Trivy SDK Documentation

[shyam0904a]

Description

Currently I'm trying to implement a file system vulnerability scanner using trivy as a sdk, after hours of debugging and going through docs, i managed to get the binary compiling but the issue is i get no component list. I'm not quite sure what is going on. It would be great if there was a docs on sdk and its usage.

package main

import (
   "context"
   "encoding/json"
   "flag"
   "fmt"
   "os"
   "path/filepath"
   "time"

   "github.com/aquasecurity/trivy/pkg/commands/artifact"
   trivyFlag "github.com/aquasecurity/trivy/pkg/flag"
   "github.com/aquasecurity/trivy/pkg/types"
)

type Config struct {
   Target         string
   OutputFile     string
   CacheDir       string
   Timeout        time.Duration
   Format         string
   Severity       string
   SkipDBUpdate   bool
   OfflineScan    bool
   ListAllPkgs    bool
   ServerURL      string
   ServerToken    string
   ScanType       string
}

func main() {
   cfg := parseFlags()

   if err := runScan(cfg); err != nil {
    fmt.Printf("Error: %v\n", err)
    os.Exit(1)
   }
}

func parseFlags() Config {
   var cfg Config

   flag.StringVar(&cfg.Target, "target", "", "Target to scan (file, directory, or image name)")
   flag.StringVar(&cfg.OutputFile, "output", "trivy-results.json", "Output file path")
   flag.StringVar(&cfg.CacheDir, "cache-dir", filepath.Join(os.TempDir(), "trivy-cache"), "Cache directory")
   flag.DurationVar(&cfg.Timeout, "timeout", 10*time.Minute, "Scan timeout")
   flag.StringVar(&cfg.Format, "format", "json", "Output format (json, table, cyclonedx, spdx)")
   flag.StringVar(&cfg.Severity, "severity", "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL", "Severity levels to report")
   flag.BoolVar(&cfg.SkipDBUpdate, "skip-db-update", false, "Skip database update")
   flag.BoolVar(&cfg.OfflineScan, "offline", false, "Offline scan")
   flag.BoolVar(&cfg.ListAllPkgs, "list-all-pkgs", true, "List all packages")
   flag.StringVar(&cfg.ServerURL, "server-url", "", "Trivy server URL")
   flag.StringVar(&cfg.ServerToken, "server-token", "", "Trivy server token")
   flag.StringVar(&cfg.ScanType, "scan-type", "vulnerability", "Scan type (vulnerability, config, secret, all)")

   flag.Parse()

   if cfg.Target == "" {
    fmt.Println("Error: target is required")
    flag.Usage()
    os.Exit(1)
   }

   return cfg
}

func runScan(cfg Config) error {
   ctx, cancel := context.WithTimeout(context.Background(), cfg.Timeout)
   defer cancel()

   // Create temp directory if needed
   if err := os.MkdirAll(cfg.CacheDir, 0755); err != nil {
    return fmt.Errorf("failed to create cache directory: %w", err)
   }

   // Configure Trivy options
   opts := &trivyFlag.Options{
    GlobalOptions: trivyFlag.GlobalOptions{
      CacheDir: cfg.CacheDir,
      Timeout:  cfg.Timeout,
    },
    ScanOptions: trivyFlag.ScanOptions{
      Target:      cfg.Target,
      OfflineScan: cfg.OfflineScan,
    },
    ReportOptions: trivyFlag.ReportOptions{
      Format:      types.Format(cfg.Format),
      Output:      cfg.OutputFile,
      ListAllPkgs: cfg.ListAllPkgs,
    },
    DBOptions: trivyFlag.DBOptions{
      SkipDBUpdate: cfg.SkipDBUpdate,
    },
    RemoteOptions: trivyFlag.RemoteOptions{
      ServerAddr: cfg.ServerURL,
      Token:      cfg.ServerToken,
    },
   }

   // Configure scan type
   switch cfg.ScanType {
   case "vulnerability":
    opts.ScanOptions.Scanners = []types.Scanner{types.VulnerabilityScanner}
   case "config":
    opts.ScanOptions.Scanners = []types.Scanner{types.MisconfigScanner}
   case "secret":
    opts.ScanOptions.Scanners = []types.Scanner{types.SecretScanner}
   case "all":
    opts.ScanOptions.Scanners = []types.Scanner{
      types.VulnerabilityScanner,
      types.MisconfigScanner,
      types.SecretScanner,
    }
   }

   // Determine target kind
   targetKind := artifact.TargetContainerImage
   if info, err := os.Stat(cfg.Target); err == nil && info.IsDir() {
    targetKind = artifact.TargetFilesystem
   }

   // Run the scan
   if err := artifact.Run(ctx, *opts, targetKind); err != nil {
    return fmt.Errorf("scan failed: %w", err)
   }

   // Print results
   if cfg.Format == "json" {
    data, err := os.ReadFile(cfg.OutputFile)
    if err != nil {
      return fmt.Errorf("failed to read output file: %w", err)
    }

    var result interface{}
    if err := json.Unmarshal(data, &result); err != nil {
      return fmt.Errorf("failed to parse JSON output: %w", err)
    }

    prettyJSON, err := json.MarshalIndent(result, "", "  ")
    if err != nil {
      return fmt.Errorf("failed to format JSON: %w", err)
    }

    fmt.Println(string(prettyJSON))
   } else {
    data, err := os.ReadFile(cfg.OutputFile)
    if err != nil {
      return fmt.Errorf("failed to read output file: %w", err)
    }
    fmt.Println(string(data))
   }

   return nil
}

Link

No response

Suggestions

It would be better to have a clear documentation on the methods and some examples if possible.