Gitlab report template fails because it gets outdated.

[mgaspereyra]

Description

The template /contrib/gitlab.tpl it's outdated and, when you use it on gitlab saas, the security tab, on pipelines, throws the following information:
[Schema] Version 14.0.6 for report type container_scanning is unsupported, supported versions for this report type are: 15.0.0, 15.0.1, 15.0.2, 15.0.4, 15.0.5, 15.0.6. GitLab will attempt to validate this report against the earliest supported versions of this report type, to show all the errors but will not ingest the report

[Schema] root is missing required keys: scan
[Schema] property '/vulnerabilities/4/location/image' does not match pattern: ^[^:]+(:\d+[^:]*)?:[^:]+(:[^:]+)?$

Desired Behavior

The desired behavior is the report being correctly parsed by GitLab.

Actual Behavior

The report cannot be parsed due the outdated schema.

Reproduction Steps

1. Run trivy scan, using the template flag as follows:
script:
    - docker build -f .docker/Dockerfile -t "$AZURE_CR"/pythonprojgitlab:"$CI_COMMIT_SHORT_SHA" .
    - >
      docker run -v /var/run/docker.sock:/var/run/docker.sock -v $(pwd):/app 
      -e AZURE_CLIENT_ID=${AZURE_CLIENT_ID} -e AZURE_CLIENT_SECRET=${AZURE_CLIENT_SECRET} 
      -e AZURE_TENANT_ID=${AZURE_TENANT_ID} aquasec/trivy -d  -f template -t "@contrib/gitlab.tpl" 
      -o /app/gl-container-scanning-report.json image "$AZURE_CR"/pythonprojgitlab:"$CI_COMMIT_SHORT_SHA"
    - docker push "$AZURE_CR"/pythonprojgitlab:"$CI_COMMIT_SHORT_SHA"
  artifacts:
    reports:
      container_scanning: gl-container-scanning-report.json
2. When pipeline finishes, check de pipeline reume page, and open the "security tab"
3. Check for the errors on the related report.
...

Target

Container Image

Scanner

Vulnerability

Output Format

Template

Mode

Standalone

Debug Output

2023-08-03T21:16:22.149Z	DEBUG	Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2023-08-03T21:16:22.151Z	DEBUG	Ignore statuses	{"statuses": null}
2023-08-03T21:16:22.159Z	DEBUG	cache dir:  /root/.cache/trivy
2023-08-03T21:16:22.159Z	DEBUG	There is no valid metadata file: unable to open a file: open /root/.cache/trivy/db/metadata.json: no such file or directory
2023-08-03T21:16:22.159Z	INFO	Need to update DB
2023-08-03T21:16:22.159Z	INFO	DB Repository: ghcr.io/aquasecurity/trivy-db
2023-08-03T21:16:22.159Z	INFO	Downloading DB...
2023-08-03T21:16:22.160Z	DEBUG	no metadata file
14.97 MiB / 38.64 MiB [----------------------->_____________________________________] 38.74% ? p/s ?36.05 MiB / 38.64 MiB [-------------------------------------------------------->____] 93.29% ? p/s ?38.64 MiB / 38.64 MiB [----------------------------------------------------------->] 100.00% ? p/s ?38.64 MiB / 38.64 MiB [---------------------------------------------->] 100.00% 39.43 MiB p/s ETA 0s38.64 MiB / 38.64 MiB [---------------------------------------------->] 100.00% 39.43 MiB p/s ETA 0s38.64 MiB / 38.64 MiB [---------------------------------------------->] 100.00% 39.43 MiB p/s ETA 0s38.64 MiB / 38.64 MiB [---------------------------------------------->] 100.00% 36.88 MiB p/s ETA 0s38.64 MiB / 38.64 MiB [---------------------------------------------->] 100.00% 36.88 MiB p/s ETA 0s38.64 MiB / 38.64 MiB [---------------------------------------------->] 100.00% 36.88 MiB p/s ETA 0s38.64 MiB / 38.64 MiB [-------------------------------------------------] 100.00% 23.88 MiB p/s 1.8s2023-08-03T21:16:24.301Z	DEBUG	Updating database metadata...
2023-08-03T21:16:24.301Z	DEBUG	DB Schema: 2, UpdatedAt: 2023-08-03 18:13:00.798612173 +0000 UTC, NextUpdate: 2023-08-04 00:13:00.798611973 +0000 UTC, DownloadedAt: 2023-08-03 21:16:24.301470698 +0000 UTC
2023-08-03T21:16:24.301Z	INFO	Vulnerability scanning is enabled
2023-08-03T21:16:24.301Z	DEBUG	Vulnerability type:  [os library]
2023-08-03T21:16:24.301Z	INFO	Secret scanning is enabled
2023-08-03T21:16:24.301Z	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2023-08-03T21:16:24.301Z	INFO	Please see also https://aquasecurity.github.io/trivy/v0.44/docs/scanner/secret/#recommendation for faster secret detection
2023-08-03T21:16:24.311Z	DEBUG	No secret config detected: trivy-secret.yaml
2023-08-03T21:16:24.311Z	DEBUG	No secret config detected: trivy-secret.yaml
2023-08-03T21:16:24.312Z	DEBUG	Image ID: sha256:e8d054ba5cef9eaea55e0403931e1b8a19724ab653b588ffb9c19a42fb8ee1b8
2023-08-03T21:16:24.312Z	DEBUG	Diff IDs: [sha256:78a822fe2a2d2c84f3de4a403188c45f623017d6a4521d23047c9fbb0801794c sha256:cd18acbc1cce1afc3e8ecd73699c93e81a2ab76778933bf170162f7ef8997702 sha256:e3de9eff010253fbcac268c5f0b663973782b64b379ec3ab4fc809a8acd85ffa sha256:d932533fc5c85e558fe43415f465fa92ddb408ea53f1f5bf746056e58782242e sha256:8380e70cbea0d455c3ce5b105354e0bada8e19d94718155669d90963ce8673c2 sha256:5da3a6d3abfe55a151e28e6527452262dc90c3df9be5f81ec885526ae6096402 sha256:67b88bf1628d9bc98de34b75826a2e562d11c60ae7f9587c19b0e0096c0b6c31 sha256:96f2a1cca3f98a295dd30d3091cf1e9699318de00cd7a8d5eed14f2c884694c3 sha256:6c03d9ed050045bfba38e39e45a13b1c1a6d80cb1b0edba86ebc0e4751f38fb3 sha256:e744397103367766b5c1a74192d364c37ad526ce2e3e5ffc043ebb1df96a3b10 sha256:9549ebe2268f7824ad4fc92af181bc162a8f30e7b1261030e35936ea4449fa15 sha256:91e7090a8cdb1345645f1dec5b13bf3e1a599aabe64a54222f23a5c8a994e9ea sha256:d1c139301724ce24542a4cb4278086f7638270aaab6dfb2939b1cacc550dcc04]
2023-08-03T21:16:24.312Z	DEBUG	Base Layers: [sha256:78a822fe2a2d2c84f3de4a403188c45f623017d6a4521d23047c9fbb0801794c sha256:cd18acbc1cce1afc3e8ecd73699c93e81a2ab76778933bf170162f7ef8997702 sha256:e3de9eff010253fbcac268c5f0b663973782b64b379ec3ab4fc809a8acd85ffa sha256:d932533fc5c85e558fe43415f465fa92ddb408ea53f1f5bf746056e58782242e sha256:8380e70cbea0d455c3ce5b105354e0bada8e19d94718155669d90963ce8673c2]
2023-08-03T21:16:24.312Z	DEBUG	Missing image ID in cache: sha256:e8d054ba5cef9eaea55e0403931e1b8a19724ab653b588ffb9c19a42fb8ee1b8
2023-08-03T21:16:24.313Z	DEBUG	Missing diff ID in cache: sha256:cd18acbc1cce1afc3e8ecd73699c93e81a2ab76778933bf170162f7ef8997702
2023-08-03T21:16:24.314Z	DEBUG	Missing diff ID in cache: sha256:e3de9eff010253fbcac268c5f0b663973782b64b379ec3ab4fc809a8acd85ffa
2023-08-03T21:16:24.314Z	DEBUG	Missing diff ID in cache: sha256:d932533fc5c85e558fe43415f465fa92ddb408ea53f1f5bf746056e58782242e
2023-08-03T21:16:24.314Z	DEBUG	Missing diff ID in cache: sha256:8380e70cbea0d455c3ce5b105354e0bada8e19d94718155669d90963ce8673c2
2023-08-03T21:16:24.313Z	DEBUG	Missing diff ID in cache: sha256:78a822fe2a2d2c84f3de4a403188c45f623017d6a4521d23047c9fbb0801794c
2023-08-03T21:16:32.349Z	DEBUG	Missing diff ID in cache: sha256:5da3a6d3abfe55a151e28e6527452262dc90c3df9be5f81ec885526ae6096402
2023-08-03T21:16:32.372Z	DEBUG	Missing diff ID in cache: sha256:67b88bf1628d9bc98de34b75826a2e562d11c60ae7f9587c19b0e0096c0b6c31
2023-08-03T21:16:32.376Z	DEBUG	Skipping directory: dev
2023-08-03T21:16:32.376Z	DEBUG	Missing diff ID in cache: sha256:96f2a1cca3f98a295dd30d3091cf1e9699318de00cd7a8d5eed14f2c884694c3
2023-08-03T21:16:32.422Z	DEBUG	Missing diff ID in cache: sha256:6c03d9ed050045bfba38e39e45a13b1c1a6d80cb1b0edba86ebc0e4751f38fb3
2023-08-03T21:16:32.488Z	DEBUG	Missing diff ID in cache: sha256:e744397103367766b5c1a74192d364c37ad526ce2e3e5ffc043ebb1df96a3b10
2023-08-03T21:16:32.516Z	DEBUG	Missing diff ID in cache: sha256:9549ebe2268f7824ad4fc92af181bc162a8f30e7b1261030e35936ea4449fa15
2023-08-03T21:16:32.530Z	DEBUG	Missing diff ID in cache: sha256:91e7090a8cdb1345645f1dec5b13bf3e1a599aabe64a54222f23a5c8a994e9ea
2023-08-03T21:16:32.535Z	DEBUG	Missing diff ID in cache: sha256:d1c139301724ce24542a4cb4278086f7638270aaab6dfb2939b1cacc550dcc04
2023-08-03T21:16:32.562Z	DEBUG	Skipping directory: proc
2023-08-03T21:16:32.577Z	DEBUG	Skipping directory: sys
2023-08-03T21:16:33.092Z	DEBUG	No secrets found in container image config
2023-08-03T21:16:33.095Z	INFO	Detected OS: alpine
2023-08-03T21:16:33.095Z	INFO	Detecting Alpine vulnerabilities...
2023-08-03T21:16:33.095Z	DEBUG	alpine: os version: 3.18
2023-08-03T21:16:33.095Z	DEBUG	alpine: package repository: 3.18
2023-08-03T21:16:33.095Z	DEBUG	alpine: the number of packages: 63
2023-08-03T21:16:33.097Z	INFO	Number of language-specific files: 1
2023-08-03T21:16:33.097Z	INFO	Detecting python-pkg vulnerabilities...
2023-08-03T21:16:33.097Z	DEBUG	Detecting library vulnerabilities, type: python-pkg, path:

Operating System

It runs on official docker image, executed by a gitlab saas runner.

Version

0.43.1

Checklist

• Run trivy image --reset
• Read the troubleshooting

[knqyf263]

Is this related?
#4035

[mgaspereyra]

Yes, it is, I didn't saw that thread before, thanks to push me on that direction!

[knqyf263]

Please watch the PR.