v0.52.0 returns Results of Targets found even if no Vulnerabiltiies in Target

[mig5]

Question

On version 0.52.0, I get a 'Results' object containing Targets even if there were no Vulnerabilities found:

trivy repo https://github.com/someorg/somerepo -f json

{
  "SchemaVersion": 2,
  "CreatedAt": "2024-06-04T06:53:23.556429172Z",
  "ArtifactName": "https://github.com/someorg/somerepo",
  "ArtifactType": "repository",
  "Metadata": {
    "ImageConfig": {
      "architecture": "",
      "created": "0001-01-01T00:00:00Z",
      "os": "",
      "rootfs": {
        "type": "",
        "diff_ids": null
      },
      "config": {}
    }
  },
  "Results": [
    {
      "Target": "poetry.lock",
      "Class": "lang-pkgs",
      "Type": "poetry"
    }
  ]
}

On version 0.51.4, I don't get a Results object:

{
  "SchemaVersion": 2,
  "CreatedAt": "2024-06-04T07:07:26.483821546Z",
  "ArtifactName": "https://github.com/someorg/somerepo",
  "ArtifactType": "repository",
  "Metadata": {
    "ImageConfig": {
      "architecture": "",
      "created": "0001-01-01T00:00:00Z",
      "os": "",
      "rootfs": {
        "type": "",
        "diff_ids": null
      },
      "config": {}
    }
  }
}

I was reading the changelog but couldn't identify whether this was a deliberate change or a regression. It's not a big deal, but I had some custom tooling that reacts to whether there's a 'Results' object at all or not, which caused some false positives.

Can anyone confirm if this is intentional or accidental?

Target

Git Repository

Scanner

Vulnerability

Output Format

JSON

Mode

Standalone

Operating System

Debian 12

Version

Version: 0.52.0

[DmitriyLewen]

Hello @mig5
Thanks for your report!

Now we always save Packages (https://github.com/aquasecurity/trivy/pull/6765/files#diff-90cc1a705fb4add75f54c736da2c3c41ae808fa935171893927f10b94b664237R57-R58) and remove them in report/json.go (https://github.com/aquasecurity/trivy/pull/6765/files#diff-00ed0f73c94f0c4f5659e5445cf3aa139f790e951d7c9c931be68cb764eb3874R23-R28).
Therefore we get Result without Packages, but with Target and can't filter this Result (https://github.com/aquasecurity/trivy/pull/6765/files#diff-00ed0f73c94f0c4f5659e5445cf3aa139f790e951d7c9c931be68cb764eb3874R29-R31).

@knqyf263 did you expect this? Either we should not check Target (https://github.com/aquasecurity/trivy/pull/6765/files#diff-00ed0f73c94f0c4f5659e5445cf3aa139f790e951d7c9c931be68cb764eb3874R29-R31), or we should exclude this Result as we did this before (in scanner package)?

[knqyf263]

Yes, intended. The community raised requests that Trivy should show results even if there are no vulnerabilities.

[mig5]

Thanks for confirming.