How does Trivy detect Go binaries in SCRATCH images?

[wollomatic]

Question

How does trivy detect Golang binaries in scratch container images like those:

FROM golang:1.22.2-alpine AS build
WORKDIR /app
COPY go.mod *.go ./
RUN GOOS=linux GOARCH=amd64 GOFLAGS="-trimpath" CGO_ENABLED=0 go build --tags netgo -ldflags="-w -s" -o /blah .

FROM scratch
EXPOSE 8080
ENTRYPOINT ["/blah"]
WORKDIR /
COPY --from=build /blah /blah
USER 65534:65534

I have some images where trivy detects the compiled binery, but other container images don't get scanned:

2024-04-15T17:57:09.936+0200    INFO    Vulnerability scanning is enabled
2024-04-15T17:57:09.936+0200    INFO    Secret scanning is enabled
2024-04-15T17:57:09.936+0200    INFO    If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-04-15T17:57:09.936+0200    INFO    Please see also https://aquasecurity.github.io/trivy/v0.50/docs/scanner/secret/#recommendation for faster secret detection
2024-04-15T17:57:10.058+0200    INFO    Number of language-specific files: 0

How can I optimise my Dockerfile, so that Trivy is able to detect the binary?

Target

Container Image

Scanner

Vulnerability

Output Format

None

Mode

Standalone

Operating System

linux/amd64

Version

Version: 0.50.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-04-15 12:12:10.582949864 +0000 UTC
  NextUpdate: 2024-04-15 18:12:10.582949704 +0000 UTC
  DownloadedAt: 2024-04-15 15:56:59.765386832 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2024-03-19 00:47:09.502917667 +0000 UTC
  NextUpdate: 2024-03-22 00:47:09.502917547 +0000 UTC
  DownloadedAt: 2024-03-19 11:33:38.686315408 +0000 UTC

[knqyf263]

Trivy basically analyzes all executable files and detects Go binaries.

Are you sure you image was successfully built?

 > [build 4/4] RUN GOOS=linux GOARCH=amd64 GOFLAGS="-trimpath" CGO_ENABLED=0 go build --tags netgo -ldflags="-w -s" -o /blah .:
0.284 main.go:4:9: missing go.sum entry for module providing package golang.org/x/mod/semver (imported by example.com); to add:
0.284   go get example.com
------
Dockerfile:4
--------------------
   2 |     WORKDIR /app
   3 |     COPY go.mod *.go ./
   4 | >>> RUN GOOS=linux GOARCH=amd64 GOFLAGS="-trimpath" CGO_ENABLED=0 go build --tags netgo -ldflags="-w -s" -o /blah .
   5 |
   6 |     FROM scratch
--------------------

After I added go.sum, the binary was detected correctly.

2024-04-15T22:09:37+04:00       INFO    Number of language-specific files       num=1
2024-04-15T22:09:37+04:00       INFO    [gobinary] Detecting vulnerabilities...

[wollomatic]

Hi @knqyf263,

thank You for the answer.

Yes, the image is successfully built, because it runs on my server: wollomatic/socket-proxy:1.1.3 (this project: https://github.com/wollomatic/socket-proxy ).
There is no go.sum, because there aren't any external dependencies. But I think Trivy is also able to detect vulnerabilities in the Go standard library?

Regards,
Wolfgang

[itaysk]

Trivy is also able to detect vulnerabilities in the Go standard library?

Not yet but soon.
#4133
#6277

[wollomatic]

It works now. Thanks!