Trivy's SARIF output doesn't pass NIST SARIF validator

[candrews]

Description

Trivy's SARIF output doesn't pass NIST SARIF validator at https://samate.nist.gov/SARD/sarif-validator failing with these errors:

• property '/runs/0' is missing required keys: properties, artifacts
• property '/runs/0/tool/driver' is missing required keys: organization
• property '/runs/0/results/0/message/text' does not match pattern: ^.*.$
• property '/runs/0/results/0/locations/0/physicalLocation/artifactLocation' is missing required keys: index

Desired Behavior

Trivy's SARIF should pass validation.

Actual Behavior

• property '/runs/0' is missing required keys: properties, artifacts
• property '/runs/0/tool/driver' is missing required keys: organization
• property '/runs/0/results/0/message/text' does not match pattern: ^.*.$
• property '/runs/0/results/0/locations/0/physicalLocation/artifactLocation' is missing required keys: index

Reproduction Steps

1. `trivy image --format sarif -o report.sarif  golang:1.12-alpine`
2. Go to https://samate.nist.gov/SARD/sarif-validator and upload `result.sarif`

Target

None

Scanner

None

Output Format

None

Mode

None

Debug Output

n/a

Operating System

Linux

Version

$ trivy --version
Version: 0.59.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2025-02-24 18:19:31.46822603 +0000 UTC
  NextUpdate: 2025-02-25 18:19:31.468225769 +0000 UTC
  DownloadedAt: 2025-02-24 19:29:21.286705124 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2025-02-14 02:24:51.921228254 +0000 UTC
  NextUpdate: 2025-02-17 02:24:51.921228094 +0000 UTC
  DownloadedAt: 2025-02-24 20:15:07.116719167 +0000 UTC
Check Bundle:
  Digest: sha256:ac89e7d82ab5feeabc055a454066bc182f9248e96b8ecb1ca5810cd59c659800
  DownloadedAt: 2025-02-14 20:22:15.184798138 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[simar7]

Is the NIST validator different in terms of standard than the one by Microsoft/GitHub https://sarifweb.azurewebsites.net/Validation?

[candrews]

The Microsoft/GitHub only validates the parts that GitHub uses and cares about.

The NIST one validates to the complete standard.