Documentation
¶
Overview ¶
Package trivy scans what an app deploys, with Trivy in a container.
The first scanner adapter (R-317, design 09 §2). It reports vulnerable dependencies, leaked secrets and misconfiguration; static analysis of the app's own code is O-19 and is not in the score.
**Trivy is given no container runtime socket.** The image it scans is saved by Pando — which has the socket already, because the runtime adapter needs one — and copied into the scanner's own filesystem as a file. R-112 forbids a socket in a build for the reason that applies at least as strongly here: a component whose job is to read untrusted code is the last one that should be able to start privileged containers on the host.
It does get the network, because a vulnerability scanner with no vulnerability database is a component that reports every app as clean. The database is cached in a volume so the second scan does not download it again.
Index ¶
- Constants
- func Info() api.KindInfo
- type Adapter
- func (a *Adapter) Category() api.Category
- func (a *Adapter) Configure(_ context.Context, raw json.RawMessage) error
- func (a *Adapter) HealthCheck(ctx context.Context) error
- func (a *Adapter) Kind() string
- func (a *Adapter) Scan(ctx context.Context, req api.ScanRequest) (api.ScanResult, error)
- func (a *Adapter) ScannerCapabilities() api.ScannerCapabilities
- type Config
Constants ¶
const Kind = "trivy"
Kind is the adapter's kind string.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Adapter ¶
type Adapter struct {
// contains filtered or unexported fields
}
Adapter scans images and source trees.
func (*Adapter) Scan ¶
func (a *Adapter) Scan(ctx context.Context, req api.ScanRequest) (api.ScanResult, error)
Scan reads an image, a source tree, or both.
Both when both are given: an image carries the dependencies the app ships with, and the tree carries the secrets and the misconfiguration that never reach one. Findings are merged and deduplicated by ID and target, because a dependency that appears in both should cost what it costs once.
func (*Adapter) ScannerCapabilities ¶
func (a *Adapter) ScannerCapabilities() api.ScannerCapabilities
ScannerCapabilities is data, not a type assertion (R-254).
type Config ¶
type Config struct {
// Host is the Docker endpoint. Empty uses the environment, as the runtime
// adapter does.
Host string `json:"host,omitempty"`
// Image overrides the scanner image. For an air-gapped install with a
// mirror, and for pinning a different version deliberately.
Image string `json:"image,omitempty"`
// Timeout bounds one scan. A scan that never finishes is a deploy that
// never finishes, and R-318 says a scanner that cannot answer must not
// block one.
TimeoutSeconds int `json:"timeout_seconds,omitempty"`
// DBRepository, JavaDBRepository and ChecksBundleRepository are where
// Trivy downloads its vulnerability database, its Java index and its
// misconfiguration checks: OCI references, the first two comma-separated
// in order of priority. Empty leaves Trivy's own defaults, which are on
// mirror.gcr.io and ghcr.io — unreachable from an egress-restricted host,
// which is who sets these to a mirror of their own.
DBRepository string `json:"db_repository,omitempty"`
JavaDBRepository string `json:"java_db_repository,omitempty"`
ChecksBundleRepository string `json:"checks_bundle_repository,omitempty"`
// OfflineScan stops Trivy asking package registries such as Maven
// Central about dependencies it cannot identify locally. It does not stop
// the database downloads; the repositories above are for those.
OfflineScan bool `json:"offline_scan,omitempty"`
}
Config is the adapter's configuration.
Source Files