chore(trivy): update trivy version and enforce OCI compliant repo names in local image storage #1068
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
andaaron
force-pushed
the
andrei-trivy
branch
6 times, most recently
from
ce97bb8
to
c9dec89
Compare
Codecov Report
@@ Coverage Diff @@
## main #1068 +/- ##
==========================================
- Coverage 89.23% 89.05% -0.18%
==========================================
Files 89 74 -15
Lines 18294 15056 -3238
==========================================
- Hits 16324 13408 -2916
+ Misses 1504 1284 -220
+ Partials 466 364 -102
📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more |
andaaron
force-pushed
the
andrei-trivy
branch
3 times, most recently
from
47a0945
to
dfe1c92
Compare
andaaron
changed the title
andaaron
requested review from
shimish2,
peusebiu and
rchincha
as code owners
andaaron
force-pushed
the
andrei-trivy
branch
from
dfe1c92
to
1fb038b
Compare
andaaron
changed the title
andaaron
force-pushed
the
andrei-trivy
branch
7 times, most recently
from
6f173e6
to
a24f436
Compare
andaaron
force-pushed
the
andrei-trivy
branch
2 times, most recently
from
fd383ea
to
56b5692
Compare
andaaron
force-pushed
the
andrei-trivy
branch
from
56b5692
to
365121d
Compare
|
@shimish2 can you review this pls? |
I already did that. |
andaaron
force-pushed
the
andrei-trivy
branch
9 times, most recently
from
5c11927
to
35da59d
Compare
rchincha
reviewed
Jan 17, 2023
rchincha
reviewed
Jan 17, 2023
rchincha
reviewed
Jan 17, 2023
…es in local image storage 1. chore(trivy): update trivy library version The trivy team switched github.com/urfave/cli for viper so there are some other code changes as well. Since we don't use github.com/urfave/cli directly in our software we needed to add a tools.go in order for "go mod tidy" to not delete it. See this pattern explained in: - https://github.com/99designs/gqlgen#quick-start - https://github.com/golang/go/wiki/Modules#how-can-i-track-tool-dependencies-for-a-module - https://github.com/go-modules-by-example/index/blob/master/010_tools/README.md#walk-through The jobs using "go get -u" have been updated to use "go install", since go get modifies the go.mod by upgrading some of the packages, but downgrading trivy to an older version with broken dependencies 2. fix(storage) Update local storage to ignore folder names not compliant with dist spec Also updated trivy to download the DB and cache results under the rootDir/_trivy folder 3. fix(s3): one of the s3 tests was missing the skipIt call This caused a failure when running locally without s3 being available 4. make sure the offline scanning is enabled, and zot only downloads the trivy DB on the regular schedule, and doesn't download the DB on every image scan ci: increase build and test timeout as tests are reaching the limit more often Signed-off-by: Andrei Aaron <aaaron@luxoft.com>
andaaron
force-pushed
the
andrei-trivy
branch
from
35da59d
to
15d1529
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Originally 4 commits, squashed so the can be signed after rebasing.
The trivy team switched github.com/urfave/cli for viper so
there are some other code changes as well.
Since we don't use github.com/urfave/cli directly in our software
we needed to add a tools.go in order for "go mod tidy" to not delete it.
See this pattern explained in:
The jobs using "go get -u" have been updated to use "go install", since go get
modifies the go.mod by upgrading some of the packages, but downgrading trivy to an older
version with broken dependencies
fix(storage) Update local storage to ignore folder names not compliant with dist spec
Also updated trivy to download the DB and cache results under the rootDir/_trivy folder
fix(s3): one of the s3 tests was missing the skipIt call
This caused a failure when running locally without s3 being available
make sure the offline scanning is enabled, and zot only downloads the trivy DB
on the regular schedule, and doesn't download the DB on every image scan
Signed-off-by: Andrei Aaron andaaron@cisco.com