feat: add support for Wolfi Linux #3215

luhring · 2022-11-22T21:14:33Z

Description

This PR adds support for Wolfi Linux to Trivy, by adding support for detecting the Wolfi "OS" and mapping that to the Wolfi secdb data provided via aquasecurity/vuln-list-update#183 and aquasecurity/trivy-db#266.

(Note: I'm on the Wolfi team. 👋 Happy to answer any questions, including about what's similar/different from Alpine.)

Here's a look at Trivy's behavior before and after adding Wolfi support. These examples are scans of an intentionally old Wolfi image so that vulnerabilities are still present. (Wofli vulnerabilities are typically patched extremely quickly.) The image being scanned is cgr.dev/chainguard/wolfi-base:latest-20221001.

Before

2022-11-22T16:08:42.908-0500	INFO	Need to update DB
2022-11-22T16:08:42.908-0500	INFO	DB Repository: ghcr.io/aquasecurity/trivy-db
2022-11-22T16:08:42.908-0500	INFO	Downloading DB...
35.24 MiB / 35.24 MiB [-----------------------------------------------------------------------------------------------------] 100.00% 22.12 MiB p/s 1.8s
2022-11-22T16:08:45.239-0500	INFO	Vulnerability scanning is enabled
2022-11-22T16:08:45.239-0500	INFO	Secret scanning is enabled
2022-11-22T16:08:45.239-0500	INFO	If your scanning is slow, please try '--security-checks vuln' to disable secret scanning
2022-11-22T16:08:45.239-0500	INFO	Please see also https://aquasecurity.github.io/trivy/v0.34/docs/secret/scanning/#recommendation for faster secret detection
2022-11-22T16:08:46.073-0500	INFO	Detected OS: none
2022-11-22T16:08:46.073-0500	WARN	unsupported os : none
2022-11-22T16:08:46.073-0500	INFO	Number of language-specific files: 0

After

2022-11-22T16:11:09.581-0500    INFO    Vulnerability scanning is enabled
2022-11-22T16:11:09.581-0500    INFO    Secret scanning is enabled
2022-11-22T16:11:09.581-0500    INFO    If your scanning is slow, please try '--security-checks vuln' to disable secret scanning
2022-11-22T16:11:09.581-0500    INFO    Please see also https://aquasecurity.github.io/trivy/dev/docs/secret/scanning/#recommendation for faster secret detection
2022-11-22T16:11:09.602-0500    INFO    Detected OS: wolfi
2022-11-22T16:11:09.602-0500    INFO    Detecting Wolfi vulnerabilities...
2022-11-22T16:11:09.603-0500    INFO    Number of language-specific files: 0

cgr.dev/chainguard/wolfi-base:latest-20221001 (wolfi 20220914)

Total: 5 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 3, CRITICAL: 1)

┌─────────┬────────────────┬──────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Installed Version │ Fixed Version │                            Title                            │
├─────────┼────────────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ busybox │ CVE-2022-28391 │ HIGH     │                   │ 1.35.0-r3     │ busybox: remote attackers may execute arbitrary code if     │
│         │                │          │                   │               │ netstat is used                                             │
│         │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2022-28391                  │
│         ├────────────────┤          ├───────────────────┤               ├─────────────────────────────────────────────────────────────┤
│         │ CVE-2022-30065 │          │                   │               │ busybox: A use-after-free in Busybox's awk applet leads to  │
│         │                │          │                   │               │ denial of service...                                        │
│         │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2022-30065                  │
├─────────┼────────────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ glibc   │ CVE-2022-39046 │ MEDIUM   │                   │ 2.36-r1       │ glibc: a crafted input may allow information disclosure     │
│         │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2022-39046                  │
├─────────┼────────────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ zlib    │ CVE-2022-37434 │ CRITICAL │                   │ 1.2.12-r3     │ zlib: heap-based buffer over-read and overflow in inflate() │
│         │                │          │                   │               │ in inflate.c via a...                                       │
│         │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2022-37434                  │
│         ├────────────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│         │ CVE-2018-25032 │ HIGH     │                   │ 1.2.12-r0     │ zlib: A flaw found in zlib when compressing (not            │
│         │                │          │                   │               │ decompressing) certain inputs...                            │
│         │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2018-25032                  │
└─────────┴────────────────┴──────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

Related issues

Close Add support for Wolfi OS #3205

Related PRs

Remove this section if you don't have related PRs.

Checklist

I've read the guidelines for contributing to this repository.
I've followed the conventions in the PR title.
I've added tests that prove my fix is effective or that my feature works.
I've updated the documentation with the relevant information (if needed).
I've added usage information (if the PR introduces new options)
I've included a "before" and "after" example to the description (if the PR is a user interface change).

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

luhring · 2022-11-23T14:25:24Z

(Compilation will fail until aquasecurity/trivy-db#266 is merged and we update this branch of trivy to use the new version of trivy-db.)

afdesk · 2022-12-04T15:09:18Z

@luhring thanks for your efforts.
could you say why we need a custom analyzer? https://github.com/luhring/trivy/tree/wolfi-support/pkg/fanal/analyzer/os/wolfi

You already handle family ID: https://github.com/luhring/trivy/blob/b7c961a65c08aa289a32659a412b550535688dd9/pkg/fanal/analyzer/os/release/release.go#L62-L63

luhring · 2022-12-04T16:44:13Z

@luhring thanks for your efforts. could you say why we need a custom analyzer? https://github.com/luhring/trivy/tree/wolfi-support/pkg/fanal/analyzer/os/wolfi

You already handle family ID: https://github.com/luhring/trivy/blob/b7c961a65c08aa289a32659a412b550535688dd9/pkg/fanal/analyzer/os/release/release.go#L62-L63

We might not need it, actually! 😃 I'm still learning Trivy's architecture, but that's what I was hoping to learn here #3205 (comment):

I'm wondering if I can even delete what I added at pkg/fanal/analyzer/os/wolfi/..., relying instead on pkg/fanal/analyzer/os/release/release.go to detect the Wolfi OS. What do you think?

afdesk · 2022-12-04T17:07:25Z

@luhring sorry, missed your thought.
yes, you can remove wolfi analyzer and rely on release package.

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

luhring · 2022-12-04T17:26:29Z

sorry, missed your thought.
yes, you can remove wolfi analyzer and rely on release package.

No worries! Removed in b0df2e5

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

luhring · 2022-12-08T12:03:30Z

Now that aquasecurity/trivy-db#266 is merged, I've updated this branch to use the latest version of trivy-db.

@knqyf263 and @afdesk could you please take a look? I'm happy to make any other changes you'd like!

Also, in these situations do you typically wait for an updated Trivy DB to be published, in order to test Trivy without using a local cache of the DB?

knqyf263 · 2022-12-08T14:58:09Z

The addition of Wolfi is causing the DB to fail to build (it is our fault), so let us fix that first.
https://github.com/aquasecurity/trivy-db/actions/runs/3648065794/jobs/6161044855

luhring · 2022-12-08T20:24:16Z

@knqyf263 The DB looks good to me now! Do you think this one is ready to merge?

knqyf263

Looks almost good to me. I left some small comments.

pkg/detector/ospkg/wolfi/wolfi.go

pkg/detector/ospkg/wolfi/wolfi_test.go

pkg/fanal/analyzer/const.go

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

knqyf263 · 2022-12-12T15:11:30Z

Hi, it looked good to me, but I found that the installed versions are empty. Do you know the reason? This analyzer should capture versions.
https://github.com/aquasecurity/trivy/blob/b944ac628616b892d2c1cb085c1bae63128de45d/pkg/fanal/analyzer/pkg/apk/apk.go

knqyf263 · 2022-12-12T15:13:35Z

Doesn't Wolfi have origin package names/versions? If it is the case, we need to use FormatVersion instead.

trivy/pkg/detector/ospkg/wolfi/wolfi.go

Line 66 in 0dfe832

installed := utils.FormatSrcVersion(pkg)

C:Q1LzfStMeff9oZ+09WB5Z5OR73s/Q=
P:binutils-dev
V:2.39-r4
A:x86_64
S:1052112
I:4209277
T:binutils development headers
U:
L:GPL-3.0-or-later
o:binutils
F:usr
F:usr/include

In the above example, can we assume binutils-dev is installed from binutils v2.39-r4? In other words, the origin package version and sub-package version are always the same?

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

luhring · 2022-12-12T15:44:08Z

In the above example, can we assume binutils-dev is installed from binutils v2.39-r4? In other words, the origin package version and sub-package version are always the same?

Yes, that's correct. Good to know about utils.FormatVersion, thanks! Updated.

luhring · 2022-12-12T15:46:15Z

Hi, it looked good to me, but I found that the installed versions are empty. Do you know the reason? This analyzer should capture versions.

Just so I understand this comment, where are you looking? I'm seeing installed versions in Trivy's output.

knqyf263 · 2022-12-12T15:47:28Z

In your PR description, installed versions are empty in the table.
#3215 (comment)

knqyf263 · 2022-12-12T15:48:51Z

It works now, though.

cgr.dev/chainguard/wolfi-base:latest-20221001 (wolfi 20220914)
==============================================================
Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 2, CRITICAL: 1)

┌─────────┬────────────────┬──────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Installed Version │ Fixed Version │                            Title                            │
├─────────┼────────────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ busybox │ CVE-2022-28391 │ HIGH     │ 1.35.0-r2         │ 1.35.0-r3     │ busybox: remote attackers may execute arbitrary code if     │
│         │                │          │                   │               │ netstat is used                                             │
│         │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2022-28391                  │
│         ├────────────────┤          │                   │               ├─────────────────────────────────────────────────────────────┤
│         │ CVE-2022-30065 │          │                   │               │ busybox: A use-after-free in Busybox's awk applet leads to  │
│         │                │          │                   │               │ denial of service...                                        │
│         │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2022-30065                  │
├─────────┼────────────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ glibc   │ CVE-2022-39046 │ MEDIUM   │ 2.36-r0           │ 2.36-r1       │ glibc: a crafted input may allow information disclosure     │
│         │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2022-39046                  │
├─────────┼────────────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ zlib    │ CVE-2022-37434 │ CRITICAL │ 1.2.12-r2         │ 1.2.12-r3     │ zlib: heap-based buffer over-read and overflow in inflate() │
│         │                │          │                   │               │ in inflate.c via a...                                       │
│         │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2022-37434                  │
└─────────┴────────────────┴──────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

luhring · 2022-12-12T15:49:34Z

In your PR description, installed versions are empty in the table.

Got it! There have been a handful of changes in the past 3 weeks. I'm seeing installed versions locally — let me know if you see something different when you run it.

knqyf263 · 2022-12-12T20:43:17Z

I didn't see installed versions before this commit 95568b5. It looks good now.

knqyf263 · 2022-12-12T20:44:29Z

Thanks for your contribution👍 It will be included in v0.36.0.

luhring · 2022-12-12T20:57:30Z

Thanks for all your help @knqyf263 and @afdesk! 🙏 This was a great learning experience.

Add support for Wolfi

c98d8af

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

luhring requested a review from knqyf263 as a code owner November 22, 2022 21:14

Add wolfi to list of valid scopes

b7c961a

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

luhring mentioned this pull request Dec 4, 2022

feat(wolfi): add support for Wolfi Linux aquasecurity/trivy-db#266

Merged

Remove wolfi analyzer

b0df2e5

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

afdesk changed the title ~~feat(wolfi): add support for Wolfi Linux~~ feat: add support for Wolfi Linux Dec 4, 2022

luhring added 2 commits December 8, 2022 06:42

Bump version of trivy-db

5709c63

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

Fix imports order lint issue

376e367

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

knqyf263 reviewed Dec 11, 2022

View reviewed changes

pkg/detector/ospkg/wolfi/wolfi.go Outdated Show resolved Hide resolved

pkg/detector/ospkg/wolfi/wolfi.go Show resolved Hide resolved

pkg/detector/ospkg/wolfi/wolfi_test.go Outdated Show resolved Hide resolved

pkg/fanal/analyzer/const.go Outdated Show resolved Hide resolved

knqyf263 mentioned this pull request Dec 11, 2022

feat: support Wolfi OS #3211

Closed

8 tasks

luhring added 5 commits December 11, 2022 12:56

Remove logic for unfixed advisories

40c4eb3

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

Explain Wolfi supported version logic

0dfe832

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

Remove Alpine-focused test case

a9f359f

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

Remove unused const

5dee0a2

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

Adjust test data for removed logic

7113371

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

Use FormatVersion

95568b5

Signed-off-by: Dan Luhring <dluhring@chainguard.dev>

knqyf263 approved these changes Dec 12, 2022

View reviewed changes

knqyf263 merged commit 93c5d2d into aquasecurity:main Dec 12, 2022

luhring deleted the wolfi-support branch December 12, 2022 20:50

fproulx-boostsecurity mentioned this pull request Jan 30, 2023

Feature Request : Add support for Wolfi Linux google/osv.dev#1003

Closed

luhring mentioned this pull request Feb 16, 2023

feat: add support for Chainguard's commercial distro #3641

Merged

8 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add support for Wolfi Linux #3215

feat: add support for Wolfi Linux #3215

luhring commented Nov 22, 2022 •

edited

Loading

luhring commented Nov 23, 2022

afdesk commented Dec 4, 2022

luhring commented Dec 4, 2022

afdesk commented Dec 4, 2022

luhring commented Dec 4, 2022 •

edited

Loading

luhring commented Dec 8, 2022

knqyf263 commented Dec 8, 2022

luhring commented Dec 8, 2022

knqyf263 left a comment

knqyf263 commented Dec 12, 2022

knqyf263 commented Dec 12, 2022 •

edited

Loading

luhring commented Dec 12, 2022

luhring commented Dec 12, 2022

knqyf263 commented Dec 12, 2022 •

edited

Loading

knqyf263 commented Dec 12, 2022

luhring commented Dec 12, 2022

knqyf263 commented Dec 12, 2022

knqyf263 commented Dec 12, 2022

luhring commented Dec 12, 2022

feat: add support for Wolfi Linux #3215

feat: add support for Wolfi Linux #3215

Conversation

luhring commented Nov 22, 2022 • edited Loading

Description

Before

After

Related issues

Related PRs

Checklist

luhring commented Nov 23, 2022

afdesk commented Dec 4, 2022

luhring commented Dec 4, 2022

afdesk commented Dec 4, 2022

luhring commented Dec 4, 2022 • edited Loading

luhring commented Dec 8, 2022

knqyf263 commented Dec 8, 2022

luhring commented Dec 8, 2022

knqyf263 left a comment

Choose a reason for hiding this comment

knqyf263 commented Dec 12, 2022

knqyf263 commented Dec 12, 2022 • edited Loading

luhring commented Dec 12, 2022

luhring commented Dec 12, 2022

knqyf263 commented Dec 12, 2022 • edited Loading

knqyf263 commented Dec 12, 2022

luhring commented Dec 12, 2022

knqyf263 commented Dec 12, 2022

knqyf263 commented Dec 12, 2022

luhring commented Dec 12, 2022

luhring commented Nov 22, 2022 •

edited

Loading

luhring commented Dec 4, 2022 •

edited

Loading

knqyf263 commented Dec 12, 2022 •

edited

Loading

knqyf263 commented Dec 12, 2022 •

edited

Loading