has marked its 'Impact' as ["Low"][CVE-2023-0464]. +As a result, Trivy will display it as "Low". + +The table below is the mapping of Red Hat's impact to Trivy's severity levels. + +| Red Hat | Trivy | +| :-------: | :------: | +| Low | Low | +| Moderate | Medium | +| Important | High | +| Critical | Critical | + +### Status +Trivy supports the following [vulnerability statuses] for RHEL. + +| Status | Supported | +| :-----------------: | :-------: | +| Fixed | ✓ | +| Affected | ✓ | +| Under Investigation | ✓ | +| Will Not Fix | ✓ | +| Fix Deferred | ✓ | +| End of Life | ✓ | + +When a vulnerability status is listed as "End of Life", it means a vulnerability with the impact level assigned to this CVE is no longer covered by its current support lifecycle phase. +The product has been identified to contain the impacted component, but analysis to determine whether it is affected or not by this vulnerability was not performed. +Red Hat advises that the product should be assumed to be affected. +Therefore, Trivy detects vulnerabilities with this status as "End of Life". + +On the other hand, for those marked "Under Investigation," the impact is unclear as they are still being examined, so Trivy does not detect them. Once the investigation is completed, the status should be updated. + +!!! abstract + Vulnerabilities with a status of "End of Life", where the presence or absence of impact is unclear, are detected by Trivy. However, those with a status of "Under Investigation" are not detected. + +## License +Trivy identifies licenses by examining the metadata of RPM packages. + +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies +[oval]: https://www.redhat.com/security/data/oval/v2/ +[api]: https://www.redhat.com/security/data/metrics/ + +[CVE-2023-0464]: https://access.redhat.com/security/cve/cve-2023-0464 +[RHSA-2023:3722]: https://access.redhat.com/errata/RHSA-2023:3722 +[NVD]: https://nvd.nist.gov/vuln/detail/CVE-2023-0464 + +[vulnerability statuses]: ../../configuration/filtering.md#by-status diff --git a/docs/docs/coverage/os/rocky.md b/docs/docs/coverage/os/rocky.md new file mode 100644 index 00000000000..7e6dba7bb14 --- /dev/null +++ b/docs/docs/coverage/os/rocky.md @@ -0,0 +1,70 @@ +# Rocky Linux +Trivy supports the following scanners for OS packages. + +| Scanner | Supported | +| :-----------: | :-------: | +| SBOM | ✓ | +| Vulnerability | ✓ | +| License | ✓ | + +Please see [here](index.md#supported-os) for supported versions. + +The table below outlines the features offered by Trivy. + +| Feature | Supported | +|:------------------------------------:|:---------:| +| Unfixed vulnerabilities | - | +| [Dependency graph][dependency-graph] | ✓ | + +## SBOM +Trivy detects packages that have been installed through package managers such as `dnf` and `yum`. + +## Vulnerability +Rocky Linux offers its own security advisories, and these are utilized when scanning Rocky Linux for vulnerabilities. + +### Data Source +See [here](../../scanner/vulnerability.md#data-sources). + +### Fixed Version +Trivy takes fixed versions from [Rocky Linux Errata][errata], not NVD or somewhere else. +See [here](../../scanner/vulnerability.md#data-source-selection) for more details. + +!!! architectures + There are cases when the vulnerability affects packages of not all architectures. + For example, vulnerable packages for [CVE-2023-0361](https://errata.rockylinux.org/RLSA-2023:1141) are only `aarch64` packages. + + Trivy only detects vulnerabilities for packages of your architecture. + +### Severity +Trivy calculates the severity of an issue based on the severity provided in [Rocky Linux Errata][errata]. + +The table below is the mapping of Rocky Linux's severity to Trivy's severity levels. + +| Rocky Linux | Trivy | +| :---------: | :------: | +| Low | Low | +| Moderate | Medium | +| Important | High | +| Critical | Critical | + +### Status +Trivy supports the following [vulnerability statuses] for Rocky Linux. + +| Status | Supported | +| :-----------------: | :-------: | +| Fixed | ✓ | +| Affected | ✓ | +| Under Investigation | | +| Will Not Fix | | +| Fix Deferred | | +| End of Life | | + + +## License +Trivy identifies licenses by examining the metadata of RPM packages. + +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies +[updateinfo]: https://download.rockylinux.org/pub/rocky/ +[errata]: https://errata.rockylinux.org/ + +[vulnerability statuses]: ../../configuration/filtering.md#by-status \ No newline at end of file diff --git a/docs/docs/coverage/os/suse.md b/docs/docs/coverage/os/suse.md new file mode 100644 index 00000000000..6ff52de31c8 --- /dev/null +++ b/docs/docs/coverage/os/suse.md @@ -0,0 +1,40 @@ +# SUSE +Trivy supports the following distributions: + +- openSUSE Leap +- SUSE Enterprise Linux (SLE) + +Please see [here](index.md#supported-os) for supported versions. + +Trivy supports these scanners for OS packages. + +| Scanner | Supported | +| :-----------: | :-------: | +| SBOM | ✓ | +| Vulnerability | ✓ | +| License | ✓ | + +The table below outlines the features offered by Trivy. + +| Feature | Supported | +|:------------------------------------:|:---------:| +| Unfixed vulnerabilities | - | +| [Dependency graph][dependency-graph] | ✓ | + +## SBOM +Trivy detects packages that have been installed through package managers such as `dnf` and `yum`. + +## Vulnerability +SUSE offers its [own security advisories][cvrf], and these are utilized when scanning openSUSE/SLE for vulnerabilities. + +### Data Source +See [here](../../scanner/vulnerability.md#data-sources). + +## License +Trivy identifies licenses by examining the metadata of RPM packages. + + +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies +[cvrf]: http://ftp.suse.com/pub/projects/security/cvrf/ + +[vulnerability statuses]: ../../configuration/filtering.md#by-status \ No newline at end of file diff --git a/docs/docs/coverage/os/ubuntu.md b/docs/docs/coverage/os/ubuntu.md new file mode 100644 index 00000000000..c922c988c63 --- /dev/null +++ b/docs/docs/coverage/os/ubuntu.md @@ -0,0 +1,65 @@ +# Ubuntu +Trivy supports these scanners for OS packages. + +| Scanner | Supported | +| :-----------: | :-------: | +| SBOM | ✓ | +| Vulnerability | ✓ | +| License | ✓ | + +Please see [here](index.md#supported-os) for supported versions. + +The following table provides an outline of the features Trivy offers. + +| Feature | Supported | +|:------------------------------------:|:---------:| +| Detect unfixed vulnerabilities | ✓ | +| [Dependency graph][dependency-graph] | ✓ | + +## SBOM +Same as [Debian](debian.md#sbom). + +## Vulnerability +Ubuntu offers its own security advisories, and these are utilized when scanning Ubuntu for vulnerabilities. + +### Data Source +See [here](../../scanner/vulnerability.md#data-sources). + +### Fixed Version +When looking at fixed versions, it's crucial to consider the patches supplied by Ubuntu. +As an illustration, for CVE-2023-3269, the fixed version for Ubuntu 23.04 (lunar) is listed as `6.2.0-26.26` in [the Security Tracker][CVE-2023-3269]. +It's essential to recognize that this differs from the upstream fixed version, which stands at `6.5`. +Typically, only the upstream information gets listed on [NVD][CVE-2023-3269 NVD], so it's important not to get confused. + +### Severity +Trivy calculates the severity of an issue based on the 'Priority' metric found in the Security Tracker. +If 'Priority' isn't provided by Ubuntu, the severity from the NVD is taken into account. + +Using CVE-2019-15052 as an example, while it is rated as ["Critical" in NVD][CVE-2019-15052 NVD], Ubuntu has marked its "Priority" as ["Medium"][CVE-2019-15052]. +As a result, Trivy will display it as "Medium". + +### Status +Trivy supports the following [vulnerability statuses] for Ubuntu. + +| Status | Supported | +| :-----------------: | :-------: | +| Fixed | ✓ | +| Affected | ✓ | +| Under Investigation | | +| Will Not Fix | | +| Fix Deferred | | +| End of Life | | + +## License +Same as [Debian](debian.md#license). + + +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies +[Ubuntu CVE Tracker]: https://ubuntu.com/security/cve + +[CVE-2023-3269]: https://ubuntu.com/security/CVE-2023-3269 +[CVE-2019-15052]: https://ubuntu.com/security/CVE-2019-15052 +[CVE-2023-3269 NVD]: https://nvd.nist.gov/vuln/detail/CVE-2023-3269 +[CVE-2019-15052 NVD]: https://nvd.nist.gov/vuln/detail/CVE-2019-15052 + +[vulnerability statuses]: ../../configuration/filtering.md#by-status \ No newline at end of file diff --git a/docs/docs/coverage/os/wolfi.md b/docs/docs/coverage/os/wolfi.md new file mode 100644 index 00000000000..9099e89add8 --- /dev/null +++ b/docs/docs/coverage/os/wolfi.md @@ -0,0 +1,31 @@ +# Wolfi Linux +Trivy supports these scanners for OS packages. + +| Scanner | Supported | +| :-----------: | :-------: | +| SBOM | ✓ | +| Vulnerability | ✓ | +| License | ✓ | + +The table below outlines the features offered by Trivy. + +| Feature | Supported | +|:------------------------------------:|:---------:| +| Detect unfixed vulnerabilities | - | +| [Dependency graph][dependency-graph] | ✓ | + +## SBOM +Same as [Alpine Linux](alpine.md#sbom). + +## Vulnerability +Wolfi Linux offers its own security advisories, and these are utilized when scanning Wolfi for vulnerabilities. +Everything else is the same as [Alpine Linux](alpine.md#vulnerability). + +### Data Source +See [here](../../scanner/vulnerability.md#data-sources). + +## License +Same as [Alpine Linux](alpine.md#license). + +[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies +[secdb]: https://packages.wolfi.dev/os/security.json \ No newline at end of file diff --git a/docs/docs/scanner/license.md b/docs/docs/scanner/license.md index d01324a903d..dad48796548 100644 --- a/docs/docs/scanner/license.md +++ b/docs/docs/scanner/license.md @@ -17,6 +17,8 @@ License are classified using the [Google License Classification][google-license- As those licenses may be in violation, it is recommended to check those unknown licenses as well. By default, Trivy scans licenses for packages installed by `apk`, `apt-get`, `dnf`, `npm`, `pip`, `gem`, etc. +Check out [the coverage document][coverage] for details. + To enable extended license scanning, you can use `--license-full`. In addition to package licenses, Trivy scans source code files, Markdown documents, text files and `LICENSE` documents to identify license usage within the image or filesystem. @@ -29,14 +31,14 @@ To configure the confidence level, you can use `--license-confidence-level`. Thi Currently, the standard license scanning doesn't support filesystem and repository scanning. | License scanning | Image | Rootfs | Filesystem | Repository | -|:---------------------:|:-----:|:------:|:----------:|:----------:| +| :-------------------: | :---: | :----: | :--------: | :--------: | | Standard | ✅ | ✅ | - | - | | Full (--license-full) | ✅ | ✅ | ✅ | ✅ | License checking classifies the identified licenses and map the classification to severity. | Classification | Severity | -|----------------|----------| +| -------------- | -------- | | Forbidden | CRITICAL | | Restricted | HIGH | | Reciprocal | MEDIUM | @@ -343,4 +345,5 @@ license: ``` +[coverage]: ../coverage/index.md [google-license-classification]: https://opensource.google/documentation/reference/thirdparty/licenses diff --git a/docs/docs/scanner/misconfiguration/custom/index.md b/docs/docs/scanner/misconfiguration/custom/index.md index 4d49e92bd9d..2316668f2ec 100644 --- a/docs/docs/scanner/misconfiguration/custom/index.md +++ b/docs/docs/scanner/misconfiguration/custom/index.md @@ -14,7 +14,7 @@ As for `--namespaces` option, the detail is described as below. If a file name matches the following file patterns, Trivy will parse the file and pass it as input to your Rego policy. | File format | File pattern | -|---------------|-----------------------------------------------------------| +| ------------- | --------------------------------------------------------- | | JSON | `*.json` | | YAML | `*.yaml` and `*.yml` | | Dockerfile | `Dockerfile`, `Dockerfile.*`, and `*.Dockerfile` | @@ -125,14 +125,14 @@ schema that will be used is based on the input document type. It is recommended correct and do not reference incorrect properties/values. | Field name | Allowed values | Default value | In table | In JSON | -|----------------------------|-------------------------------------------------------------------|:----------------------------:|:----------------:|:----------------:| +| -------------------------- | ----------------------------------------------------------------- | :--------------------------: | :--------------: | :--------------: | | title | Any characters | N/A | :material-check: | :material-check: | | description | Any characters | | :material-close: | :material-check: | | schemas.input | `schema["kubernetes"]`, `schema["dockerfile"]`, `schema["cloud"]` | (applied to all input types) | :material-close: | :material-close: | | custom.id | Any characters | N/A | :material-check: | :material-check: | | custom.severity | `LOW`, `MEDIUM`, `HIGH`, `CRITICAL` | UNKNOWN | :material-check: | :material-check: | -| custom.recommended_actions | Any characters | | :material-close: | :material-check: | -| custom.input.selector.type | Any item(s) in [this list][source-types] | | :material-close: | :material-check: | +| custom.recommended_actions | Any characters | | :material-close: | :material-check: | +| custom.input.selector.type | Any item(s) in [this list][source-types] | | :material-close: | :material-check: | | url | Any characters | | :material-close: | :material-check: | @@ -178,6 +178,7 @@ You can specify input format via the `custom.input` annotation. Even if a Dockerfile exists in the specified directory, it will not be passed to the policy as input. Possible values for input types are: + - `dockerfile` (Dockerfile) - `kubernetes` (Kubernetes YAML/JSON) - `rbac` (Kubernetes RBAC YAML/JSON) diff --git a/docs/docs/scanner/misconfiguration/index.md b/docs/docs/scanner/misconfiguration/index.md index a7780e08fe7..9371f6f6502 100644 --- a/docs/docs/scanner/misconfiguration/index.md +++ b/docs/docs/scanner/misconfiguration/index.md @@ -349,55 +349,4 @@ This can be repeated for specifying multiple packages. trivy conf --policy ./policy --namespaces main --namespaces user ./configs ``` -### Terraform value overrides -You can pass `tf-vars` files to Trivy to override default values found in the Terraform HCL code. - -```bash -trivy conf --tf-vars dev.terraform.tfvars ./infrastructure/tf -``` - -### Exclude downloaded Terraform modules -You can remove results for downloaded modules in `.terraform` folder. -```bash -trivy conf --tf-exclude-downloaded-modules ./configs -``` - -### Helm value overrides -There are a number of options for overriding values in Helm charts. When override values are passed to the Helm scanner, the values will be used during the Manifest rendering process and will become part of the scanned artifact. - -#### Setting inline value overrides -Overrides can be set inline on the command line - -```bash -trivy conf --helm-set securityContext.runAsUser=0 ./charts/mySql -``` - -#### Setting value file overrides -Overrides can be in a file that has the key=value set. - -```yaml -# Example override file (overrides.yaml) - -securityContext: - runAsUser: 0 -``` - -```bash -trivy conf --helm-values overrides.yaml ./charts/mySql -``` - -#### Setting value as explicit string -the `--helm-set-string` is the same as `--helm-set` but explicitly retains the value as a string - -```bash -trivy config --helm-set-string name=false ./infrastructure/tf -``` - -#### Setting specific values from files -Specific override values can come from specific files - -```bash -trivy conf --helm-set-file environment=dev.values.yaml ./charts/mySql -``` - [custom]: custom/index.md \ No newline at end of file diff --git a/docs/docs/scanner/misconfiguration/policy/builtin.md b/docs/docs/scanner/misconfiguration/policy/builtin.md index bf099fb350d..5bca22d8b68 100644 --- a/docs/docs/scanner/misconfiguration/policy/builtin.md +++ b/docs/docs/scanner/misconfiguration/policy/builtin.md @@ -1,23 +1,12 @@ # Built-in Policies ## Policy Sources - Built-in policies are mainly written in [Rego][rego] and Go. Those policies are managed under [defsec repository][defsec]. - -| Config type | Source | -|---------------------------|----------------------| -| Kubernetes | [defsec][kubernetes] | -| Dockerfile, Containerfile | [defsec][docker] | -| Terraform | [defsec][defsec] | -| CloudFormation | [defsec][defsec] | -| Azure ARM Template | [defsec][defsec] | -| Helm Chart | [defsec][kubernetes] | +See [here](../../../coverage/iac/index.md) for the list of supported config types. For suggestions or issues regarding policy content, please open an issue under the [defsec][defsec] repository. -Helm Chart scanning will resolve the chart to Kubernetes manifests then run the [kubernetes][kubernetes] checks. - ## Policy Distribution defsec policies are distributed as an OPA bundle on [GitHub Container Registry][ghcr] (GHCR). When misconfiguration detection is enabled, Trivy pulls the OPA bundle from GHCR as an OCI artifact and stores it in the cache. @@ -28,7 +17,8 @@ If Trivy is unable to pull down newer policies, it will use the embedded set of Trivy checks for updates to OPA bundle on GHCR every 24 hours and pulls it if there are any updates. [rego]: https://www.openpolicyagent.org/docs/latest/policy-language/ + +[kubernetes-policies]: https://github.com/aquasecurity/defsec/tree/master/rules/kubernetes/policies +[docker-policies]: https://github.com/aquasecurity/defsec/tree/master/rules/docker/policies [defsec]: https://github.com/aquasecurity/defsec -[kubernetes]: https://github.com/aquasecurity/defsec/tree/master/rules/kubernetes/policies -[docker]: https://github.com/aquasecurity/defsec/tree/master/rules/docker/policies -[ghcr]: https://github.com/aquasecurity/defsec/pkgs/container/defsec +[ghcr]: https://github.com/aquasecurity/defsec/pkgs/container/defsec \ No newline at end of file diff --git a/docs/docs/scanner/vulnerability.md b/docs/docs/scanner/vulnerability.md new file mode 100644 index 00000000000..820be63d475 --- /dev/null +++ b/docs/docs/scanner/vulnerability.md @@ -0,0 +1,180 @@ +# Vulnerability Scanning +Trivy detects known vulnerabilities according to the versions of installed packages. + +The following packages are supported. + +- [OS packages](#os-packages) +- [Language-specific packages](#language-specific-packages) + +## OS Packages +Trivy is capable of automatically detecting installed OS packages when scanning container images, VM images and running hosts. + +!!! note + Trivy doesn't support third-party/self-compiled packages/binaries, but official packages provided by vendors such as Red Hat and Debian. + +### Supported OS +See [here](../coverage/os/index.md#supported-os) for the supported OSes. + +### Data Sources + +| OS | Source | +| ------------- | ------------------------------------------------------------ | +| Arch Linux | [Vulnerable Issues][arch] | +| Alpine Linux | [secdb][alpine] | +| Wolfi Linux | [secdb][wolfi] | +| Chainguard | [secdb][chainguard] | +| Amazon Linux | [Amazon Linux Security Center][amazon] | +| Debian | [Security Bug Tracker][debian-tracker] / [OVAL][debian-oval] | +| Ubuntu | [Ubuntu CVE Tracker][ubuntu] | +| RHEL/CentOS | [OVAL][rhel-oval] / [Security Data][rhel-api] | +| AlmaLinux | [AlmaLinux Product Errata][alma] | +| Rocky Linux | [Rocky Linux UpdateInfo][rocky] | +| Oracle Linux | [OVAL][oracle] | +| CBL-Mariner | [OVAL][mariner] | +| OpenSUSE/SLES | [CVRF][suse] | +| Photon OS | [Photon Security Advisory][photon] | + +#### Data Source Selection +Trivy **only** consumes security advisories from the sources listed in the above table. + +As for packages installed from OS package managers (`dpkg`, `yum`, `apk`, etc.), Trivy uses the advisory database from the appropriate **OS vendor**. + +For example: for a python package installed from `yum` (Amazon linux), Trivy will only get advisories from [ALAS][amazon]. +But for a python package installed from another source (e.g. `pip`), Trivy will get advisories from the `GitLab` and `GitHub` databases. + +This advisory selection is essential to avoid getting false positives because OS vendors usually backport upstream fixes, and the fixed version can be different from the upstream fixed version. + +#### Severity Selection +The severity is taken from the selected data source since the severity from vendors is more accurate. +Using CVE-2023-0464 as an example, while it is [rated as "HIGH" in NVD][nvd-CVE-2023-0464], Red Hat has marked its 'Impact' as ["Low"][redhat-CVE-2023-0464]. +As a result, Trivy will display it as "Low". + +The severity depends on the compile option, the default configuration, etc. +NVD doesn't know how the vendor distributes the software. +Red Hat evaluates the severity more accurately. +That's why Trivy prefers vendor scores over NVD. + +If the data source does not provide a severity, the severity is determined based on the CVSS score as follows: + +| Base Score Range | Severity | +| ---------------- | -------- | +| 0.1-3.9 | Low | +| 4.0-6.9 | Medium | +| 7.0-8.9 | High | +| 9.0-10.0 | Critical | + +If the CVSS score is also not provided, it falls back to [NVD][nvd], and if NVD does not have severity, it will be UNKNOWN. + +### Unfixed Vulnerabilities +The unfixed/unfixable vulnerabilities mean that the patch has not yet been provided on their distribution. +To hide unfixed/unfixable vulnerabilities, you can use the `--ignore-unfixed` flag. + +## Language-specific Packages + +### Supported Languages +See [here](../coverage/language/index.md#supported-languages) for the supported languages. + +### Data Sources + +| Language | Source | Commercial Use | Delay[^1] | +| -------- | --------------------------------------------------- | :------------: | :-------: | +| PHP | [PHP Security Advisories Database][php] | ✅ | - | +| | [GitHub Advisory Database (Composer)][php-ghsa] | ✅ | - | +| Python | [GitHub Advisory Database (pip)][python-ghsa] | ✅ | - | +| | [Open Source Vulnerabilities (PyPI)][python-osv] | ✅ | - | +| Ruby | [Ruby Advisory Database][ruby] | ✅ | - | +| | [GitHub Advisory Database (RubyGems)][ruby-ghsa] | ✅ | - | +| Node.js | [Ecosystem Security Working Group][nodejs] | ✅ | - | +| | [GitHub Advisory Database (npm)][nodejs-ghsa] | ✅ | - | +| Java | [GitLab Advisories Community][gitlab] | ✅ | 1 month | +| | [GitHub Advisory Database (Maven)][java-ghsa] | ✅ | - | +| Go | [GitHub Advisory Database (Go)][go-ghsa] | ✅ | - | +| Rust | [Open Source Vulnerabilities (crates.io)][rust-osv] | ✅ | - | +| .NET | [GitHub Advisory Database (NuGet)][dotnet-ghsa] | ✅ | - | +| C/C++ | [GitLab Advisories Community][gitlab] | ✅ | 1 month | +| Dart | [GitHub Advisory Database (Pub)][pub-ghsa] | ✅ | - | +| Elixir | [GitHub Advisory Database (Erlang)][erlang-ghsa] | ✅ | | + +[^1]: Intentional delay between vulnerability disclosure and registration in the DB + +## Database +Trivy downloads [the vulnerabillity database](https://github.com/aquasecurity/trivy-db) every 6 hours. +Trivy uses two types of databases for vulnerability detection: + +- Vulnerability Database +- Java Index Database + +This page provides detailed information about these databases. + +### Vulnerability Database +Trivy utilizes a database containing vulnerability information. +This database is built every six hours on [GitHub](https://github.com/aquasecurity/trivy-db) and is distributed via [GitHub Container registry (GHCR)](https://ghcr.io/aquasecurity/trivy-db). +The database is cached and updated as needed. +As Trivy updates the database automatically during execution, users don't need to be concerned about it. + +For CLI flags related to the database, please refer to [this page](../configuration/db.md). + +#### Private Hosting +If you host the database on your own OCI registry, you can specify a different repository with the `--db-repository` flag. +The default is `ghcr.io/aquasecurity/trivy-db`. + +```shell +$ trivy image --db-repository YOUR_REPO YOUR_IMAGE +``` + +If authentication is required, it can be configured in the same way as for private images. +Please refer to [the documentation](../advanced/private-registries/index.md) for more details. + +### Java Index Database +This database is only downloaded when scanning JAR files so that Trivy can identify the groupId, artifactId, and version of JAR files. +It is built once a day on [GitHub](https://github.com/aquasecurity/trivy-java-db) and distributed via [GitHub Container registry (GHCR)](https://ghcr.io/aquasecurity/trivy-java-db). +Like the vulnerability database, it is automatically downloaded and updated when needed, so users don't need to worry about it. + +#### Private Hosting +If you host the database on your own OCI registry, you can specify a different repository with the `--java-db-repository` flag. +The default is `ghcr.io/aquasecurity/trivy-java-db`. + +If authentication is required, you need to run `docker login YOUR_REGISTRY`. +Currently, specifying a username and password is not supported. + +[^1]: https://github.com/GoogleContainerTools/distroless + +[nvd-CVE-2023-0464]: https://nvd.nist.gov/vuln/detail/CVE-2023-0464 +[redhat-CVE-2023-0464]: https://access.redhat.com/security/cve/cve-2023-0464 + +[arch]: https://security.archlinux.org/ +[alpine]: https://secdb.alpinelinux.org/ +[wolfi]: https://packages.wolfi.dev/os/security.json +[chainguard]: https://packages.cgr.dev/chainguard/security.json +[amazon]: https://alas.aws.amazon.com/ +[debian-tracker]: https://security-tracker.debian.org/tracker/ +[debian-oval]: https://www.debian.org/security/oval/ +[ubuntu]: https://ubuntu.com/security/cve +[rhel-oval]: https://www.redhat.com/security/data/oval/v2/ +[rhel-api]: https://www.redhat.com/security/data/metrics/ +[alma]: https://errata.almalinux.org/ +[rocky]: https://download.rockylinux.org/pub/rocky/ +[oracle]: https://linux.oracle.com/security/oval/ +[suse]: http://ftp.suse.com/pub/projects/security/cvrf/ +[photon]: https://packages.vmware.com/photon/photon_cve_metadata/ +[mariner]: https://github.com/microsoft/CBL-MarinerVulnerabilityData/ + +[php-ghsa]: https://github.com/advisories?query=ecosystem%3Acomposer +[python-ghsa]: https://github.com/advisories?query=ecosystem%3Apip +[ruby-ghsa]: https://github.com/advisories?query=ecosystem%3Arubygems +[nodejs-ghsa]: https://github.com/advisories?query=ecosystem%3Anpm +[java-ghsa]: https://github.com/advisories?query=ecosystem%3Amaven +[dotnet-ghsa]: https://github.com/advisories?query=ecosystem%3Anuget +[pub-ghsa]: https://github.com/advisories?query=ecosystem%3Apub +[erlang-ghsa]: https://github.com/advisories?query=ecosystem%3Aerlang +[go-ghsa]: https://github.com/advisories?query=ecosystem%3Ago + +[php]: https://github.com/FriendsOfPHP/security-advisories +[ruby]: https://github.com/rubysec/ruby-advisory-db +[nodejs]: https://github.com/nodejs/security-wg +[gitlab]: https://gitlab.com/gitlab-org/advisories-community + +[python-osv]: https://osv.dev/list?q=&ecosystem=PyPI +[rust-osv]: https://osv.dev/list?q=&ecosystem=crates.io + +[nvd]: https://nvd.nist.gov/vuln \ No newline at end of file diff --git a/docs/docs/scanner/vulnerability/index.md b/docs/docs/scanner/vulnerability/index.md deleted file mode 100644 index 2b48fcda1f1..00000000000 --- a/docs/docs/scanner/vulnerability/index.md +++ /dev/null @@ -1,51 +0,0 @@ -# Vulnerability Scanning - -## Overview -This section describes the overview of vulnerability scanning. -Trivy detects known vulnerabilities according to the versions of installed packages. - -The following packages are supported. - -- [OS packages](os.md) -- [Language-specific packages](language/index.md) - -Trivy downloads [the vulnerabillity database](https://github.com/aquasecurity/trivy-db) every 6 hours. - -## Database -Trivy uses two types of databases for vulnerability detection: - -- Vulnerability Database -- Java Index Database - -This page provides detailed information about these databases. - -### Vulnerability Database -Trivy utilizes a database containing vulnerability information. -This database is built every six hours on [GitHub](https://github.com/aquasecurity/trivy-db) and is distributed via [GitHub Container registry (GHCR)](https://ghcr.io/aquasecurity/trivy-db). -The database is cached and updated as needed. -As Trivy updates the database automatically during execution, users don't need to be concerned about it. - -For CLI flags related to the database, please refer to [this page](../../configuration/db.md). - -#### Private Hosting -If you host the database on your own OCI registry, you can specify a different repository with the `--db-repository` flag. -The default is `ghcr.io/aquasecurity/trivy-db`. - -```shell -$ trivy image --db-repository YOUR_REPO YOUR_IMAGE -``` - -If authentication is required, it can be configured in the same way as for private images. -Please refer to [the documentation](../../advanced/private-registries/index.md) for more details. - -### Java Index Database -This database is only downloaded when scanning JAR files so that Trivy can identify the groupId, artifactId, and version of JAR files. -It is built once a day on [GitHub](https://github.com/aquasecurity/trivy-java-db) and distributed via [GitHub Container registry (GHCR)](https://ghcr.io/aquasecurity/trivy-java-db). -Like the vulnerability database, it is automatically downloaded and updated when needed, so users don't need to worry about it. - -#### Private Hosting -If you host the database on your own OCI registry, you can specify a different repository with the `--java-db-repository` flag. -The default is `ghcr.io/aquasecurity/trivy-java-db`. - -If authentication is required, you need to run `docker login YOUR_REGISTRY`. -Currently, specifying a username and password is not supported. diff --git a/docs/docs/scanner/vulnerability/language/index.md b/docs/docs/scanner/vulnerability/language/index.md deleted file mode 100644 index cdd83376787..00000000000 --- a/docs/docs/scanner/vulnerability/language/index.md +++ /dev/null @@ -1,92 +0,0 @@ -# Language-specific Packages - -`Trivy` automatically detects the following files and scans vulnerabilities in the application dependencies. - -## Supported languages - -| Language | File | Image[^7] | Rootfs[^8] | Filesystem[^9] | Repository[^10] | Dev dependencies | Dependency location[^11] | -|----------------------|--------------------------------------------------------------------------------------------|:---------:|:----------:|:--------------:|:---------------:|------------------------------|:------------------------:| -| Ruby | Gemfile.lock | - | - | ✅ | ✅ | included | - | -| | gemspec | ✅ | ✅ | - | - | included | - | -| [Python](python.md) | Pipfile.lock | - | - | ✅ | ✅ | excluded | ✅ | -| | poetry.lock | - | - | ✅ | ✅ | excluded | - | -| | requirements.txt | - | - | ✅ | ✅ | included | - | -| | egg package[^1] | ✅ | ✅ | - | - | excluded | - | -| | wheel package[^2] | ✅ | ✅ | - | - | excluded | - | -| [PHP](php.md) | composer.lock | ✅ | ✅ | ✅ | ✅ | excluded | ✅ | -| [Node.js](nodejs.md) | package-lock.json | - | - | ✅ | ✅ | [excluded](./nodejs.md#npm) | ✅ | -| | yarn.lock | - | - | ✅ | ✅ | [excluded](./nodejs.md#yarn) | ✅ | -| | pnpm-lock.yaml | - | - | ✅ | ✅ | excluded | - | -| | package.json | ✅ | ✅ | - | - | excluded | - | -| .NET | packages.lock.json | ✅ | ✅ | ✅ | ✅ | included | ✅ | -| | packages.config | ✅ | ✅ | ✅ | ✅ | excluded | - | -| | .deps.json | ✅ | ✅ | ✅ | ✅ | excluded | ✅ | -| [Java](java.md) | JAR/WAR/PAR/EAR[^3] | ✅ | ✅ | - | - | included | - | -| | pom.xml[^4] | - | - | ✅ | ✅ | excluded | - | -| | *gradle.lockfile | - | - | ✅ | ✅ | excluded | - | -| [Go](golang.md) | Binaries built by Go[^5] | ✅ | ✅ | - | - | excluded | - | -| | go.mod[^6] | - | - | ✅ | ✅ | included | - | -| [Rust](rust.md) | Cargo.lock | ✅ | ✅ | ✅ | ✅ | excluded | ✅ | -| | Binaries built with [cargo-auditable](https://github.com/rust-secure-code/cargo-auditable) | ✅ | ✅ | - | - | excluded | - | -| C/C++ | conan.lock[^12] | - | - | ✅ | ✅ | excluded | ✅ | -| Elixir | mix.lock[^12] | - | - | ✅ | ✅ | excluded | ✅ | -| Dart | pubspec.lock | - | - | ✅ | ✅ | included | - | - -The path of these files does not matter. - -Example: [Dockerfile](https://github.com/aquasecurity/trivy-ci-test/blob/main/Dockerfile) - -[^1]: `*.egg-info`, `*.egg-info/PKG-INFO`, `*.egg` and `EGG-INFO/PKG-INFO` -[^2]: `.dist-info/META-DATA` -[^3]: `*.jar`, `*.war`, `*.par` and `*.ear` -[^4]: It requires Internet access when the POM doesn't exist in your local repository -[^5]: UPX-compressed binaries don't work -[^6]: If smaller than go 1.17, go.sum is also required -[^7]: ✅ means "enabled" and `-` means "disabled" in the image scanning -[^8]: ✅ means "enabled" and `-` means "disabled" in the rootfs scanning -[^9]: ✅ means "enabled" and `-` means "disabled" in the filesystem scanning -[^10]: ✅ means "enabled" and `-` means "disabled" in the git repository scanning -[^11]: ✅ means that Trivy detects line numbers where each dependency is declared in the scanned file. Only supported in [json](../../../configuration/reporting.md#json) and [sarif](../../../configuration/reporting.md#sarif) formats. SARIF uses `startline == 1 and endline == 1` for unsupported file types -[^12]: To scan a filename other than the default filename use [file-patterns](../../../configuration/others.md#file-patterns) -[^13]: When you scan `Cargo.lock` and `Cargo.toml` together. See about it [here](./rust.md#cargo). - -## Data Sources - -| Language | Source | Commercial Use | Delay[^1] | -|----------|-----------------------------------------------------|:--------------:|:---------:| -| PHP | [PHP Security Advisories Database][php] | ✅ | - | -| | [GitHub Advisory Database (Composer)][php-ghsa] | ✅ | - | -| Python | [GitHub Advisory Database (pip)][python-ghsa] | ✅ | - | -| | [Open Source Vulnerabilities (PyPI)][python-osv] | ✅ | - | -| Ruby | [Ruby Advisory Database][ruby] | ✅ | - | -| | [GitHub Advisory Database (RubyGems)][ruby-ghsa] | ✅ | - | -| Node.js | [Ecosystem Security Working Group][nodejs] | ✅ | - | -| | [GitHub Advisory Database (npm)][nodejs-ghsa] | ✅ | - | -| Java | [GitLab Advisories Community][gitlab] | ✅ | 1 month | -| | [GitHub Advisory Database (Maven)][java-ghsa] | ✅ | - | -| Go | [GitHub Advisory Database (Go)][go-ghsa] | ✅ | - | -| Rust | [Open Source Vulnerabilities (crates.io)][rust-osv] | ✅ | - | -| .NET | [GitHub Advisory Database (NuGet)][dotnet-ghsa] | ✅ | - | -| C/C++ | [GitLab Advisories Community][gitlab] | ✅ | 1 month | -| Dart | [GitHub Advisory Database (Pub)][pub-ghsa] | ✅ | - | -| Elixir | [GitHub Advisory Database (Erlang)][erlang-ghsa] | ✅ | | - -[^1]: Intentional delay between vulnerability disclosure and registration in the DB - -[php-ghsa]: https://github.com/advisories?query=ecosystem%3Acomposer -[python-ghsa]: https://github.com/advisories?query=ecosystem%3Apip -[ruby-ghsa]: https://github.com/advisories?query=ecosystem%3Arubygems -[nodejs-ghsa]: https://github.com/advisories?query=ecosystem%3Anpm -[java-ghsa]: https://github.com/advisories?query=ecosystem%3Amaven -[dotnet-ghsa]: https://github.com/advisories?query=ecosystem%3Anuget -[pub-ghsa]: https://github.com/advisories?query=ecosystem%3Apub -[erlang-ghsa]: https://github.com/advisories?query=ecosystem%3Aerlang -[go-ghsa]: https://github.com/advisories?query=ecosystem%3Ago - -[php]: https://github.com/FriendsOfPHP/security-advisories -[ruby]: https://github.com/rubysec/ruby-advisory-db -[nodejs]: https://github.com/nodejs/security-wg -[gitlab]: https://gitlab.com/gitlab-org/advisories-community - -[python-osv]: https://osv.dev/list?q=&ecosystem=PyPI -[rust-osv]: https://osv.dev/list?q=&ecosystem=crates.io \ No newline at end of file diff --git a/docs/docs/scanner/vulnerability/os.md b/docs/docs/scanner/vulnerability/os.md deleted file mode 100644 index de302dde552..00000000000 --- a/docs/docs/scanner/vulnerability/os.md +++ /dev/null @@ -1,136 +0,0 @@ -# OS Packages -Trivy is capable of automatically detecting installed OS packages when scanning container images, VM images and running hosts. -This page provides an overview of OS packages in the context of Trivy scans. - -## Supported OS - -The unfixed/unfixable vulnerabilities mean that the patch has not yet been provided on their distribution. -To hide unfixed/unfixable vulnerabilities, you can use the `--ignore-unfixed` flag. - -Trivy doesn't support self-compiled packages/binaries, but official packages provided by vendors such as Red Hat and Debian. - -| OS | Supported Versions | Target Packages | Detection of unfixed vulnerabilities | -|----------------------------------|-------------------------------------|-------------------------------|:------------------------------------:| -| Alpine Linux | 2.2 - 2.7, 3.0 - 3.18, edge | Installed by apk | NO | -| Wolfi Linux | (n/a) | Installed by apk | NO | -| Chainguard | (n/a) | Installed by apk | NO | -| Red Hat Universal Base Image[^1] | 7, 8, 9 | Installed by yum/rpm | YES | -| Red Hat Enterprise Linux | 6, 7, 8 | Installed by yum/rpm | YES | -| CentOS | 6, 7, 8 | Installed by yum/rpm | YES | -| AlmaLinux | 8, 9 | Installed by yum/rpm | NO | -| Rocky Linux | 8, 9 | Installed by yum/rpm | NO | -| Oracle Linux | 5, 6, 7, 8 | Installed by yum/rpm | NO | -| CBL-Mariner | 1.0, 2.0 | Installed by yum/rpm | YES | -| Amazon Linux | 1, 2, 2023 | Installed by yum/rpm | NO | -| openSUSE Leap | 42, 15 | Installed by zypper/rpm | NO | -| SUSE Enterprise Linux | 11, 12, 15 | Installed by zypper/rpm | NO | -| Photon OS | 1.0, 2.0, 3.0, 4.0 | Installed by tdnf/yum/rpm | NO | -| Debian GNU/Linux | 7, 8, 9, 10, 11, 12 | Installed by apt/apt-get/dpkg | YES | -| Ubuntu | All versions supported by Canonical | Installed by apt/apt-get/dpkg | YES | -| Distroless[^2] | Any | Installed by apt/apt-get/dpkg | YES | - -## Data Sources - -| OS | Source | -|---------------|----------------------------------------| -| Arch Linux | [Vulnerable Issues][arch] | -| Alpine Linux | [secdb][alpine] | -| Wolfi Linux | [secdb][wolfi] | -| Chainguard | [secdb][chainguard] | -| Amazon Linux | [Amazon Linux Security Center][amazon] | -| Debian | [Security Bug Tracker][debian-tracker] | -| | [OVAL][debian-oval] | -| Ubuntu | [Ubuntu CVE Tracker][ubuntu] | -| RHEL/CentOS | [OVAL][rhel-oval] | -| | [Security Data][rhel-api] | -| AlmaLinux | [AlmaLinux Product Errata][alma] | -| Rocky Linux | [Rocky Linux UpdateInfo][rocky] | -| Oracle Linux | [OVAL][oracle] | -| CBL-Mariner | [OVAL][mariner] | -| OpenSUSE/SLES | [CVRF][suse] | -| Photon OS | [Photon Security Advisory][photon] | - -### Data source selection -Trivy **only** consumes security advisories from the sources listed in the above table. - -As for packages installed from OS package managers (`dpkg`, `yum`, `apk`, etc.), Trivy uses the advisory database from the appropriate **OS vendor**. - -For example: for a python package installed from `yum` (Amazon linux), Trivy will only get advisories from [ALAS][amazon]. -But for a python package installed from another source (e.g. `pip`), Trivy will get advisories from the `GitLab` and `GitHub` databases. - -This advisory selection is essential to avoid getting false positives because OS vendors usually backport upstream fixes, and the fixed version can be different from the upstream fixed version. -The severity is from the selected data source. -If the data source does not provide severity, it falls back to [NVD][nvd], and if NVD does not have severity, it will be UNKNOWN. - -## Distributions -### CBL-Mariner -Trivy scans [CBL-Mariner][cbl-mariner]. - -#### Support -The following table provides an outline of the features Trivy offers. - -| Version | Container image | Virtual machine | Distroless | Multi-arch | Unfixed support | -|---------|:---------------:|:---------------:|:----------:|:------------:|:---------------:| -| 1.0 | ✔ | ✔ | ✔ | amd64, arm64 | ✔ | -| 2.0 | ✔ | ✔ | ✔ | amd64, arm64 | ✔ | - -### Examples - -=== "image" - ``` - ➜ trivy image mcr.microsoft.com/cbl-mariner/base/core:2.0 - 2022-07-27T14:48:20.355+0600 INFO Detected OS: cbl-mariner - 2022-07-27T14:48:20.355+0600 INFO Detecting CBL-Mariner vulnerabilities... - 2022-07-27T14:48:20.356+0600 INFO Number of language-specific files: 0 - - mcr.microsoft.com/cbl-mariner/base/core:2.0 (cbl-mariner 2.0.20220527) - - Total: 33 (UNKNOWN: 0, LOW: 0, MEDIUM: 15, HIGH: 13, CRITICAL: 5) - ``` - -=== "rootfs" - ``` - ➜ docker run -it --rm --entrypoint bin/bash mcr.microsoft.com/cbl-mariner/base/core:2.0 - root [ / ]# tdnf -y install ca-certificates - root [ / ]# # Install the latest Trivy - root [ / ]# trivy rootfs / - 2022-07-27T09:30:06.815Z INFO Need to update DB - 2022-07-27T09:30:06.815Z INFO DB Repository: ghcr.io/aquasecurity/trivy-db - 2022-07-27T09:30:06.815Z INFO Downloading DB... - 33.25 MiB / 33.25 MiB [------------------------------] 100.00% 4.20 MiB p/s 8.1s - 2022-07-27T09:30:21.756Z INFO Vulnerability scanning is enabled - 2022-07-27T09:30:21.756Z INFO Secret scanning is enabled - 2022-07-27T09:30:21.756Z INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning - 2022-07-27T09:30:21.756Z INFO Please see also https://aquasecurity.github.io/trivy/v0.30.4/docs/secret/scanning/#recommendation for faster secret detection - 2022-07-27T09:30:22.205Z INFO Detected OS: cbl-mariner - 2022-07-27T09:30:22.205Z INFO Detecting CBL-Mariner vulnerabilities... - 2022-07-27T09:30:22.205Z INFO Number of language-specific files: 0 - - 40ba9a55397c (cbl-mariner 2.0.20220527) - ======================================= - Total: 33 (UNKNOWN: 0, LOW: 0, MEDIUM: 15, HIGH: 13, CRITICAL: 5) - ``` - -[^1]: https://developers.redhat.com/products/rhel/ubi -[^2]: https://github.com/GoogleContainerTools/distroless - -[arch]: https://security.archlinux.org/ -[alpine]: https://secdb.alpinelinux.org/ -[wolfi]: https://packages.wolfi.dev/os/security.json -[chainguard]: https://packages.cgr.dev/chainguard/security.json -[amazon]: https://alas.aws.amazon.com/ -[debian-tracker]: https://security-tracker.debian.org/tracker/ -[debian-oval]: https://www.debian.org/security/oval/ -[ubuntu]: https://ubuntu.com/security/cve -[rhel-oval]: https://www.redhat.com/security/data/oval/v2/ -[rhel-api]: https://www.redhat.com/security/data/metrics/ -[alma]: https://errata.almalinux.org/ -[rocky]: https://download.rockylinux.org/pub/rocky/ -[oracle]: https://linux.oracle.com/security/oval/ -[suse]: http://ftp.suse.com/pub/projects/security/cvrf/ -[photon]: https://packages.vmware.com/photon/photon_cve_metadata/ -[mariner]: https://github.com/microsoft/CBL-MarinerVulnerabilityData/ - -[cbl-mariner]: https://github.com/microsoft/CBL-Mariner - -[nvd]: https://nvd.nist.gov/ diff --git a/docs/docs/supply-chain/sbom.md b/docs/docs/supply-chain/sbom.md index 097836d61eb..7091eb6ed2b 100644 --- a/docs/docs/supply-chain/sbom.md +++ b/docs/docs/supply-chain/sbom.md @@ -185,18 +185,6 @@ Trivy supports the following packages. - [OS packages][os_packages] - [Language-specific packages][language_packages] -In addition to the above packages, Trivy also supports the following packages for generating SBOM. - -!!! note - These packages are not supported for vulnerability scanning. - -| Language | File | Dependency location[^1] | -|----------|-------------------|:-----------------------:| -| Python | conda package[^2] | - | -| Swift | Podfile.lock | - | - -[^1]: Use `startline == 1 and endline == 1` for unsupported file types -[^2]: `envs/*/conda-meta/*.json` ### Formats #### CycloneDX @@ -754,7 +742,7 @@ Trivy automatically detects the SBOM files and uses them for scanning. It is enabled in the following targets. | Target | Enabled | -|:---------------:|:-------:| +| :-------------: | :-----: | | Container Image | ✓ | | Filesystem | | | Rootfs | ✓ | @@ -771,5 +759,5 @@ It is enabled in the following targets. [sbom]: https://cyclonedx.org/capabilities/sbom/ [bov]: https://cyclonedx.org/capabilities/bov/ -[os_packages]: ../scanner/vulnerability/os.md -[language_packages]: ../scanner/vulnerability/language/index.md +[os_packages]: ../scanner/vulnerability.md#os-packages +[language_packages]: ../scanner/vulnerability.md#language-specific-packages diff --git a/docs/docs/target/container_image.md b/docs/docs/target/container_image.md index 18fbea52131..c0afd1319ca 100644 --- a/docs/docs/target/container_image.md +++ b/docs/docs/target/container_image.md @@ -22,7 +22,7 @@ By default, vulnerability and secret scanning are enabled, and you can configure It is enabled by default. You can simply specify your image name (and a tag). It detects known vulnerabilities in your container image. -See [here](../scanner/vulnerability/index.md) for the detail. +See [here](../scanner/vulnerability.md) for the detail. ``` $ trivy image [YOUR_IMAGE_NAME] diff --git a/docs/docs/target/filesystem.md b/docs/docs/target/filesystem.md index 37731d8b958..cb1210dc42f 100644 --- a/docs/docs/target/filesystem.md +++ b/docs/docs/target/filesystem.md @@ -23,7 +23,7 @@ $ trivy fs ~/src/github.com/aquasecurity/trivy-ci-test/Pipfile.lock ### Vulnerabilities It is enabled by default. Trivy will look for vulnerabilities based on lock files such as Gemfile.lock and package-lock.json. -See [here](../scanner/vulnerability/index.md) for the detail. +See [here](../scanner/vulnerability.md) for the detail. ``` $ trivy fs ~/src/github.com/aquasecurity/trivy-ci-test diff --git a/docs/docs/target/repository.md b/docs/docs/target/repository.md index e4f99052dbf..16bb29f4367 100644 --- a/docs/docs/target/repository.md +++ b/docs/docs/target/repository.md @@ -34,13 +34,13 @@ $ trivy repo https://github.com/aquasecurity/trivy-ci-test ## Rationale `trivy repo` is designed to scan code repositories, and it is intended to be used for scanning local/remote repositories in your machine or in your CI environment. Therefore, unlike container/VM image scanning, it targets lock files such as package-lock.json and does not target artifacts like JAR files, binary files, etc. -See [here](../scanner/vulnerability/language/index.md) for the detail. +See [here](../scanner/vulnerability.md#language-specific-packages) for the detail. ## Scanners ### Vulnerabilities It is enabled by default. Trivy will look for vulnerabilities based on lock files such as Gemfile.lock and package-lock.json. -See [here](../scanner/vulnerability/index.md) for the detail. +See [here](../scanner/vulnerability.md) for the detail. ``` $ trivy repo ~/src/github.com/aquasecurity/trivy-ci-test diff --git a/docs/docs/target/rootfs.md b/docs/docs/target/rootfs.md index 4895798cb43..1b6b7438b6a 100644 --- a/docs/docs/target/rootfs.md +++ b/docs/docs/target/rootfs.md @@ -12,4 +12,4 @@ $ trivy rootfs /path/to/rootfs !!! note Rootfs scanning works differently from the Filesystem scanning. You should use `trivy fs` to scan your local projects in CI/CD. - See [here](../scanner/vulnerability/index.md) for the differences. + See [here](../scanner/vulnerability.md) for the differences. diff --git a/docs/docs/target/vm.md b/docs/docs/target/vm.md index 293ef48d49f..0bf61620010 100644 --- a/docs/docs/target/vm.md +++ b/docs/docs/target/vm.md @@ -144,7 +144,7 @@ Trivy supports VM image scanning for It is enabled by default. You can simply specify your VM image location. It detects known vulnerabilities in your VM image. -See [here](../scanner/vulnerability/index.md) for the detail. +See [here](../scanner/vulnerability.md) for the detail. ``` $ trivy vm [YOUR_VM_IMAGE] diff --git a/docs/getting-started/coverage.md b/docs/getting-started/coverage.md deleted file mode 100644 index 81c6a2b662f..00000000000 --- a/docs/getting-started/coverage.md +++ /dev/null @@ -1,58 +0,0 @@ -# Scanning Coverage - -Trivy can detect security issues in many different platforms and languages. This page gives a general overview of that coverage, and can help answer the frequently asked question "Does Trivy support X?". For more detailed information about the specific features and options, check the relevant scanner documentation. - -## Vulnerabilities & SBOM - -### Programming languages -Trivy detects code dependencies for the purpose of SBOM generation and vulnerability detection. The following programming languages have some level of support: - -- Ruby -- Python -- PHP -- Node.js -- .NET -- Java -- Go -- Rust -- C/C++ -- Elixir -- Dart -- Swift - -Some features might be not be universally supported. For a full supportability matrix, [see here](../docs/scanner/vulnerability/language/index.md). - -### OS -Trivy detects installed packages for the purpose of vulnerability detection. The following package managers are supported: - -- Alpine Linux -- Wolfi Linux -- Chainguard -- Red Hat Universal Base Image -- Red Hat Enterprise Linux -- CentOS -- AlmaLinux -- Rocky Linux -- Oracle Linux -- CBL-Mariner -- Amazon Linux -- openSUSE Leap -- SUSE Enterprise Linux -- Photon OS -- Debian GNU/Linux -- Ubuntu -- Distroless - -Some features might be not be universally supported. For a full supportability matrix, [see here](../docs/scanner/vulnerability/os.md). - -## IaC & configuration -Trivy reads IaC & configuration languages for the purpose of misconfiguration detection and custom checks. - -- Kubernetes -- Dockerfile, Containerfile -- Terraform -- CloudFormation -- Azure ARM Template -- Helm Chart - -For more information about checks [see here](../docs/scanner/misconfiguration/policy/builtin.md). diff --git a/docs/getting-started/faq.md b/docs/getting-started/faq.md index 4652aab42ec..3bd1e9fcb97 100644 --- a/docs/getting-started/faq.md +++ b/docs/getting-started/faq.md @@ -6,7 +6,7 @@ ### Does Trivy support X? -Check out the [Scanning coverage page](./coverage.md) +Check out the [Scanning coverage page](../docs/coverage/index.md). ### Is there a paid version of Trivy? diff --git a/docs/index.md b/docs/index.md index 1728d90c853..41711eaf20b 100644 --- a/docs/index.md +++ b/docs/index.md @@ -127,7 +127,7 @@ Contact us about any matter by opening a GitHub Discussion [here][discussions] [Ecosystem]: ./ecosystem/index.md [Installation]: getting-started/installation.md [pronunciation]: #how-to-pronounce-the-name-trivy -[Scanning Coverage]: getting-started/coverage.md +[Scanning Coverage]: ./docs/coverage/index.md [aquasec]: https://aquasec.com [oss]: https://www.aquasec.com/products/open-source-projects/ diff --git a/mkdocs.yml b/mkdocs.yml index 191578c2664..b6c00c541f5 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -10,7 +10,6 @@ nav: - Getting Started: - Overview: index.md - Installation: getting-started/installation.md - - Scanning coverage: getting-started/coverage.md - FAQ: getting-started/faq.md - Tutorials: - Overview: tutorials/overview.md @@ -48,17 +47,7 @@ nav: - AWS: docs/target/aws.md - SBOM: docs/target/sbom.md - Scanner: - - Vulnerability: - - Overview: docs/scanner/vulnerability/index.md - - OS Packages: docs/scanner/vulnerability/os.md - - Language-specific Packages: - - Overview: docs/scanner/vulnerability/language/index.md - - Go: docs/scanner/vulnerability/language/golang.md - - Java: docs/scanner/vulnerability/language/java.md - - Node.js: docs/scanner/vulnerability/language/nodejs.md - - PHP: docs/scanner/vulnerability/language/php.md - - Python: docs/scanner/vulnerability/language/python.md - - Rust: docs/scanner/vulnerability/language/rust.md + - Vulnerability: docs/scanner/vulnerability.md - Misconfiguration: - Overview: docs/scanner/misconfiguration/index.md - Policy: @@ -74,6 +63,47 @@ nav: - Debugging Policies: docs/scanner/misconfiguration/custom/debug.md - Secret: docs/scanner/secret.md - License: docs/scanner/license.md + - Coverage: + - Overview: docs/coverage/index.md + - OS: + - Overview: docs/coverage/os/index.md + - AlmaLinux: docs/coverage/os/alma.md + - Alpine Linux: docs/coverage/os/alpine.md + - Amazon Linux: docs/coverage/os/amazon.md + - CBL-Mariner: docs/coverage/os/cbl-mariner.md + - CentOS: docs/coverage/os/centos.md + - Chainguard: docs/coverage/os/chainguard.md + - Debian: docs/coverage/os/debian.md + - Google Distroless: docs/coverage/os/google-distroless.md + - Oracle Linux: docs/coverage/os/oracle.md + - Photon OS: docs/coverage/os/photon.md + - Red Hat: docs/coverage/os/rhel.md + - Rocky Linux: docs/coverage/os/rocky.md + - SUSE: docs/coverage/os/suse.md + - Ubuntu: docs/coverage/os/ubuntu.md + - Wolfi: docs/coverage/os/wolfi.md + - Language: + - Overview: docs/coverage/language/index.md + - C/C++: docs/coverage/language/c.md + - Dart: docs/coverage/language/dart.md + - .NET: docs/coverage/language/dotnet.md + - Elixir: docs/coverage/language/elixir.md + - Go: docs/coverage/language/golang.md + - Java: docs/coverage/language/java.md + - Node.js: docs/coverage/language/nodejs.md + - PHP: docs/coverage/language/php.md + - Python: docs/coverage/language/python.md + - Ruby: docs/coverage/language/ruby.md + - Rust: docs/coverage/language/rust.md + - Swift: docs/coverage/language/swift.md + - IaC: + - Overview: docs/coverage/iac/index.md + - Azure ARM Template: docs/coverage/iac/azure-arm.md + - CloudFormation: docs/coverage/iac/cloudformation.md + - Docker: docs/coverage/iac/docker.md + - Helm: docs/coverage/iac/helm.md + - Kubernetes: docs/coverage/iac/kubernetes.md + - Terraform: docs/coverage/iac/terraform.md - Configuration: - Overview: docs/configuration/index.md - Filtering: docs/configuration/filtering.md diff --git a/pkg/purl/purl.go b/pkg/purl/purl.go index 5787da1b9f8..6278943a870 100644 --- a/pkg/purl/purl.go +++ b/pkg/purl/purl.go @@ -112,6 +112,8 @@ func (p *PackageURL) PackageType() string { return ftypes.Cocoapods case packageurl.TypeHex: return ftypes.Hex + case packageurl.TypeConan: + return ftypes.Conan case TypeDart: // TODO: replace with packageurl.TypeDart once they add it. return ftypes.Pub } @@ -331,6 +333,8 @@ func purlType(t string) string { return packageurl.TypeSwift case ftypes.Hex: return packageurl.TypeHex + case ftypes.Conan: + return packageurl.TypeConan case ftypes.Pub: return TypeDart // TODO: replace with packageurl.TypeDart once they add it. case os.Alpine: