gitea-mirror/trivy
1
0
Fork 0
mirror of https://github.com/aquasecurity/trivy.git synced 2025-12-23 15:37:50 -08:00
Code Issues Packages Projects Releases Wiki Activity

docs: add coverage (#4954)

Browse Source 
* docs: add coverage

* add more pages

* add dart, dotnet, elixir languages.

* add C, ruby, cocoapods. Update links

* rename headers for dart and elixir

* docs: add Google Distroless and Photon OS

* docs: add IaC

* docs: put vulnerability into a single page

* fixed broken links

* docs: add coverage overview

* update some links

* add note about arch for Rocky linux

* docs: fix typo

* fix typo

* docs: add footnotes

* docs: add a link to coverage in the license section

* docs: add a conversion table

* docs: get aligned

---------

Co-authored-by: DmitriyLewen <dmitriy.lewen@smartforce.io>
This commit is contained in:
Teppei Fukuda
2023-08-17 11:00:34 +03:00
committed by GitHub
parent 6f03c79405
commit a4e981b4ec
58 changed files with 1736 additions and 495 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/docs/advanced/air-gap.md
View File

@@ -139,4 +139,4 @@ $ trivy conf --skip-policy-update /path/to/conf
[allowlist]: ../references/troubleshooting.md
[oras]: https://oras.land/cli/
[^1]: This is only required to scan `jar` files. More information about `Java index db` [here](../scanner/vulnerability/language/java.md)
[^1]: This is only required to scan `jar` files. More information about `Java index db` [here](../coverage/language/java.md)

2
docs/docs/configuration/db.md
View File

@@ -8,7 +8,7 @@
| License | |
The vulnerability database and the Java index database are needed only for vulnerability scanning.
See [here](../scanner/vulnerability/index.md) for the detail.
See [here](../scanner/vulnerability.md) for the detail.
## Vulnerability Database

33
docs/docs/coverage/iac/azure-arm.md Normal file
View File

@@ -0,0 +1,33 @@
# Azure ARM Template
Trivy supports the scanners listed in the table below.
| Scanner | Supported |
| :----------------: | :-------: |
| [Misconfiguration] | ✓ |
| [Secret] | ✓ |
It supports the following configurations:
| Format | Supported |
| :----------: | :-------: |
| ARM template | ✓ |
| Bicep | ✓[^1] |
To scan Bicep codes, you need to convert them into ARM templates first.
```
az bicep build -f main.bicep
or
bicep build main.bicep
```
## Misconfiguration
Trivy recursively searches directories and scans all found Azure ARM templates.
## Secret
The secret scan is performed on plain text files, with no special treatment for Azure ARM templates.
[Misconfiguration]: ../../scanner/misconfiguration/index.md
[Secret]: ../../scanner/secret.md
[^1]: Bicep is not natively supported. It needs to be converted into Azure ARM templates.

24
docs/docs/coverage/iac/cloudformation.md Normal file
View File

@@ -0,0 +1,24 @@
# CloudFormation
Trivy supports the scanners listed in the table below.
| Scanner | Supported |
| :----------------: | :-------: |
| [Misconfiguration] | ✓ |
| [Secret] | ✓ |
It supports the following formats.
| Format | Supported |
| :----: | :-------: |
| JSON | ✓ |
| YAML | ✓ |
## Misconfiguration
Trivy recursively searches directories and scans all found CloudFormation files.
It evaluates properties, functions, and other elements within CloudFormation files to detect misconfigurations.
## Secret
The secret scan is performed on plain text files, with no special treatment for CloudFormation.
[Misconfiguration]: ../../scanner/misconfiguration/index.md
[Secret]: ../../scanner/secret.md

24
docs/docs/coverage/iac/docker.md Normal file
View File

@@ -0,0 +1,24 @@
# Docker
Trivy supports the scanners listed in the table below.
| Scanner | Supported |
| :----------------: | :-------: |
| [Misconfiguration] | ✓ |
| [Secret] | ✓ |
It supports the following configurations.
| Config | Supported |
| :-----------: | :-------: |
| Dockerfile | ✓ |
| Containerfile | ✓ |
| Compose | - |
## Misconfiguration
Trivy recursively searches directories and scans all found Docker files.
## Secret
The secret scan is performed on plain text files, with no special treatment for Dockerfile.
[Misconfiguration]: ../../scanner/misconfiguration/index.md
[Secret]: ../../scanner/secret.md

60
docs/docs/coverage/iac/helm.md Normal file
View File

@@ -0,0 +1,60 @@
# Helm
Trivy supports two types of Helm scanning, templates and packaged charts.
The following scanners are supported.
| Format | [Misconfiguration] | [Secret] |
| -------- | :----------------: | :------: |
| Template | ✓ | ✓ |
| Chart | ✓ | - |
## Misconfiguration
Trivy recursively searches directories and scans all found Helm files.
It evaluates variables, functions, and other elements within Helm templates and resolve the chart to Kubernetes manifests then run the Kubernetes checks.
See [here](../../scanner/misconfiguration/policy/builtin.md) for more details on the built-in policies.
### Value overrides
There are a number of options for overriding values in Helm charts.
When override values are passed to the Helm scanner, the values will be used during the Manifest rendering process and will become part of the scanned artifact.
#### Setting inline value overrides
Overrides can be set inline on the command line
```bash
trivy conf --helm-set securityContext.runAsUser=0 ./charts/mySql
```
#### Setting value file overrides
Overrides can be in a file that has the key=value set.
```yaml
# Example override file (overrides.yaml)
securityContext:
runAsUser: 0
```
```bash
trivy conf --helm-values overrides.yaml ./charts/mySql
```
#### Setting value as explicit string
the `--helm-set-string` is the same as `--helm-set` but explicitly retains the value as a string
```bash
trivy config --helm-set-string name=false ./infrastructure/tf
```
#### Setting specific values from files
Specific override values can come from specific files
```bash
trivy conf --helm-set-file environment=dev.values.yaml ./charts/mySql
```
## Secret
The secret scan is performed on plain text files, with no special treatment for Helm.
Secret scanning is not conducted on the contents of packaged Charts, such as tar or tar.gz.
[Misconfiguration]: ../../scanner/misconfiguration/index.md
[Secret]: ../../scanner/secret.md

21
docs/docs/coverage/iac/index.md Normal file
View File

@@ -0,0 +1,21 @@
# Infrastructure as Code
## Scanner
Trivy scans Infrastructure as Code (IaC) files for
- [Misconfigurations][misconf]
- [Secrets][secret]
## Supported configurations
| Config type | File patterns |
| ----------------------------------- | ----------------------------- |
| [Kubernetes](kubernetes.md) | *.yml, *.yaml, *.json |
| [Docker](docker.md) | Dockerfile, Containerfile |
| [Terraform](terraform.md) | *.tf, *.tf.json, *.tfvars, |
| [CloudFormation](cloudformation.md) | *.yml, *.yaml, *.json |
| [Azure ARM Template](azure-arm.md) | *.json |
| [Helm](helm.md) | *.yaml, *.tpl, *.tar.gz, etc. |
[misconf]: ../../scanner/misconfiguration/index.md
[secret]: ../../scanner/secret.md

31
docs/docs/coverage/iac/kubernetes.md Normal file
View File

@@ -0,0 +1,31 @@
# Kubernetes
Trivy supports the scanners listed in the table below.
| Scanner | Supported |
| :----------------: | :-------: |
| [Misconfiguration] | ✓ |
| [Secret] | ✓ |
In addition to raw YAML and JSON, it supports the following templates:
| Template | Supported |
| :-------------: | :-------: |
| [Helm](helm.md) | ✓ |
| Kustomize | ✓[^1] |
!!! note
Trivy does not support Kustomize overlays, so it scans files defined in the base.
Or, you can scan the output of `kustomize build`.
## Misconfiguration
Trivy recursively searches directories and scans all found Kubernetes files.
## Secret
The secret scan is performed on plain text files, with no special treatment for Kubernetes.
This means that Base64 encoded secrets are not scanned, and only secrets written in plain text are detected.
[Misconfiguration]: ../../scanner/misconfiguration/index.md
[Secret]: ../../scanner/secret.md
[^1]: Kustomize is not natively supported.

45
docs/docs/coverage/iac/terraform.md Normal file
View File

@@ -0,0 +1,45 @@
# Terraform
Trivy supports the scanners listed in the table below.
| Scanner | Supported |
| :--------------: | :-------: |
| Misconfiguration | ✓ |
| Secret | ✓ |
It supports the following formats:
| Format | Supported |
| :-------: | :-------: |
| JSON | ✓ |
| HCL | ✓ |
| Plan JSON | ✓ |
Trivy can scan the results of `terraform plan`.
You can scan by passing the file generated as shown below to Trivy:
```
$ terraform plan --out tfplan.binary
$ terraform show -json tfplan.binary > tfplan.json
```
## Misconfiguration
Trivy recursively searches directories and scans all found Terraform files.
It also evaluates variables, imports, and other elements within Terraform files to detect misconfigurations.
### Value Overrides
You can provide `tf-vars` files to Trivy to override default values specified in the Terraform HCL code.
```bash
trivy conf --tf-vars dev.terraform.tfvars ./infrastructure/tf
```
### Exclude Downloaded Terraform Modules
By default, downloaded modules are also scanned.
If you don't want to scan modules downloaded into the `.terraform` directory, you can use the `--tf-exclude-downloaded-modules` flag.
```bash
trivy conf --tf-exclude-downloaded-modules ./configs
```
## Secret
The secret scan is performed on plain text files, with no special treatment for Terraform.

8
docs/docs/coverage/index.md Normal file
View File

@@ -0,0 +1,8 @@
# Scanning Coverage
Trivy can detect security issues in many different platforms, languages and configuration files.
This section gives a general overview of that coverage, and can help answer the frequently asked question "Does Trivy support X?".
For more detailed information about the specific platforms and languages, check the relevant documentation.
- [OS Packages](os/index.md)
- [Language-specific Packages](language/index.md)
- [IaC files](iac/index.md)

23
docs/docs/coverage/language/c.md Normal file
View File

@@ -0,0 +1,23 @@
# C/C++
Trivy supports [Conan][conan] C/C++ Package Manager.
The following scanners are supported.
| Package manager | SBOM | Vulnerability | License |
| --------------- | :---: | :-----------: | :-----: |
| Conan | ✓ | ✓ | - |
The following table provides an outline of the features Trivy offers.
| Package manager | File | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position |
| --------------- | -------------- | :---------------------: | :--------------: | :----------------------------------: | :------: |
| Conan | conan.lock[^1] | ✓ | Excluded | ✓ | ✓ |
## Conan
In order to detect dependencies, Trivy searches for `conan.lock`[^1].
[conan]: https://docs.conan.io/1/index.html
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
[^1]: `conan.lock` is default name. To scan a custom filename use [file-patterns](../../configuration/skipping.md#file-patterns)

26
docs/docs/coverage/language/dart.md Normal file
View File

@@ -0,0 +1,26 @@
# Dart
Trivy supports [Dart][dart].
The following scanners are supported.
| Package manager | SBOM | Vulnerability | License |
|-------------------------| :---: | :-----------: |:-------:|
| [Dart][dart-repository] | ✓ | ✓ | - |
The following table provides an outline of the features Trivy offers.
| Package manager | File | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position |
|-------------------------|--------------|:-----------------------:|:----------------:|:------------------------------------:|:--------:|
| [Dart][dart-repository] | pubspec.lock | ✓ | Included | - | - |
## Dart
In order to detect dependencies, Trivy searches for `pubspec.lock`.
Trivy marks indirect dependencies, but `pubspec.lock` file doesn't have options to separate root and dev transitive dependencies.
So Trivy includes all dependencies in report.
[dart]: https://dart.dev/
[dart-repository]: https://pub.dev/
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies

34
docs/docs/coverage/language/dotnet.md Normal file
View File

@@ -0,0 +1,34 @@
# .NET
Trivy supports `.NET core` and `NuGet` package managers.
The following scanners are supported.
| Artifact | SBOM | Vulnerability | License |
|-----------|:----:|:-------------:|:-------:|
| .Net Core | ✓ | ✓ | - |
| NuGet | ✓ | ✓ | - |
The following table provides an outline of the features Trivy offers.
| Package manager | File | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position |
|:---------------:|--------------------|:-----------------------:|:----------------:|:------------------------------------:|:--------:|
| .Net Core | *.deps.json | ✓ | Excluded | - | ✓ |
| NuGet | packages.config | ✓ | Excluded | - | - |
| NuGet | packages.lock.json | ✓ | Included | ✓ | ✓ |
### *.deps.json
Trivy parses `*.deps.json` files. Trivy currently excludes dev dependencies from the report.
### packages.config
Trivy only finds dependency names and versions from `packages.config` files. To build dependency graph, it is better to use `packages.lock.json` files.
### packages.lock.json
Don't forgot to [enable][enable-lock] lock files in your project.
!!! tip
Please make sure your lock file is up-to-date after modifying dependencies.
[enable-lock]: https://learn.microsoft.com/en-us/nuget/consume-packages/package-references-in-project-files#enabling-the-lock-file
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies

27
docs/docs/coverage/language/elixir.md Normal file
View File

@@ -0,0 +1,27 @@
# Elixir
Trivy supports [Hex][hex] repository for [Elixir][elixir].
The following scanners are supported.
| Package manager | SBOM | Vulnerability | License |
|-----------------| :---: | :-----------: |:-------:|
| [hex][hex] | ✓ | ✓ | - |
The following table provides an outline of the features Trivy offers.
| Package manager | File | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position |
|-----------------|--------------|:-----------------------:|:----------------:|:------------------------------------:|:--------:|
| [hex][hex] | mix.lock[^1] | ✓ | Excluded | - | ✓ |
## Hex
In order to detect dependencies, Trivy searches for `mix.lock`[^1].
[Configure](https://hexdocs.pm/mix/Mix.Project.html#module-configuration) your project to use `mix.lock`[^1] file.
[elixir]: https://elixir-lang.org/
[hex]: https://hex.pm/
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
[^1]: `mix.lock` is default name. To scan a custom filename use [file-patterns](../../configuration/skipping.md#file-patterns)

25
docs/docs/scanner/vulnerability/language/golang.md → docs/docs/coverage/language/golang.md
View File

@@ -2,12 +2,20 @@
## Features
Trivy supports two types of Go scanning, Go Modules and binaries built by Go.
The following table provides an outline of the features Trivy offers.
| Artifact | Offline[^1] | Dev dependencies | License | Dependency graph |
|----------|:-----------:|:-----------------|:-------:|:----------------:|
| Modules | ✅ | Include | ✅[^2] | ✅[^2] |
| Binaries | ✅ | Exclude | - | - |
The following scanners are supported.
| Artifact | SBOM | Vulnerability | License |
| -------- | :---: | :-----------: | :-----: |
| Modules | ✓ | ✓ | ✓[^2] |
| Binaries | ✓ | ✓ | - |
The table below provides an outline of the features Trivy offers.
| Artifact | Offline[^1] | Dev dependencies | [Dependency graph][dependency-graph] |
|----------|:-----------:|:-----------------|:----------------------------------:|
| Modules | ✅ | Include | ✅[^2] |
| Binaries | ✅ | Exclude | - |
!!! note
Trivy scans only dependencies of the Go project.
@@ -18,7 +26,7 @@ The following table provides an outline of the features Trivy offers.
Depending on Go versions, the required files are different.
| Version | Required files | Offline |
|---------|:--------------:|:-------:|
| ------- | :------------: | :-----: |
| \>=1.17 | go.mod | ✅ |
| <1.17 | go.mod, go.sum | ✅ |
@@ -63,5 +71,10 @@ Also, you can scan your local binaries.
$ trivy fs ./your_binary
```
!!! note
It doesn't work with UPX-compressed binaries.
[^1]: It doesn't require the Internet access.
[^2]: Need to download modules to local cache beforehand
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies

66
docs/docs/coverage/language/index.md Normal file
View File

@@ -0,0 +1,66 @@
# Programming Language
Trivy supports programming languages for
- [SBOM][sbom]
- [Vulnerabilities][vuln]
- [Licenses][license]
## Supported languages
The files analyzed vary depending on the target.
This is because Trivy primarily categorizes targets into two groups:
- Pre-build
- Post-build
If the target is a pre-build project, like a code repository, Trivy will analyze files used for building, such as lock files.
On the other hand, when the target is a post-build artifact, like a container image, Trivy will analyze installed package metadata like `.gemspec`, binary files, and so on.
| Language | File | Image[^5] | Rootfs[^6] | Filesystem[^7] | Repository[^8] |
| -------------------- | ------------------------------------------------------------------------------------------ | :-------: | :--------: | :------------: | :------------: |
| [Ruby](ruby.md) | Gemfile.lock | - | - | ✅ | ✅ |
| | gemspec | ✅ | ✅ | - | - |
| [Python](python.md) | Pipfile.lock | - | - | ✅ | ✅ |
| | poetry.lock | - | - | ✅ | ✅ |
| | requirements.txt | - | - | ✅ | ✅ |
| | egg package[^1] | ✅ | ✅ | - | - |
| | wheel package[^2] | ✅ | ✅ | - | - |
| | conda package[^3] | ✅ | ✅ | - | - |
| [PHP](php.md) | composer.lock | ✅ | ✅ | ✅ | ✅ |
| [Node.js](nodejs.md) | package-lock.json | - | - | ✅ | ✅ |
| | yarn.lock | - | - | ✅ | ✅ |
| | pnpm-lock.yaml | - | - | ✅ | ✅ |
| | package.json | ✅ | ✅ | - | - |
| [.NET](dotnet.md) | packages.lock.json | ✅ | ✅ | ✅ | ✅ |
| | packages.config | ✅ | ✅ | ✅ | ✅ |
| | .deps.json | ✅ | ✅ | ✅ | ✅ |
| [Java](java.md) | JAR/WAR/PAR/EAR[^4] | ✅ | ✅ | - | - |
| | pom.xml | - | - | ✅ | ✅ |
| | *gradle.lockfile | - | - | ✅ | ✅ |
| [Go](golang.md) | Binaries built by Go | ✅ | ✅ | - | - |
| | go.mod | - | - | ✅ | ✅ |
| [Rust](rust.md) | Cargo.lock | ✅ | ✅ | ✅ | ✅ |
| | Binaries built with [cargo-auditable](https://github.com/rust-secure-code/cargo-auditable) | ✅ | ✅ | - | - |
| [C/C++](c.md) | conan.lock | - | - | ✅ | ✅ |
| [Elixir](elixir.md) | mix.lock[^10] | - | - | ✅ | ✅ |
| [Dart](dart.md) | pubspec.lock | - | - | ✅ | ✅ |
| [Swift](swift.md) | Podfile.lock | - | - | ✅ | ✅ |
The path of these files does not matter.
Example: [Dockerfile](https://github.com/aquasecurity/trivy-ci-test/blob/main/Dockerfile)
[sbom]: ../../supply-chain/sbom.md
[vuln]: ../../scanner/vulnerability.md
[license]: ../../scanner/license.md
[^1]: `*.egg-info`, `*.egg-info/PKG-INFO`, `*.egg` and `EGG-INFO/PKG-INFO`
[^2]: `.dist-info/META-DATA`
[^3]: `envs/*/conda-meta/*.json`
[^4]: `*.jar`, `*.war`, `*.par` and `*.ear`
[^5]: ✅ means "enabled" and `-` means "disabled" in the image scanning
[^6]: ✅ means "enabled" and `-` means "disabled" in the rootfs scanning
[^7]: ✅ means "enabled" and `-` means "disabled" in the filesystem scanning
[^8]: ✅ means "enabled" and `-` means "disabled" in the git repository scanning
[^9]: ✅ means that Trivy detects line numbers where each dependency is declared in the scanned file. Only supported in [json](../../configuration/reporting.md#json) and [sarif](../../configuration/reporting.md#sarif) formats. SARIF uses `startline == 1 and endline == 1` for unsupported file types
[^10]: To scan a filename other than the default filename use [file-patterns](../../configuration/skipping.md#file-patterns)

27
docs/docs/scanner/vulnerability/language/java.md → docs/docs/coverage/language/java.md
View File

@@ -1,14 +1,21 @@
# Java
Trivy supports three types of Java scanning: `JAR/WAR/PAR/EAR`, `pom.xml` and `*gradle.lockfile` files.
Each artifact supports the following scanners:
| Artifact | SBOM | Vulnerability | License |
| ---------------- | :---: | :-----------: | :-----: |
| JAR/WAR/PAR/EAR | ✓ | ✓ | - |
| pom.xml | ✓ | ✓ | ✓ |
| *gradle.lockfile | ✓ | ✓ | - |
The following table provides an outline of the features Trivy offers.
| Artifact | Internet access | Dev dependencies | License |
|------------------|:---------------------:|:-----------------|:-------:|
| JAR/WAR/PAR/EAR | Trivy Java DB | Include | - |
| pom.xml | Maven repository [^1] | Exclude | ✅ |
| *gradle.lockfile | - | Exclude | - |
| Artifact | Internet access | Dev dependencies | [Dependency graph][dependency-graph] |
|------------------|:---------------------:|:----------------:|:------------------------------------:|
| JAR/WAR/PAR/EAR | Trivy Java DB | Include | - |
| pom.xml | Maven repository [^1] | Exclude | - |
| *gradle.lockfile | - | Exclude | - |
These may be enabled or disabled depending on the target.
See [here](./index.md) for the detail.
@@ -18,7 +25,7 @@ To find information about your JAR[^2] file, Trivy parses `pom.properties` and `
If those files don't exist or don't contain enough information - Trivy will try to find this JAR[^2] file in [trivy-java-db](https://github.com/aquasecurity/trivy-java-db).
The Java DB will be automatically downloaded/updated when any JAR[^2] file is found.
It is stored in [the cache directory](../../../configuration/cache.md#cache-directory).
It is stored in [the cache directory](../../configuration/cache.md#cache-directory).
!!! warning "EXPERIMENTAL"
Finding JARs in `trivy-java-db` is an experimental function.
@@ -39,7 +46,7 @@ If your machine doesn't have the necessary files - Trivy tries to find the infor
!!! Note
Trivy only takes information about packages. We don't take a list of vulnerabilities for packages from the `maven repository`.
Information about data sources for Java you can see [here](./index.md#data-sources).
Information about data sources for Java you can see [here](../../scanner/vulnerability.md#data-sources_1).
You can disable connecting to the maven repository with the `--offline-scan` flag.
The `--offline-scan` flag does not affect the Trivy database.
@@ -60,3 +67,5 @@ It doesn't require the internet access.
[^4]: e.g. when parent pom.xml file has `../pom.xml` path
[^5]: When you use dependency path in `relativePath` field in pom.xml file
[^6]: `/Users/<username>/.m2/repository` (for Linux and Mac) and `C:/Users/<username>/.m2/repository` (for Windows) by default
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies

26
docs/docs/scanner/vulnerability/language/nodejs.md → docs/docs/coverage/language/nodejs.md
View File

@@ -1,18 +1,27 @@
# Node.js
Trivy supports three types of Node.js package managers: `npm`, `Yarn` and `pnpm`.
The following scanners are supported.
| Artifact | SBOM | Vulnerability | License |
| -------- | :---: | :-----------: | :-----: |
| npm | ✓ | ✓ | ✓ |
| Yarn | ✓ | ✓ | - |
| pnpm | ✓ | ✓ | - |
The following table provides an outline of the features Trivy offers.
| Package manager | File | Transitive dependencies | Dev dependencies | Dependency graph | Position | License |
|:---------------:|-------------------|:-----------------------:|:-----------------:|:----------------:|:--------:|:-------:|
| npm | package-lock.json | ✅ | [Excluded](#npm) | ✅ | ✅ | ✅ |
| Yarn | yarn.lock | ✅ | [Excluded](#yarn) | ✅ | ✅ | - |
| pnpm | pnpm-lock.yaml | ✅ | Excluded | ✅ | - | - |
| Package manager | File | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position |
|:---------------:|-------------------|:-----------------------:|:-----------------:|:------------------------------------:|:--------:|
| npm | package-lock.json | ✓ | [Excluded](#npm) | ✓ | ✓ |
| Yarn | yarn.lock | ✓ | [Excluded](#yarn) | ✓ | ✓ |
| pnpm | pnpm-lock.yaml | ✓ | Excluded | ✓ | - |
In addition, Trivy scans installed packages with `package.json`.
| File | Dependency graph | Position | License |
|--------------|:----------------:|:--------:|:-------:|
| ------------ | :--------------: | :------: | :-----: |
| package.json | - | - | ✅ |
These may be enabled or disabled depending on the target.
@@ -38,7 +47,7 @@ To exclude devDependencies, `package.json` also needs to be present next to `yar
By default, Trivy doesn't report development dependencies. Use the `--include-dev-deps` flag to include them.
### pnpm
Trivy parses `pnpm-lock.yaml`, then finds production dependencies and builds a [tree] of dependencies with vulnerabilities.
Trivy parses `pnpm-lock.yaml`, then finds production dependencies and builds a [tree][dependency-graph] of dependencies with vulnerabilities.
## Packages
Trivy parses the manifest files of installed packages in container image scanning and so on.
@@ -47,5 +56,4 @@ Trivy parses the manifest files of installed packages in container image scannin
Trivy searches for `package.json` files under `node_modules` and identifies installed packages.
It only extracts package names, versions and licenses for those packages.
[tree]: ../../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies

14
docs/docs/scanner/vulnerability/language/php.md → docs/docs/coverage/language/php.md
View File

@@ -1,12 +1,19 @@
# PHP
Trivy supports [Composer][composer], which is a tool for dependency management in PHP.
The following scanners are supported.
| Package manager | SBOM | Vulnerability | License |
| --------------- | :---: | :-----------: | :-----: |
| Composer | ✓ | ✓ | ✓ |
The following table provides an outline of the features Trivy offers.
| Package Manager | File | Transitive dependencies | Dev dependencies | Dependency graph | Position | License |
|-----------------|---------------|:-----------------------:|:----------------:|:----------------:|:--------:|:-------:|
| Composer | composer.lock | ✅ | Excluded | ✅ | ✅ | ✅ |
| Package manager | File | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position |
|-----------------|---------------|:-----------------------:|:----------------:|:------------------------------------:|:--------:|
| Composer | composer.lock | ✓ | Excluded | ✓ | ✓ |
## Composer
In order to detect dependencies, Trivy searches for `composer.lock`.
@@ -16,3 +23,4 @@ Since this information is not included in `composer.lock`, Trivy parses `compose
If you want to see the dependency tree, please ensure that `composer.json` is present.
[composer]: https://getcomposer.org/
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies

39
docs/docs/scanner/vulnerability/language/python.md → docs/docs/coverage/language/python.md
View File

@@ -1,20 +1,37 @@
# Python
Trivy supports three types of Python package managers: `pip`, `Pipenv` and `Poetry`.
The following scanners are supported for package managers.
| Package manager | SBOM | Vulnerability | License |
| --------------- | :---: | :-----------: | :-----: |
| pip | ✓ | ✓ | - |
| Pipenv | ✓ | ✓ | - |
| Poetry | ✓ | ✓ | - |
In addition, Trivy supports three formats of Python packages: `egg`, `wheel` and `conda`.
The following scanners are supported for Python packages.
| Packaging | SBOM | Vulnerability | License |
| --------- | :---: | :-----------: | :-----: |
| Egg | ✓ | ✓ | ✓ |
| Wheel | ✓ | ✓ | ✓ |
| Conda | ✓ | - | - |
The following table provides an outline of the features Trivy offers.
| Package manager | File | Transitive dependencies | Dev dependencies | Dependency graph | Position | License |
|-----------------|------------------|:-----------------------:|:----------------:|:----------------:|:--------:|:-------:|
| pip | requirements.txt | - | Include | - | - | - |
| Pipenv | Pipfile.lock | ✅ | Include | - | ✅ | - |
| Poetry | poetry.lock | ✅ | Exclude | ✅ | | - |
| Package manager | File | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position |
|-----------------|------------------|:-----------------------:|:----------------:|:------------------------------------:|:--------:|
| pip | requirements.txt | - | Include | - | - |
| Pipenv | Pipfile.lock | ✓ | Include | - | ✓ |
| Poetry | poetry.lock | ✓ | Exclude | ✓ | |
In addition, Trivy supports two formats of Python packages: `egg` and `wheel`.
| Packaging | License |
|-----------|:-------:|
| Egg | ✅ |
| Wheel | ✅ |
| Packaging | Dependency graph |
| --------- | :--------------: |
| Egg | ✓ |
| Wheel | ✓ |
These may be enabled or disabled depending on the target.
See [here](./index.md) for the detail.
@@ -73,3 +90,5 @@ Trivy looks for `*.egg-info`, `*.egg-info/PKG-INFO`, `*.egg` and `EGG-INFO/PKG-I
### Wheel
Trivy looks for `.dist-info/META-DATA` to identify Python packages.
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies

30
docs/docs/coverage/language/ruby.md Normal file
View File

@@ -0,0 +1,30 @@
# Ruby
Trivy supports [Bundler][bundler] and [RubyGems][rubygems].
The following scanners are supported for Cargo.
| Package manager | SBOM | Vulnerability | License |
|-----------------|:----:|:-------------:|:-------:|
| Bundler | ✓ | ✓ | - |
| RubyGems | ✓ | ✓ | ✓ |
The following table provides an outline of the features Trivy offers.
| Package manager | File | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position |
|-----------------|--------------|:-----------------------:|:-----------------|:------------------------------------:|:--------:|
| Bundler | Gemfile.lock | ✓ | Included | ✓ | ✓ |
| RubyGems | .gemspec | - | Included | - | - |
### Bundler
Trivy searches for `Gemfile.lock` to detect dependencies.
### RubyGems
`.gemspec` files doesn't contains transitive dependencies. You need to scan each `.gemspec` file separately.
[bundler]: https://bundler.io
[rubygems]: https://rubygems.org/
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies

29
docs/docs/scanner/vulnerability/language/rust.md → docs/docs/coverage/language/rust.md
View File

@@ -1,18 +1,29 @@
# Rust
## Features
Trivy supports [Cargo](https://doc.rust-lang.org/stable/cargo/), which is the Rust package manager.
The following table provides an outline of the features Trivy offers.
The following scanners are supported for Cargo.
| Package manager | File | Transitive dependencies | Dev dependencies | License | Dependency graph | Position |
|-----------------|------------|:-----------------------:|:-----------------|:-------:|:----------------:|:--------:|
| Cargo | Cargo.lock | ✅ | Excluded[^1] | - | ✅ | ✅ |
| Package manager | SBOM | Vulnerability | License |
| --------------- | :---: | :-----------: | :-----: |
| Cargo | ✓ | ✓ | - |
In addition, it supports binaries built with [cargo-auditable](https://github.com/rust-secure-code/cargo-auditable).
| Artifact | Transitive dependencies | Dev dependencies | License | Dependency graph | Position |
|----------|:-----------------------:|:-----------------|:-------:|:----------------:|:--------:|
| Binaries | ✅ | Excluded | - | - | - |
| Artifact | SBOM | Vulnerability | License |
| -------- | :---: | :-----------: | :-----: |
| Binaries | ✓ | ✓ | - |
## Features
The following table provides an outline of the features Trivy offers.
| Package manager | File | Transitive dependencies | Dev dependencies | [Dependency graph][dependency-graph] | Position |
|-----------------|------------|:-----------------------:|:-----------------|:------------------------------------:|:--------:|
| Cargo | Cargo.lock | ✓ | Excluded[^1] | ✓ | ✓ |
| Artifact | Transitive dependencies | Dev dependencies | Dependency graph | Position |
| -------- | :---------------------: | :--------------- | :--------------: | :------: |
| Binaries | ✓ | Excluded | - | - |
### Cargo
@@ -29,3 +40,5 @@ Trivy scans binaries built with [cargo-auditable](https://github.com/rust-secure
If such a binary exists, Trivy will identify it as being built with cargo-audit and scan it.
[^1]: When you scan Cargo.lock and Cargo.toml together.
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies

10
docs/docs/coverage/language/swift.md Normal file
View File

@@ -0,0 +1,10 @@
# Swift
Trivy supports [CocoaPods][cocoapods] for Swift packages.
The following scanners are supported.
| Package manager | SBOM | Vulnerability | License |
| --------------- | :---: | :-----------: | :-----: |
| CocoaPods | ✓ | - | - |
[cocoapods]: https://cocoapods.org/

73
docs/docs/coverage/os/alma.md Normal file
View File

@@ -0,0 +1,73 @@
# AlmaLinux
Trivy supports the following scanners for OS packages.
| Scanner | Supported |
| :-----------: | :-------: |
| SBOM | ✓ |
| Vulnerability | ✓ |
| License | ✓ |
Please see [here](index.md#supported-os) for supported versions.
The table below outlines the features offered by Trivy.
| Feature | Supported |
|:------------------------------------:|:---------:|
| Unfixed vulnerabilities | - |
| [Dependency graph][dependency-graph] | ✓ |
## SBOM
Trivy detects packages that have been installed through package managers such as `dnf` and `yum`.
## Vulnerability
AlmaLinux offers its own security advisories, and these are utilized when scanning AlmaLinux for vulnerabilities.
### Data Source
See [here](../../scanner/vulnerability.md#data-sources).
### Fixed Version
When looking at fixed versions, it's crucial to consider the patches supplied by AlmaLinux.
For example, for CVE-2023-0464, the fixed version for AlmaLinux 9 is listed as `3.0.7-16.el9_2` in [their advisory][ALSA-2023:3722].
Note that this is different from the upstream fixed version, which is `3.0.9`, `3.1.1`, and son on.
Typically, only the upstream information gets listed on [NVD], so it's important not to get confused.
### Severity
Trivy calculates the severity of an issue based on the severity provided by AlmaLinux.
If the severity is not provided or defined yet by AlmaLinux, the severity from the NVD is taken into account.
Using CVE-2023-0464 as an example, while it is rated as "High" in NVD, AlmaLinux has marked as ["moderate"][ALSA-2023:3722].
As a result, Trivy will display it as "Medium".
The table below is the mapping of AlmaLinux's severity to Trivy's severity levels.
| AlmaLinux | Trivy |
| :-------: | :------: |
| Low | Low |
| Moderate | Medium |
| Important | High |
| Critical | Critical |
### Status
Trivy supports the following [vulnerability statuses] for AlmaLinux.
| Status | Supported |
| :-----------------: | :-------: |
| Fixed | ✓ |
| Affected | ✓ |
| Under Investigation | |
| Will Not Fix | |
| Fix Deferred | |
| End of Life | |
## License
Trivy identifies licenses by examining the metadata of RPM packages.
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
[errata]: https://errata.almalinux.org/
[ALSA-2023:3722]: https://errata.almalinux.org/9/ALSA-2023-3722.html
[NVD]: https://nvd.nist.gov/vuln/detail/CVE-2023-0464
[vulnerability statuses]: ../../configuration/filtering.md#by-status

59
docs/docs/coverage/os/alpine.md Normal file
View File

@@ -0,0 +1,59 @@
# Alpine Linux
Trivy supports the following scanners for OS packages.
| Scanner | Supported |
| :-----------: | :-------: |
| SBOM | ✓ |
| Vulnerability | ✓ |
| License | ✓ |
Please see [here](index.md#supported-os) for supported versions.
The table below outlines the features offered by Trivy.
| Feature | Supported |
|:------------------------------------:|:---------:|
| Unfixed vulnerabilities | - |
| [Dependency graph][dependency-graph] | ✓ |
## SBOM
Trivy detects packages that have been installed through `apk`.
## Vulnerability
Alpine Linux offers its own security advisories, and these are utilized when scanning Alpine for vulnerabilities.
### Data Source
See [here](../../scanner/vulnerability.md#data-sources).
### Fixed Version
When looking at fixed versions, it's crucial to consider the patches supplied by Alpine.
For example, for CVE-2023-0464, the fixed version for Alpine Linux is listed as `3.1.0-r1` in [the secfixes][CVE-2023-0464].
Note that this is different from the upstream fixed version, which is `3.1.1`.
Typically, only the upstream information gets listed on [NVD], so it's important not to get confused.
### Severity
For Alpine vulnerabilities, the severity is determined using the values set by NVD.
### Status
Trivy supports the following [vulnerability statuses] for Alpine.
| Status | Supported |
| :-----------------: | :-------: |
| Fixed | ✓ |
| Affected | ✓ |
| Under Investigation | |
| Will Not Fix | |
| Fix Deferred | |
| End of Life | |
## License
Trivy identifies licenses by examining the metadata of APK packages.
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
[secdb]: https://secdb.alpinelinux.org/
[CVE-2023-0464]: https://gitlab.alpinelinux.org/alpine/aports/-/blob/dad5b7380ab3be705951ce6fd2d7bba513d6a744/main/openssl/APKBUILD#L36-37
[NVD]: https://nvd.nist.gov/vuln/detail/CVE-2023-0464
[vulnerability statuses]: ../../configuration/filtering.md#by-status

72
docs/docs/coverage/os/amazon.md Normal file
View File

@@ -0,0 +1,72 @@
# Amazon Linux
Trivy supports the following scanners for OS packages.
| Scanner | Supported |
| :-----------: | :-------: |
| SBOM | ✓ |
| Vulnerability | ✓ |
| License | ✓ |
Please see [here](index.md#supported-os) for supported versions.
The table below outlines the features offered by Trivy.
| Feature | Supported |
|:------------------------------------:|:---------:|
| Unfixed vulnerabilities | - |
| [Dependency graph][dependency-graph] | ✓ |
## SBOM
Trivy detects packages that have been installed through package managers such as `dnf` and `yum`.
## Vulnerability
Amazon Linux offers its own security advisories, and these are utilized when scanning Amazon Linux for vulnerabilities.
### Data Source
See [here](../../scanner/vulnerability.md#data-sources).
### Fixed Version
When looking at fixed versions, it's crucial to consider the patches supplied by Amazon.
For example, for CVE-2023-0464, the fixed version for Amazon Linux 2023 is listed as `3.0.8-1.amzn2023.0.2` in [ALAS2023-2023-181].
Note that this is different from the upstream fixed version, which is `3.0.9`, `3.1.1`, and so on.
Typically, only the upstream information gets listed on [NVD], so it's important not to get confused.
### Severity
Trivy determines vulnerability severity based on the severity metric provided by Amazon.
For example, the security patch for [CVE-2023-0464] in Amazon Linux 2023 is provided as [ALAS2023-2023-181].
Its severity is rated as "Medium".
Thus, even though it's evaluated as "HIGH" in the NVD, Trivy displays it with a severity of "MEDIUM".
The table below is the mapping of Amazon's severity to Trivy's severity levels.
| Amazon | Trivy |
| :-------: | :------: |
| Low | Low |
| Medium | Medium |
| Important | High |
| Critical | Critical |
### Status
Trivy supports the following [vulnerability statuses] for Amazon Linux.
| Status | Supported |
| :-----------------: | :-------: |
| Fixed | ✓ |
| Affected | ✓ |
| Under Investigation | |
| Will Not Fix | |
| Fix Deferred | |
| End of Life | |
## License
Trivy identifies licenses by examining the metadata of RPM packages.
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
[center]: https://alas.aws.amazon.com/
[CVE-2023-0464]: https://alas.aws.amazon.com/cve/html/CVE-2023-0464.html
[ALAS2023-2023-181]: https://alas.aws.amazon.com/AL2023/ALAS-2023-181.html
[NVD]: https://nvd.nist.gov/vuln/detail/CVE-2023-0464
[vulnerability statuses]: ../../configuration/filtering.md#by-status

66
docs/docs/coverage/os/cbl-mariner.md Normal file
View File

@@ -0,0 +1,66 @@
# CBL-Mariner
Trivy supports the following scanners for OS packages.
| Version | SBOM | Vulnerability | License |
| ---------------- | :---: | :-----------: | :-----: |
| 1.0 | ✔ | ✔ | ✔ |
| 1.0 (Distroless) | ✔ | ✔ | |
| 2.0 | ✔ | ✔ | ✔ |
| 2.0 (Distroless) | ✔ | ✔ | |
The following table provides an outline of the targets Trivy supports.
| Version | Container image | Virtual machine | Arch |
| ------- | :-------------: | :-------------: | :----------: |
| 1.0 | ✔ | ✔ | amd64, arm64 |
| 2.0 | ✔ | ✔ | amd64, arm64 |
The table below outlines the features offered by Trivy.
| Feature | Supported |
|:------------------------------------:|:---------:|
| Detect unfixed vulnerabilities | ✓ |
| [Dependency graph][dependency-graph] | ✓ |
## SBOM
Trivy detects packages that have been installed through package managers such as `dnf` and `yum`.
## Vulnerability
CBL-Mariner offers its own security advisories, and these are utilized when scanning CBL-Mariner for vulnerabilities.
### Data Source
See [here](../../scanner/vulnerability.md#data-sources).
### Fixed Version
Trivy takes fixed versions from [CBL-Mariner OVAL][oval].
### Severity
Trivy calculates the severity of an issue based on the severity provided in [CBL-Mariner OVAL][oval].
### Status
Trivy supports the following [vulnerability statuses] for CBL-Mariner.
| Status | Supported |
| :-----------------: | :-------: |
| Fixed | ✓ |
| Affected | ✓ |
| Under Investigation | |
| Will Not Fix | |
| Fix Deferred | |
| End of Life | |
## License
Trivy identifies licenses by examining the metadata of RPM packages.
!!! note
License detection is not supported for CBL-Mariner Distroless.
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
[cbl-mariner]: https://github.com/microsoft/CBL-Mariner
[oval]: https://github.com/microsoft/CBL-MarinerVulnerabilityData/
[vulnerability statuses]: ../../configuration/filtering.md#by-status

38
docs/docs/coverage/os/centos.md Normal file
View File

@@ -0,0 +1,38 @@
# CentOS
Trivy supports the following scanners for OS packages.
| Scanner | Supported |
| :-----------: | :-------: |
| SBOM | ✓ |
| Vulnerability | ✓ |
| License | ✓ |
Please see [here](index.md#supported-os) for supported versions.
The table below outlines the features offered by Trivy.
| Feature | Supported |
| :-----------------------------------: | :-------: |
| Unfixed vulnerabilities | ✓ |
| [Dependency graph][dependency-graph] | ✓ |
## SBOM
Same as [RHEL](rhel.md#sbom).
## Vulnerability
CentOS does not provide straightforward machine-readable security advisories.
As a result, Trivy utilizes the security advisories from [Red Hat Enterprise Linux (RHEL)](rhel.md#vulnerability) for detecting vulnerabilities in CentOS.
This approach might lead to situations where, even though Trivy displays a fixed version, CentOS might not have the patch available yet.
Since patches released for RHEL often become available in CentOS after some time, it's usually just a matter of waiting.
!!! note
The case for CentOS Stream, which is not supported by Trivy, is entirely different from CentOS.
As Trivy relies on Red Hat's advisories, please refer to [Red Hat](rhel.md) for details regarding vulnerability severity and status.
## License
Same as [RHEL](rhel.md#license).
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies

32
docs/docs/coverage/os/chainguard.md Normal file
View File

@@ -0,0 +1,32 @@
# Chainguard
Trivy supports the following scanners for OS packages.
| Scanner | Supported |
| :-----------: | :-------: |
| SBOM | ✓ |
| Vulnerability | ✓ |
| License | ✓ |
The table below outlines the features offered by Trivy.
| Feature | Supported |
| :-----------------------------------: | :-------: |
| Detect unfixed vulnerabilities | - |
| [Dependency graph][dependency-graph] | ✓ |
## SBOM
Same as [Alpine Linux](alpine.md#sbom).
## Vulnerability
Chainguard offers its own security advisories, and these are utilized when scanning Chainguard for vulnerabilities.
Everything else is the same as [Alpine Linux](alpine.md#vulnerability).
### Data Source
See [here](../../scanner/vulnerability.md#data-sources).
## License
Same as [Alpine Linux](alpine.md#license).
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
[secdb]: https://packages.cgr.dev/chainguard/security.json

74
docs/docs/coverage/os/debian.md Normal file
View File

@@ -0,0 +1,74 @@
# Debian
Trivy supports the following scanners for OS packages.
| Scanner | Supported |
| :-----------: | :-------: |
| SBOM | ✓ |
| Vulnerability | ✓ |
| License | ✓ |
Please see [here](index.md#supported-os) for supported versions.
The table below outlines the features offered by Trivy.
| Feature | Supported |
| :-----------------------------------: | :-------: |
| Unfixed vulnerabilities | ✓ |
| [Dependency graph][dependency-graph] | ✓ |
## SBOM
Trivy detects packages that have been installed through package managers such as `apt` and `dpkg`.
While there are some exceptions, like Go binaries and JAR files, it's important to note that binaries that have been custom-built using `make` or tools installed via `curl` are generally not detected.
## Vulnerability
Debian offers its own security advisories, and these are utilized when scanning Debian for vulnerabilities.
### Data Source
See [here](../../scanner/vulnerability.md#data-sources).
### Fixed Version
When looking at fixed versions, it's crucial to consider the patches supplied by Debian.
For example, for CVE-2023-3269, the fixed version for Debian 12 (bookworm) is listed as `6.1.37-1` in [the Security Tracker][CVE-2023-3269].
This patch is provided in [DSA-5448-1].
Note that this is different from the upstream fixed version, which is `6.5`.
Typically, only the upstream information gets listed on [NVD], so it's important not to get confused.
### Severity
Trivy calculates the severity of an issue based on the 'Urgency' metric found in the Security Tracker.
If 'Urgency' isn't provided by Debian, the severity from the NVD is taken into account.
Using CVE-2019-15052 as an example, while it is rated as "Critical" in NVD, Debian has marked its "Urgency" as ["Low"][CVE-2019-15052].
As a result, Trivy will display it as "Low".
### Status
Trivy supports the following [vulnerability statuses] for Debian.
| Status | Supported |
| :-----------------: | :-------: |
| Fixed | ✓ |
| Affected | ✓ |
| Under Investigation | |
| Will Not Fix | |
| Fix Deferred | ✓ |
| End of Life | ✓ |
## License
To identify the license of a package, Trivy checks the copyright file located at `/usr/share/doc/*/copyright`.
However, this method has its limitations as the file isn't machine-readable, leading to situations where the license isn't detected.
In such scenarios, the `--license-full` flag can be passed.
It compares the contents of known licenses with the copyright file to discern the license in question.
Please be aware that using this flag can increase memory usage, so it's disabled by default for efficiency.
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
[debian-tracker]: https://security-tracker.debian.org/tracker/
[debian-oval]: https://www.debian.org/security/oval/
[CVE-2023-3269]: https://security-tracker.debian.org/tracker/CVE-2023-3269
[CVE-2019-15052]: https://security-tracker.debian.org/tracker/CVE-2019-15052
[DSA-5448-1]: https://security-tracker.debian.org/tracker/DSA-5448-1
[NVD]: https://nvd.nist.gov/vuln/detail/CVE-2023-3269
[vulnerability statuses]: ../../configuration/filtering.md#by-status

34
docs/docs/coverage/os/google-distroless.md Normal file
View File

@@ -0,0 +1,34 @@
# Google Distroless
Trivy supports the following scanners for OS packages.
| Scanner | Supported |
| :-----------: | :-------: |
| SBOM | ✓ |
| Vulnerability | ✓ |
| License | ✓ |
Please see [here](index.md#supported-os) for supported versions.
The table below outlines the features offered by Trivy.
| Feature | Supported |
| :----------------------------------: | :-------: |
| Unfixed vulnerabilities | - |
| [Dependency graph][dependency-graph] | ✓ |
## SBOM
Trivy detects packages pre-installed in distroless images.
## Vulnerability
Google Distroless is based on [Debian]; see there for details.
## License
Google Distroless is based on [Debian]; see there for details.
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
[metadata]: https://packages.vmware.com/photon/photon_cve_metadata/
[vulnerability statuses]: ../../configuration/filtering.md#by-status
[Debian]: debian.md

39
docs/docs/coverage/os/index.md Normal file
View File

@@ -0,0 +1,39 @@
# OS
## Scanner
Trivy supports operating systems for
- [SBOM][sbom]
- [Vulnerabilities][vuln]
- [Licenses][license]
## Supported OS
| OS | Supported Versions | Package Managers |
|-----------------------------------------------|-------------------------------------|------------------|
| [Alpine Linux](alpine.md) | 2.2 - 2.7, 3.0 - 3.18, edge | apk |
| [Wolfi Linux](wolfi.md) | (n/a) | apk |
| [Chainguard](chainguard.md) | (n/a) | apk |
| [Red Hat Enterprise Linux](rhel.md) | 6, 7, 8 | dnf/yum/rpm |
| [CentOS](centos.md)[^1] | 6, 7, 8 | dnf/yum/rpm |
| [AlmaLinux](alma.md) | 8, 9 | dnf/yum/rpm |
| [Rocky Linux](rocky.md) | 8, 9 | dnf/yum/rpm |
| [Oracle Linux](oracle.md) | 5, 6, 7, 8 | dnf/yum/rpm |
| [CBL-Mariner](cbl-mariner.md) | 1.0, 2.0 | dnf/yum/rpm |
| [Amazon Linux](amazon.md) | 1, 2, 2023 | dnf/yum/rpm |
| [openSUSE Leap](suse.md) | 42, 15 | zypper/rpm |
| [SUSE Enterprise Linux](suse.md) | 11, 12, 15 | zypper/rpm |
| [Photon OS](photon.md) | 1.0, 2.0, 3.0, 4.0 | tndf/yum/rpm |
| [Debian GNU/Linux](debian.md) | 7, 8, 9, 10, 11, 12 | apt/dpkg |
| [Ubuntu](ubuntu.md) | All versions supported by Canonical | apt/dpkg |
| [Google Distroless](google-distroless.md)[^2] | Any | apt/dpkg |
Each page gives more details.
[^1]: CentOS Stream is not supported
[^2]: https://github.com/GoogleContainerTools/distroless
[sbom]: ../../supply-chain/sbom.md
[vuln]: ../../scanner/vulnerability.md
[license]: ../../scanner/license.md

70
docs/docs/coverage/os/oracle.md Normal file
View File

@@ -0,0 +1,70 @@
# Oracle Linux
Trivy supports the following scanners for OS packages.
| Scanner | Supported |
| :-----------: | :-------: |
| SBOM | ✓ |
| Vulnerability | ✓ |
| License | ✓ |
Please see [here](index.md#supported-os) for supported versions.
The table below outlines the features offered by Trivy.
| Feature | Supported |
| :-----------------------------------: | :-------: |
| Unfixed vulnerabilities | - |
| [Dependency graph][dependency-graph] | ✓ |
## SBOM
Trivy detects packages that have been installed through package managers such as `dnf` and `yum`.
## Vulnerability
Oracle Linux offers its own security advisories, and these are utilized when scanning Oracle Linux for vulnerabilities.
### Data Source
See [here](../../scanner/vulnerability.md#data-sources).
### Fixed Version
Trivy takes fixed versions from [Oracle security advisories][alerts].
### Severity
Trivy determines vulnerability severity based on the severity metric provided in [Oracle security advisories][alerts].
For example, the security patch for [CVE-2023-0464][CVE-2023-0464] is provided as [ELSA-2023-2645][ELSA-2023-2645].
Its severity is rated as "MODERATE".
Thus, even though it's evaluated as "HIGH" in the NVD, Trivy displays it with a severity of "MEDIUM".
The table below is the mapping of Oracle's threat to Trivy's severity levels.
| Oracle | Trivy |
| :-------: | :------: |
| Low | Low |
| Moderate | Medium |
| Important | High |
| Critical | Critical |
### Status
Trivy supports the following [vulnerability statuses] for Oracle Linux.
| Status | Supported |
| :-----------------: | :-------: |
| Fixed | ✓ |
| Affected | ✓ |
| Under Investigation | |
| Will Not Fix | |
| Fix Deferred | |
| End of Life | |
## License
Trivy identifies licenses by examining the metadata of RPM packages.
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
[oval]: https://linux.oracle.com/security/oval/
[alerts]: https://www.oracle.com/security-alerts/
[CVE-2023-0464]: https://linux.oracle.com/cve/CVE-2023-0464.html
[ELSA-2023-2645]: https://linux.oracle.com/errata/ELSA-2023-2645.html
[NVD]: https://nvd.nist.gov/vuln/detail/CVE-2023-0464
[vulnerability statuses]: ../../configuration/filtering.md#by-status

54
docs/docs/coverage/os/photon.md Normal file
View File

@@ -0,0 +1,54 @@
# Photon OS
Trivy supports the following scanners for OS packages.
| Scanner | Supported |
| :-----------: | :-------: |
| SBOM | ✓ |
| Vulnerability | ✓ |
| License | ✓ |
Please see [here](index.md#supported-os) for supported versions.
The table below outlines the features offered by Trivy.
| Feature | Supported |
|:------------------------------------:|:---------:|
| Unfixed vulnerabilities | - |
| [Dependency graph][dependency-graph] | ✓ |
## SBOM
Trivy detects packages that have been installed through package managers such as `tdnf` and `yum`.
## Vulnerability
Photon OS offers its own security advisories, and these are utilized when scanning Photon OS for vulnerabilities.
### Data Source
See [here](../../scanner/vulnerability.md#data-sources).
### Fixed Version
Trivy takes fixed versions from [Photon CVE metadata][metadata].
### Severity
Trivy determines the severity of vulnerabilities based on the CVSSv3 score provided by Photon OS.
See [here](../../scanner/vulnerability.md#severity-selection) for the conversion table from CVSS score to severity.
### Status
Trivy supports the following [vulnerability statuses] for Photon OS.
| Status | Supported |
| :-----------------: | :-------: |
| Fixed | ✓ |
| Affected | ✓ |
| Under Investigation | |
| Will Not Fix | |
| Fix Deferred | |
| End of Life | |
## License
Trivy identifies licenses by examining the metadata of RPM packages.
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
[metadata]: https://packages.vmware.com/photon/photon_cve_metadata/
[vulnerability statuses]: ../../configuration/filtering.md#by-status

84
docs/docs/coverage/os/rhel.md Normal file
View File

@@ -0,0 +1,84 @@
# Red Hat Enterprise Linux
Trivy supports the following scanners for OS packages.
| Scanner | Supported |
| :-----------: | :-------: |
| SBOM | ✓ |
| Vulnerability | ✓ |
| License | ✓ |
Please see [here](index.md#supported-os) for supported versions.
The table below outlines the features offered by Trivy.
| Feature | Supported |
| :----------------------------------: | :-------: |
| Unfixed vulnerabilities | ✓ |
| [Dependency graph][dependency-graph] | ✓ |
## SBOM
Trivy detects packages that have been installed through package managers such as `dnf` and `yum`.
## Vulnerability
Red Hat offers its own security advisories, and these are utilized when scanning Red Hat Enterprise Linux (RHEL) for vulnerabilities.
### Data Source
See [here](../../scanner/vulnerability.md#data-sources).
### Fixed Version
When looking at fixed versions, it's crucial to consider the patches supplied by Red Hat.
For example, for CVE-2023-0464, the fixed version for RHEL 9 is listed as `3.0.7-16.el9_2` in [their advisory][CVE-2023-0464].
This patch is provided in [RHSA-2023:3722].
Note that this is different from the upstream fixed version, which is `3.0.9`, `3.1.1`, and so on.
Typically, only the upstream information gets listed on [NVD], so it's important not to get confused.
### Severity
Trivy calculates the severity of a vulnerability based on the 'Impact' metric provided by Red Hat.
If the impact is not provided or defined yet by Red Hat, the severity from the NVD is taken into account.
Using CVE-2023-0464 as an example, while it is rated as "HIGH" in NVD, Red Hat has marked its 'Impact' as ["Low"][CVE-2023-0464].
As a result, Trivy will display it as "Low".
The table below is the mapping of Red Hat's impact to Trivy's severity levels.
| Red Hat | Trivy |
| :-------: | :------: |
| Low | Low |
| Moderate | Medium |
| Important | High |
| Critical | Critical |
### Status
Trivy supports the following [vulnerability statuses] for RHEL.
| Status | Supported |
| :-----------------: | :-------: |
| Fixed | ✓ |
| Affected | ✓ |
| Under Investigation | ✓ |
| Will Not Fix | ✓ |
| Fix Deferred | ✓ |
| End of Life | ✓ |
When a vulnerability status is listed as "End of Life", it means a vulnerability with the impact level assigned to this CVE is no longer covered by its current support lifecycle phase.
The product has been identified to contain the impacted component, but analysis to determine whether it is affected or not by this vulnerability was not performed.
Red Hat advises that the product should be assumed to be affected.
Therefore, Trivy detects vulnerabilities with this status as "End of Life".
On the other hand, for those marked "Under Investigation," the impact is unclear as they are still being examined, so Trivy does not detect them. Once the investigation is completed, the status should be updated.
!!! abstract
Vulnerabilities with a status of "End of Life", where the presence or absence of impact is unclear, are detected by Trivy. However, those with a status of "Under Investigation" are not detected.
## License
Trivy identifies licenses by examining the metadata of RPM packages.
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
[oval]: https://www.redhat.com/security/data/oval/v2/
[api]: https://www.redhat.com/security/data/metrics/
[CVE-2023-0464]: https://access.redhat.com/security/cve/cve-2023-0464
[RHSA-2023:3722]: https://access.redhat.com/errata/RHSA-2023:3722
[NVD]: https://nvd.nist.gov/vuln/detail/CVE-2023-0464
[vulnerability statuses]: ../../configuration/filtering.md#by-status

70
docs/docs/coverage/os/rocky.md Normal file
View File

@@ -0,0 +1,70 @@
# Rocky Linux
Trivy supports the following scanners for OS packages.
| Scanner | Supported |
| :-----------: | :-------: |
| SBOM | ✓ |
| Vulnerability | ✓ |
| License | ✓ |
Please see [here](index.md#supported-os) for supported versions.
The table below outlines the features offered by Trivy.
| Feature | Supported |
|:------------------------------------:|:---------:|
| Unfixed vulnerabilities | - |
| [Dependency graph][dependency-graph] | ✓ |
## SBOM
Trivy detects packages that have been installed through package managers such as `dnf` and `yum`.
## Vulnerability
Rocky Linux offers its own security advisories, and these are utilized when scanning Rocky Linux for vulnerabilities.
### Data Source
See [here](../../scanner/vulnerability.md#data-sources).
### Fixed Version
Trivy takes fixed versions from [Rocky Linux Errata][errata], not NVD or somewhere else.
See [here](../../scanner/vulnerability.md#data-source-selection) for more details.
!!! architectures
There are cases when the vulnerability affects packages of not all architectures.
For example, vulnerable packages for [CVE-2023-0361](https://errata.rockylinux.org/RLSA-2023:1141) are only `aarch64` packages.
Trivy only detects vulnerabilities for packages of your architecture.
### Severity
Trivy calculates the severity of an issue based on the severity provided in [Rocky Linux Errata][errata].
The table below is the mapping of Rocky Linux's severity to Trivy's severity levels.
| Rocky Linux | Trivy |
| :---------: | :------: |
| Low | Low |
| Moderate | Medium |
| Important | High |
| Critical | Critical |
### Status
Trivy supports the following [vulnerability statuses] for Rocky Linux.
| Status | Supported |
| :-----------------: | :-------: |
| Fixed | ✓ |
| Affected | ✓ |
| Under Investigation | |
| Will Not Fix | |
| Fix Deferred | |
| End of Life | |
## License
Trivy identifies licenses by examining the metadata of RPM packages.
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
[updateinfo]: https://download.rockylinux.org/pub/rocky/
[errata]: https://errata.rockylinux.org/
[vulnerability statuses]: ../../configuration/filtering.md#by-status

40
docs/docs/coverage/os/suse.md Normal file
View File

@@ -0,0 +1,40 @@
# SUSE
Trivy supports the following distributions:
- openSUSE Leap
- SUSE Enterprise Linux (SLE)
Please see [here](index.md#supported-os) for supported versions.
Trivy supports these scanners for OS packages.
| Scanner | Supported |
| :-----------: | :-------: |
| SBOM | ✓ |
| Vulnerability | ✓ |
| License | ✓ |
The table below outlines the features offered by Trivy.
| Feature | Supported |
|:------------------------------------:|:---------:|
| Unfixed vulnerabilities | - |
| [Dependency graph][dependency-graph] | ✓ |
## SBOM
Trivy detects packages that have been installed through package managers such as `dnf` and `yum`.
## Vulnerability
SUSE offers its [own security advisories][cvrf], and these are utilized when scanning openSUSE/SLE for vulnerabilities.
### Data Source
See [here](../../scanner/vulnerability.md#data-sources).
## License
Trivy identifies licenses by examining the metadata of RPM packages.
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
[cvrf]: http://ftp.suse.com/pub/projects/security/cvrf/
[vulnerability statuses]: ../../configuration/filtering.md#by-status

65
docs/docs/coverage/os/ubuntu.md Normal file
View File

@@ -0,0 +1,65 @@
# Ubuntu
Trivy supports these scanners for OS packages.
| Scanner | Supported |
| :-----------: | :-------: |
| SBOM | ✓ |
| Vulnerability | ✓ |
| License | ✓ |
Please see [here](index.md#supported-os) for supported versions.
The following table provides an outline of the features Trivy offers.
| Feature | Supported |
|:------------------------------------:|:---------:|
| Detect unfixed vulnerabilities | ✓ |
| [Dependency graph][dependency-graph] | ✓ |
## SBOM
Same as [Debian](debian.md#sbom).
## Vulnerability
Ubuntu offers its own security advisories, and these are utilized when scanning Ubuntu for vulnerabilities.
### Data Source
See [here](../../scanner/vulnerability.md#data-sources).
### Fixed Version
When looking at fixed versions, it's crucial to consider the patches supplied by Ubuntu.
As an illustration, for CVE-2023-3269, the fixed version for Ubuntu 23.04 (lunar) is listed as `6.2.0-26.26` in [the Security Tracker][CVE-2023-3269].
It's essential to recognize that this differs from the upstream fixed version, which stands at `6.5`.
Typically, only the upstream information gets listed on [NVD][CVE-2023-3269 NVD], so it's important not to get confused.
### Severity
Trivy calculates the severity of an issue based on the 'Priority' metric found in the Security Tracker.
If 'Priority' isn't provided by Ubuntu, the severity from the NVD is taken into account.
Using CVE-2019-15052 as an example, while it is rated as ["Critical" in NVD][CVE-2019-15052 NVD], Ubuntu has marked its "Priority" as ["Medium"][CVE-2019-15052].
As a result, Trivy will display it as "Medium".
### Status
Trivy supports the following [vulnerability statuses] for Ubuntu.
| Status | Supported |
| :-----------------: | :-------: |
| Fixed | ✓ |
| Affected | ✓ |
| Under Investigation | |
| Will Not Fix | |
| Fix Deferred | |
| End of Life | |
## License
Same as [Debian](debian.md#license).
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
[Ubuntu CVE Tracker]: https://ubuntu.com/security/cve
[CVE-2023-3269]: https://ubuntu.com/security/CVE-2023-3269
[CVE-2019-15052]: https://ubuntu.com/security/CVE-2019-15052
[CVE-2023-3269 NVD]: https://nvd.nist.gov/vuln/detail/CVE-2023-3269
[CVE-2019-15052 NVD]: https://nvd.nist.gov/vuln/detail/CVE-2019-15052
[vulnerability statuses]: ../../configuration/filtering.md#by-status

31
docs/docs/coverage/os/wolfi.md Normal file
View File

@@ -0,0 +1,31 @@
# Wolfi Linux
Trivy supports these scanners for OS packages.
| Scanner | Supported |
| :-----------: | :-------: |
| SBOM | ✓ |
| Vulnerability | ✓ |
| License | ✓ |
The table below outlines the features offered by Trivy.
| Feature | Supported |
|:------------------------------------:|:---------:|
| Detect unfixed vulnerabilities | - |
| [Dependency graph][dependency-graph] | ✓ |
## SBOM
Same as [Alpine Linux](alpine.md#sbom).
## Vulnerability
Wolfi Linux offers its own security advisories, and these are utilized when scanning Wolfi for vulnerabilities.
Everything else is the same as [Alpine Linux](alpine.md#vulnerability).
### Data Source
See [here](../../scanner/vulnerability.md#data-sources).
## License
Same as [Alpine Linux](alpine.md#license).
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
[secdb]: https://packages.wolfi.dev/os/security.json

7
docs/docs/scanner/license.md
View File

@@ -17,6 +17,8 @@ License are classified using the [Google License Classification][google-license-
As those licenses may be in violation, it is recommended to check those unknown licenses as well.
By default, Trivy scans licenses for packages installed by `apk`, `apt-get`, `dnf`, `npm`, `pip`, `gem`, etc.
Check out [the coverage document][coverage] for details.
To enable extended license scanning, you can use `--license-full`.
In addition to package licenses, Trivy scans source code files, Markdown documents, text files and `LICENSE` documents to identify license usage within the image or filesystem.
@@ -29,14 +31,14 @@ To configure the confidence level, you can use `--license-confidence-level`. Thi
Currently, the standard license scanning doesn't support filesystem and repository scanning.
| License scanning | Image | Rootfs | Filesystem | Repository |
|:---------------------:|:-----:|:------:|:----------:|:----------:|
| :-------------------: | :---: | :----: | :--------: | :--------: |
| Standard | ✅ | ✅ | - | - |
| Full (--license-full) | ✅ | ✅ | ✅ | ✅ |
License checking classifies the identified licenses and map the classification to severity.
| Classification | Severity |
|----------------|----------|
| -------------- | -------- |
| Forbidden | CRITICAL |
| Restricted | HIGH |
| Reciprocal | MEDIUM |
@@ -343,4 +345,5 @@ license:
```
[coverage]: ../coverage/index.md
[google-license-classification]: https://opensource.google/documentation/reference/thirdparty/licenses

5
docs/docs/scanner/misconfiguration/custom/index.md
View File

@@ -14,7 +14,7 @@ As for `--namespaces` option, the detail is described as below.
If a file name matches the following file patterns, Trivy will parse the file and pass it as input to your Rego policy.
| File format | File pattern |
|---------------|-----------------------------------------------------------|
| ------------- | --------------------------------------------------------- |
| JSON | `*.json` |
| YAML | `*.yaml` and `*.yml` |
| Dockerfile | `Dockerfile`, `Dockerfile.*`, and `*.Dockerfile` |
@@ -125,7 +125,7 @@ schema that will be used is based on the input document type. It is recommended
correct and do not reference incorrect properties/values.
| Field name | Allowed values | Default value | In table | In JSON |
|----------------------------|-------------------------------------------------------------------|:----------------------------:|:----------------:|:----------------:|
| -------------------------- | ----------------------------------------------------------------- | :--------------------------: | :--------------: | :--------------: |
| title | Any characters | N/A | :material-check: | :material-check: |
| description | Any characters | | :material-close: | :material-check: |
| schemas.input | `schema["kubernetes"]`, `schema["dockerfile"]`, `schema["cloud"]` | (applied to all input types) | :material-close: | :material-close: |
@@ -178,6 +178,7 @@ You can specify input format via the `custom.input` annotation.
Even if a Dockerfile exists in the specified directory, it will not be passed to the policy as input.
Possible values for input types are:
- `dockerfile` (Dockerfile)
- `kubernetes` (Kubernetes YAML/JSON)
- `rbac` (Kubernetes RBAC YAML/JSON)

51
docs/docs/scanner/misconfiguration/index.md
View File

@@ -349,55 +349,4 @@ This can be repeated for specifying multiple packages.
trivy conf --policy ./policy --namespaces main --namespaces user ./configs
```
### Terraform value overrides
You can pass `tf-vars` files to Trivy to override default values found in the Terraform HCL code.
```bash
trivy conf --tf-vars dev.terraform.tfvars ./infrastructure/tf
```
### Exclude downloaded Terraform modules
You can remove results for downloaded modules in `.terraform` folder.
```bash
trivy conf --tf-exclude-downloaded-modules ./configs
```
### Helm value overrides
There are a number of options for overriding values in Helm charts. When override values are passed to the Helm scanner, the values will be used during the Manifest rendering process and will become part of the scanned artifact.
#### Setting inline value overrides
Overrides can be set inline on the command line
```bash
trivy conf --helm-set securityContext.runAsUser=0 ./charts/mySql
```
#### Setting value file overrides
Overrides can be in a file that has the key=value set.
```yaml
# Example override file (overrides.yaml)
securityContext:
runAsUser: 0
```
```bash
trivy conf --helm-values overrides.yaml ./charts/mySql
```
#### Setting value as explicit string
the `--helm-set-string` is the same as `--helm-set` but explicitly retains the value as a string
```bash
trivy config --helm-set-string name=false ./infrastructure/tf
```
#### Setting specific values from files
Specific override values can come from specific files
```bash
trivy conf --helm-set-file environment=dev.values.yaml ./charts/mySql
```
[custom]: custom/index.md

18
docs/docs/scanner/misconfiguration/policy/builtin.md
View File

@@ -1,23 +1,12 @@
# Built-in Policies
## Policy Sources
Built-in policies are mainly written in [Rego][rego] and Go.
Those policies are managed under [defsec repository][defsec].
| Config type | Source |
|---------------------------|----------------------|
| Kubernetes | [defsec][kubernetes] |
| Dockerfile, Containerfile | [defsec][docker] |
| Terraform | [defsec][defsec] |
| CloudFormation | [defsec][defsec] |
| Azure ARM Template | [defsec][defsec] |
| Helm Chart | [defsec][kubernetes] |
See [here](../../../coverage/iac/index.md) for the list of supported config types.
For suggestions or issues regarding policy content, please open an issue under the [defsec][defsec] repository.
Helm Chart scanning will resolve the chart to Kubernetes manifests then run the [kubernetes][kubernetes] checks.
## Policy Distribution
defsec policies are distributed as an OPA bundle on [GitHub Container Registry][ghcr] (GHCR).
When misconfiguration detection is enabled, Trivy pulls the OPA bundle from GHCR as an OCI artifact and stores it in the cache.
@@ -28,7 +17,8 @@ If Trivy is unable to pull down newer policies, it will use the embedded set of
Trivy checks for updates to OPA bundle on GHCR every 24 hours and pulls it if there are any updates.
[rego]: https://www.openpolicyagent.org/docs/latest/policy-language/
[kubernetes-policies]: https://github.com/aquasecurity/defsec/tree/master/rules/kubernetes/policies
[docker-policies]: https://github.com/aquasecurity/defsec/tree/master/rules/docker/policies
[defsec]: https://github.com/aquasecurity/defsec
[kubernetes]: https://github.com/aquasecurity/defsec/tree/master/rules/kubernetes/policies
[docker]: https://github.com/aquasecurity/defsec/tree/master/rules/docker/policies
[ghcr]: https://github.com/aquasecurity/defsec/pkgs/container/defsec

180
docs/docs/scanner/vulnerability.md Normal file
View File

@@ -0,0 +1,180 @@
# Vulnerability Scanning
Trivy detects known vulnerabilities according to the versions of installed packages.
The following packages are supported.
- [OS packages](#os-packages)
- [Language-specific packages](#language-specific-packages)
## OS Packages
Trivy is capable of automatically detecting installed OS packages when scanning container images, VM images and running hosts.
!!! note
Trivy doesn't support third-party/self-compiled packages/binaries, but official packages provided by vendors such as Red Hat and Debian.
### Supported OS
See [here](../coverage/os/index.md#supported-os) for the supported OSes.
### Data Sources
| OS | Source |
| ------------- | ------------------------------------------------------------ |
| Arch Linux | [Vulnerable Issues][arch] |
| Alpine Linux | [secdb][alpine] |
| Wolfi Linux | [secdb][wolfi] |
| Chainguard | [secdb][chainguard] |
| Amazon Linux | [Amazon Linux Security Center][amazon] |
| Debian | [Security Bug Tracker][debian-tracker] / [OVAL][debian-oval] |
| Ubuntu | [Ubuntu CVE Tracker][ubuntu] |
| RHEL/CentOS | [OVAL][rhel-oval] / [Security Data][rhel-api] |
| AlmaLinux | [AlmaLinux Product Errata][alma] |
| Rocky Linux | [Rocky Linux UpdateInfo][rocky] |
| Oracle Linux | [OVAL][oracle] |
| CBL-Mariner | [OVAL][mariner] |
| OpenSUSE/SLES | [CVRF][suse] |
| Photon OS | [Photon Security Advisory][photon] |
#### Data Source Selection
Trivy **only** consumes security advisories from the sources listed in the above table.
As for packages installed from OS package managers (`dpkg`, `yum`, `apk`, etc.), Trivy uses the advisory database from the appropriate **OS vendor**.
For example: for a python package installed from `yum` (Amazon linux), Trivy will only get advisories from [ALAS][amazon].
But for a python package installed from another source (e.g. `pip`), Trivy will get advisories from the `GitLab` and `GitHub` databases.
This advisory selection is essential to avoid getting false positives because OS vendors usually backport upstream fixes, and the fixed version can be different from the upstream fixed version.
#### Severity Selection
The severity is taken from the selected data source since the severity from vendors is more accurate.
Using CVE-2023-0464 as an example, while it is [rated as "HIGH" in NVD][nvd-CVE-2023-0464], Red Hat has marked its 'Impact' as ["Low"][redhat-CVE-2023-0464].
As a result, Trivy will display it as "Low".
The severity depends on the compile option, the default configuration, etc.
NVD doesn't know how the vendor distributes the software.
Red Hat evaluates the severity more accurately.
That's why Trivy prefers vendor scores over NVD.
If the data source does not provide a severity, the severity is determined based on the CVSS score as follows:
| Base Score Range | Severity |
| ---------------- | -------- |
| 0.1-3.9 | Low |
| 4.0-6.9 | Medium |
| 7.0-8.9 | High |
| 9.0-10.0 | Critical |
If the CVSS score is also not provided, it falls back to [NVD][nvd], and if NVD does not have severity, it will be UNKNOWN.
### Unfixed Vulnerabilities
The unfixed/unfixable vulnerabilities mean that the patch has not yet been provided on their distribution.
To hide unfixed/unfixable vulnerabilities, you can use the `--ignore-unfixed` flag.
## Language-specific Packages
### Supported Languages
See [here](../coverage/language/index.md#supported-languages) for the supported languages.
### Data Sources
| Language | Source | Commercial Use | Delay[^1] |
| -------- | --------------------------------------------------- | :------------: | :-------: |
| PHP | [PHP Security Advisories Database][php] | ✅ | - |
| | [GitHub Advisory Database (Composer)][php-ghsa] | ✅ | - |
| Python | [GitHub Advisory Database (pip)][python-ghsa] | ✅ | - |
| | [Open Source Vulnerabilities (PyPI)][python-osv] | ✅ | - |
| Ruby | [Ruby Advisory Database][ruby] | ✅ | - |
| | [GitHub Advisory Database (RubyGems)][ruby-ghsa] | ✅ | - |
| Node.js | [Ecosystem Security Working Group][nodejs] | ✅ | - |
| | [GitHub Advisory Database (npm)][nodejs-ghsa] | ✅ | - |
| Java | [GitLab Advisories Community][gitlab] | ✅ | 1 month |
| | [GitHub Advisory Database (Maven)][java-ghsa] | ✅ | - |
| Go | [GitHub Advisory Database (Go)][go-ghsa] | ✅ | - |
| Rust | [Open Source Vulnerabilities (crates.io)][rust-osv] | ✅ | - |
| .NET | [GitHub Advisory Database (NuGet)][dotnet-ghsa] | ✅ | - |
| C/C++ | [GitLab Advisories Community][gitlab] | ✅ | 1 month |
| Dart | [GitHub Advisory Database (Pub)][pub-ghsa] | ✅ | - |
| Elixir | [GitHub Advisory Database (Erlang)][erlang-ghsa] | ✅ | |
[^1]: Intentional delay between vulnerability disclosure and registration in the DB
## Database
Trivy downloads [the vulnerabillity database](https://github.com/aquasecurity/trivy-db) every 6 hours.
Trivy uses two types of databases for vulnerability detection:
- Vulnerability Database
- Java Index Database
This page provides detailed information about these databases.
### Vulnerability Database
Trivy utilizes a database containing vulnerability information.
This database is built every six hours on [GitHub](https://github.com/aquasecurity/trivy-db) and is distributed via [GitHub Container registry (GHCR)](https://ghcr.io/aquasecurity/trivy-db).
The database is cached and updated as needed.
As Trivy updates the database automatically during execution, users don't need to be concerned about it.
For CLI flags related to the database, please refer to [this page](../configuration/db.md).
#### Private Hosting
If you host the database on your own OCI registry, you can specify a different repository with the `--db-repository` flag.
The default is `ghcr.io/aquasecurity/trivy-db`.
```shell
$ trivy image --db-repository YOUR_REPO YOUR_IMAGE
```
If authentication is required, it can be configured in the same way as for private images.
Please refer to [the documentation](../advanced/private-registries/index.md) for more details.
### Java Index Database
This database is only downloaded when scanning JAR files so that Trivy can identify the groupId, artifactId, and version of JAR files.
It is built once a day on [GitHub](https://github.com/aquasecurity/trivy-java-db) and distributed via [GitHub Container registry (GHCR)](https://ghcr.io/aquasecurity/trivy-java-db).
Like the vulnerability database, it is automatically downloaded and updated when needed, so users don't need to worry about it.
#### Private Hosting
If you host the database on your own OCI registry, you can specify a different repository with the `--java-db-repository` flag.
The default is `ghcr.io/aquasecurity/trivy-java-db`.
If authentication is required, you need to run `docker login YOUR_REGISTRY`.
Currently, specifying a username and password is not supported.
[^1]: https://github.com/GoogleContainerTools/distroless
[nvd-CVE-2023-0464]: https://nvd.nist.gov/vuln/detail/CVE-2023-0464
[redhat-CVE-2023-0464]: https://access.redhat.com/security/cve/cve-2023-0464
[arch]: https://security.archlinux.org/
[alpine]: https://secdb.alpinelinux.org/
[wolfi]: https://packages.wolfi.dev/os/security.json
[chainguard]: https://packages.cgr.dev/chainguard/security.json
[amazon]: https://alas.aws.amazon.com/
[debian-tracker]: https://security-tracker.debian.org/tracker/
[debian-oval]: https://www.debian.org/security/oval/
[ubuntu]: https://ubuntu.com/security/cve
[rhel-oval]: https://www.redhat.com/security/data/oval/v2/
[rhel-api]: https://www.redhat.com/security/data/metrics/
[alma]: https://errata.almalinux.org/
[rocky]: https://download.rockylinux.org/pub/rocky/
[oracle]: https://linux.oracle.com/security/oval/
[suse]: http://ftp.suse.com/pub/projects/security/cvrf/
[photon]: https://packages.vmware.com/photon/photon_cve_metadata/
[mariner]: https://github.com/microsoft/CBL-MarinerVulnerabilityData/
[php-ghsa]: https://github.com/advisories?query=ecosystem%3Acomposer
[python-ghsa]: https://github.com/advisories?query=ecosystem%3Apip
[ruby-ghsa]: https://github.com/advisories?query=ecosystem%3Arubygems
[nodejs-ghsa]: https://github.com/advisories?query=ecosystem%3Anpm
[java-ghsa]: https://github.com/advisories?query=ecosystem%3Amaven
[dotnet-ghsa]: https://github.com/advisories?query=ecosystem%3Anuget
[pub-ghsa]: https://github.com/advisories?query=ecosystem%3Apub
[erlang-ghsa]: https://github.com/advisories?query=ecosystem%3Aerlang
[go-ghsa]: https://github.com/advisories?query=ecosystem%3Ago
[php]: https://github.com/FriendsOfPHP/security-advisories
[ruby]: https://github.com/rubysec/ruby-advisory-db
[nodejs]: https://github.com/nodejs/security-wg
[gitlab]: https://gitlab.com/gitlab-org/advisories-community
[python-osv]: https://osv.dev/list?q=&ecosystem=PyPI
[rust-osv]: https://osv.dev/list?q=&ecosystem=crates.io
[nvd]: https://nvd.nist.gov/vuln

51
docs/docs/scanner/vulnerability/index.md
View File

@@ -1,51 +0,0 @@
# Vulnerability Scanning
## Overview
This section describes the overview of vulnerability scanning.
Trivy detects known vulnerabilities according to the versions of installed packages.
The following packages are supported.
- [OS packages](os.md)
- [Language-specific packages](language/index.md)
Trivy downloads [the vulnerabillity database](https://github.com/aquasecurity/trivy-db) every 6 hours.
## Database
Trivy uses two types of databases for vulnerability detection:
- Vulnerability Database
- Java Index Database
This page provides detailed information about these databases.
### Vulnerability Database
Trivy utilizes a database containing vulnerability information.
This database is built every six hours on [GitHub](https://github.com/aquasecurity/trivy-db) and is distributed via [GitHub Container registry (GHCR)](https://ghcr.io/aquasecurity/trivy-db).
The database is cached and updated as needed.
As Trivy updates the database automatically during execution, users don't need to be concerned about it.
For CLI flags related to the database, please refer to [this page](../../configuration/db.md).
#### Private Hosting
If you host the database on your own OCI registry, you can specify a different repository with the `--db-repository` flag.
The default is `ghcr.io/aquasecurity/trivy-db`.
```shell
$ trivy image --db-repository YOUR_REPO YOUR_IMAGE
```
If authentication is required, it can be configured in the same way as for private images.
Please refer to [the documentation](../../advanced/private-registries/index.md) for more details.
### Java Index Database
This database is only downloaded when scanning JAR files so that Trivy can identify the groupId, artifactId, and version of JAR files.
It is built once a day on [GitHub](https://github.com/aquasecurity/trivy-java-db) and distributed via [GitHub Container registry (GHCR)](https://ghcr.io/aquasecurity/trivy-java-db).
Like the vulnerability database, it is automatically downloaded and updated when needed, so users don't need to worry about it.
#### Private Hosting
If you host the database on your own OCI registry, you can specify a different repository with the `--java-db-repository` flag.
The default is `ghcr.io/aquasecurity/trivy-java-db`.
If authentication is required, you need to run `docker login YOUR_REGISTRY`.
Currently, specifying a username and password is not supported.

92
docs/docs/scanner/vulnerability/language/index.md
View File

@@ -1,92 +0,0 @@
# Language-specific Packages
`Trivy` automatically detects the following files and scans vulnerabilities in the application dependencies.
## Supported languages
| Language | File | Image[^7] | Rootfs[^8] | Filesystem[^9] | Repository[^10] | Dev dependencies | Dependency location[^11] |
|----------------------|--------------------------------------------------------------------------------------------|:---------:|:----------:|:--------------:|:---------------:|------------------------------|:------------------------:|
| Ruby | Gemfile.lock | - | - | ✅ | ✅ | included | - |
| | gemspec | ✅ | ✅ | - | - | included | - |
| [Python](python.md) | Pipfile.lock | - | - | ✅ | ✅ | excluded | ✅ |
| | poetry.lock | - | - | ✅ | ✅ | excluded | - |
| | requirements.txt | - | - | ✅ | ✅ | included | - |
| | egg package[^1] | ✅ | ✅ | - | - | excluded | - |
| | wheel package[^2] | ✅ | ✅ | - | - | excluded | - |
| [PHP](php.md) | composer.lock | ✅ | ✅ | ✅ | ✅ | excluded | ✅ |
| [Node.js](nodejs.md) | package-lock.json | - | - | ✅ | ✅ | [excluded](./nodejs.md#npm) | ✅ |
| | yarn.lock | - | - | ✅ | ✅ | [excluded](./nodejs.md#yarn) | ✅ |
| | pnpm-lock.yaml | - | - | ✅ | ✅ | excluded | - |
| | package.json | ✅ | ✅ | - | - | excluded | - |
| .NET | packages.lock.json | ✅ | ✅ | ✅ | ✅ | included | ✅ |
| | packages.config | ✅ | ✅ | ✅ | ✅ | excluded | - |
| | .deps.json | ✅ | ✅ | ✅ | ✅ | excluded | ✅ |
| [Java](java.md) | JAR/WAR/PAR/EAR[^3] | ✅ | ✅ | - | - | included | - |
| | pom.xml[^4] | - | - | ✅ | ✅ | excluded | - |
| | *gradle.lockfile | - | - | ✅ | ✅ | excluded | - |
| [Go](golang.md) | Binaries built by Go[^5] | ✅ | ✅ | - | - | excluded | - |
| | go.mod[^6] | - | - | ✅ | ✅ | included | - |
| [Rust](rust.md) | Cargo.lock | ✅ | ✅ | ✅ | ✅ | excluded | ✅ |
| | Binaries built with [cargo-auditable](https://github.com/rust-secure-code/cargo-auditable) | ✅ | ✅ | - | - | excluded | - |
| C/C++ | conan.lock[^12] | - | - | ✅ | ✅ | excluded | ✅ |
| Elixir | mix.lock[^12] | - | - | ✅ | ✅ | excluded | ✅ |
| Dart | pubspec.lock | - | - | ✅ | ✅ | included | - |
The path of these files does not matter.
Example: [Dockerfile](https://github.com/aquasecurity/trivy-ci-test/blob/main/Dockerfile)
[^1]: `*.egg-info`, `*.egg-info/PKG-INFO`, `*.egg` and `EGG-INFO/PKG-INFO`
[^2]: `.dist-info/META-DATA`
[^3]: `*.jar`, `*.war`, `*.par` and `*.ear`
[^4]: It requires Internet access when the POM doesn't exist in your local repository
[^5]: UPX-compressed binaries don't work
[^6]: If smaller than go 1.17, go.sum is also required
[^7]: ✅ means "enabled" and `-` means "disabled" in the image scanning
[^8]: ✅ means "enabled" and `-` means "disabled" in the rootfs scanning
[^9]: ✅ means "enabled" and `-` means "disabled" in the filesystem scanning
[^10]: ✅ means "enabled" and `-` means "disabled" in the git repository scanning
[^11]: ✅ means that Trivy detects line numbers where each dependency is declared in the scanned file. Only supported in [json](../../../configuration/reporting.md#json) and [sarif](../../../configuration/reporting.md#sarif) formats. SARIF uses `startline == 1 and endline == 1` for unsupported file types
[^12]: To scan a filename other than the default filename use [file-patterns](../../../configuration/others.md#file-patterns)
[^13]: When you scan `Cargo.lock` and `Cargo.toml` together. See about it [here](./rust.md#cargo).
## Data Sources
| Language | Source | Commercial Use | Delay[^1] |
|----------|-----------------------------------------------------|:--------------:|:---------:|
| PHP | [PHP Security Advisories Database][php] | ✅ | - |
| | [GitHub Advisory Database (Composer)][php-ghsa] | ✅ | - |
| Python | [GitHub Advisory Database (pip)][python-ghsa] | ✅ | - |
| | [Open Source Vulnerabilities (PyPI)][python-osv] | ✅ | - |
| Ruby | [Ruby Advisory Database][ruby] | ✅ | - |
| | [GitHub Advisory Database (RubyGems)][ruby-ghsa] | ✅ | - |
| Node.js | [Ecosystem Security Working Group][nodejs] | ✅ | - |
| | [GitHub Advisory Database (npm)][nodejs-ghsa] | ✅ | - |
| Java | [GitLab Advisories Community][gitlab] | ✅ | 1 month |
| | [GitHub Advisory Database (Maven)][java-ghsa] | ✅ | - |
| Go | [GitHub Advisory Database (Go)][go-ghsa] | ✅ | - |
| Rust | [Open Source Vulnerabilities (crates.io)][rust-osv] | ✅ | - |
| .NET | [GitHub Advisory Database (NuGet)][dotnet-ghsa] | ✅ | - |
| C/C++ | [GitLab Advisories Community][gitlab] | ✅ | 1 month |
| Dart | [GitHub Advisory Database (Pub)][pub-ghsa] | ✅ | - |
| Elixir | [GitHub Advisory Database (Erlang)][erlang-ghsa] | ✅ | |
[^1]: Intentional delay between vulnerability disclosure and registration in the DB
[php-ghsa]: https://github.com/advisories?query=ecosystem%3Acomposer
[python-ghsa]: https://github.com/advisories?query=ecosystem%3Apip
[ruby-ghsa]: https://github.com/advisories?query=ecosystem%3Arubygems
[nodejs-ghsa]: https://github.com/advisories?query=ecosystem%3Anpm
[java-ghsa]: https://github.com/advisories?query=ecosystem%3Amaven
[dotnet-ghsa]: https://github.com/advisories?query=ecosystem%3Anuget
[pub-ghsa]: https://github.com/advisories?query=ecosystem%3Apub
[erlang-ghsa]: https://github.com/advisories?query=ecosystem%3Aerlang
[go-ghsa]: https://github.com/advisories?query=ecosystem%3Ago
[php]: https://github.com/FriendsOfPHP/security-advisories
[ruby]: https://github.com/rubysec/ruby-advisory-db
[nodejs]: https://github.com/nodejs/security-wg
[gitlab]: https://gitlab.com/gitlab-org/advisories-community
[python-osv]: https://osv.dev/list?q=&ecosystem=PyPI
[rust-osv]: https://osv.dev/list?q=&ecosystem=crates.io

136
docs/docs/scanner/vulnerability/os.md
View File

@@ -1,136 +0,0 @@
# OS Packages
Trivy is capable of automatically detecting installed OS packages when scanning container images, VM images and running hosts.
This page provides an overview of OS packages in the context of Trivy scans.
## Supported OS
The unfixed/unfixable vulnerabilities mean that the patch has not yet been provided on their distribution.
To hide unfixed/unfixable vulnerabilities, you can use the `--ignore-unfixed` flag.
Trivy doesn't support self-compiled packages/binaries, but official packages provided by vendors such as Red Hat and Debian.
| OS | Supported Versions | Target Packages | Detection of unfixed vulnerabilities |
|----------------------------------|-------------------------------------|-------------------------------|:------------------------------------:|
| Alpine Linux | 2.2 - 2.7, 3.0 - 3.18, edge | Installed by apk | NO |
| Wolfi Linux | (n/a) | Installed by apk | NO |
| Chainguard | (n/a) | Installed by apk | NO |
| Red Hat Universal Base Image[^1] | 7, 8, 9 | Installed by yum/rpm | YES |
| Red Hat Enterprise Linux | 6, 7, 8 | Installed by yum/rpm | YES |
| CentOS | 6, 7, 8 | Installed by yum/rpm | YES |
| AlmaLinux | 8, 9 | Installed by yum/rpm | NO |
| Rocky Linux | 8, 9 | Installed by yum/rpm | NO |
| Oracle Linux | 5, 6, 7, 8 | Installed by yum/rpm | NO |
| CBL-Mariner | 1.0, 2.0 | Installed by yum/rpm | YES |
| Amazon Linux | 1, 2, 2023 | Installed by yum/rpm | NO |
| openSUSE Leap | 42, 15 | Installed by zypper/rpm | NO |
| SUSE Enterprise Linux | 11, 12, 15 | Installed by zypper/rpm | NO |
| Photon OS | 1.0, 2.0, 3.0, 4.0 | Installed by tdnf/yum/rpm | NO |
| Debian GNU/Linux | 7, 8, 9, 10, 11, 12 | Installed by apt/apt-get/dpkg | YES |
| Ubuntu | All versions supported by Canonical | Installed by apt/apt-get/dpkg | YES |
| Distroless[^2] | Any | Installed by apt/apt-get/dpkg | YES |
## Data Sources
| OS | Source |
|---------------|----------------------------------------|
| Arch Linux | [Vulnerable Issues][arch] |
| Alpine Linux | [secdb][alpine] |
| Wolfi Linux | [secdb][wolfi] |
| Chainguard | [secdb][chainguard] |
| Amazon Linux | [Amazon Linux Security Center][amazon] |
| Debian | [Security Bug Tracker][debian-tracker] |
| | [OVAL][debian-oval] |
| Ubuntu | [Ubuntu CVE Tracker][ubuntu] |
| RHEL/CentOS | [OVAL][rhel-oval] |
| | [Security Data][rhel-api] |
| AlmaLinux | [AlmaLinux Product Errata][alma] |
| Rocky Linux | [Rocky Linux UpdateInfo][rocky] |
| Oracle Linux | [OVAL][oracle] |
| CBL-Mariner | [OVAL][mariner] |
| OpenSUSE/SLES | [CVRF][suse] |
| Photon OS | [Photon Security Advisory][photon] |
### Data source selection
Trivy **only** consumes security advisories from the sources listed in the above table.
As for packages installed from OS package managers (`dpkg`, `yum`, `apk`, etc.), Trivy uses the advisory database from the appropriate **OS vendor**.
For example: for a python package installed from `yum` (Amazon linux), Trivy will only get advisories from [ALAS][amazon].
But for a python package installed from another source (e.g. `pip`), Trivy will get advisories from the `GitLab` and `GitHub` databases.
This advisory selection is essential to avoid getting false positives because OS vendors usually backport upstream fixes, and the fixed version can be different from the upstream fixed version.
The severity is from the selected data source.
If the data source does not provide severity, it falls back to [NVD][nvd], and if NVD does not have severity, it will be UNKNOWN.
## Distributions
### CBL-Mariner
Trivy scans [CBL-Mariner][cbl-mariner].
#### Support
The following table provides an outline of the features Trivy offers.
| Version | Container image | Virtual machine | Distroless | Multi-arch | Unfixed support |
|---------|:---------------:|:---------------:|:----------:|:------------:|:---------------:|
| 1.0 | ✔ | ✔ | ✔ | amd64, arm64 | ✔ |
| 2.0 | ✔ | ✔ | ✔ | amd64, arm64 | ✔ |
### Examples
=== "image"
```
➜ trivy image mcr.microsoft.com/cbl-mariner/base/core:2.0
2022-07-27T14:48:20.355+0600 INFO Detected OS: cbl-mariner
2022-07-27T14:48:20.355+0600 INFO Detecting CBL-Mariner vulnerabilities...
2022-07-27T14:48:20.356+0600 INFO Number of language-specific files: 0
mcr.microsoft.com/cbl-mariner/base/core:2.0 (cbl-mariner 2.0.20220527)
Total: 33 (UNKNOWN: 0, LOW: 0, MEDIUM: 15, HIGH: 13, CRITICAL: 5)
```
=== "rootfs"
```
➜ docker run -it --rm --entrypoint bin/bash mcr.microsoft.com/cbl-mariner/base/core:2.0
root [ / ]# tdnf -y install ca-certificates
root [ / ]# # Install the latest Trivy
root [ / ]# trivy rootfs /
2022-07-27T09:30:06.815Z INFO Need to update DB
2022-07-27T09:30:06.815Z INFO DB Repository: ghcr.io/aquasecurity/trivy-db
2022-07-27T09:30:06.815Z INFO Downloading DB...
33.25 MiB / 33.25 MiB [------------------------------] 100.00% 4.20 MiB p/s 8.1s
2022-07-27T09:30:21.756Z INFO Vulnerability scanning is enabled
2022-07-27T09:30:21.756Z INFO Secret scanning is enabled
2022-07-27T09:30:21.756Z INFO If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2022-07-27T09:30:21.756Z INFO Please see also https://aquasecurity.github.io/trivy/v0.30.4/docs/secret/scanning/#recommendation for faster secret detection
2022-07-27T09:30:22.205Z INFO Detected OS: cbl-mariner
2022-07-27T09:30:22.205Z INFO Detecting CBL-Mariner vulnerabilities...
2022-07-27T09:30:22.205Z INFO Number of language-specific files: 0
40ba9a55397c (cbl-mariner 2.0.20220527)
=======================================
Total: 33 (UNKNOWN: 0, LOW: 0, MEDIUM: 15, HIGH: 13, CRITICAL: 5)
```
[^1]: https://developers.redhat.com/products/rhel/ubi
[^2]: https://github.com/GoogleContainerTools/distroless
[arch]: https://security.archlinux.org/
[alpine]: https://secdb.alpinelinux.org/
[wolfi]: https://packages.wolfi.dev/os/security.json
[chainguard]: https://packages.cgr.dev/chainguard/security.json
[amazon]: https://alas.aws.amazon.com/
[debian-tracker]: https://security-tracker.debian.org/tracker/
[debian-oval]: https://www.debian.org/security/oval/
[ubuntu]: https://ubuntu.com/security/cve
[rhel-oval]: https://www.redhat.com/security/data/oval/v2/
[rhel-api]: https://www.redhat.com/security/data/metrics/
[alma]: https://errata.almalinux.org/
[rocky]: https://download.rockylinux.org/pub/rocky/
[oracle]: https://linux.oracle.com/security/oval/
[suse]: http://ftp.suse.com/pub/projects/security/cvrf/
[photon]: https://packages.vmware.com/photon/photon_cve_metadata/
[mariner]: https://github.com/microsoft/CBL-MarinerVulnerabilityData/
[cbl-mariner]: https://github.com/microsoft/CBL-Mariner
[nvd]: https://nvd.nist.gov/

18
docs/docs/supply-chain/sbom.md
View File

@@ -185,18 +185,6 @@ Trivy supports the following packages.
- [OS packages][os_packages]
- [Language-specific packages][language_packages]
In addition to the above packages, Trivy also supports the following packages for generating SBOM.
!!! note
These packages are not supported for vulnerability scanning.
| Language | File | Dependency location[^1] |
|----------|-------------------|:-----------------------:|
| Python | conda package[^2] | - |
| Swift | Podfile.lock | - |
[^1]: Use `startline == 1 and endline == 1` for unsupported file types
[^2]: `envs/*/conda-meta/*.json`
### Formats
#### CycloneDX
@@ -754,7 +742,7 @@ Trivy automatically detects the SBOM files and uses them for scanning.
It is enabled in the following targets.
| Target | Enabled |
|:---------------:|:-------:|
| :-------------: | :-----: |
| Container Image | ✓ |
| Filesystem | |
| Rootfs | ✓ |
@@ -771,5 +759,5 @@ It is enabled in the following targets.
[sbom]: https://cyclonedx.org/capabilities/sbom/
[bov]: https://cyclonedx.org/capabilities/bov/
[os_packages]: ../scanner/vulnerability/os.md
[language_packages]: ../scanner/vulnerability/language/index.md
[os_packages]: ../scanner/vulnerability.md#os-packages
[language_packages]: ../scanner/vulnerability.md#language-specific-packages

2
docs/docs/target/container_image.md
View File

@@ -22,7 +22,7 @@ By default, vulnerability and secret scanning are enabled, and you can configure
It is enabled by default.
You can simply specify your image name (and a tag).
It detects known vulnerabilities in your container image.
See [here](../scanner/vulnerability/index.md) for the detail.
See [here](../scanner/vulnerability.md) for the detail.
```
$ trivy image [YOUR_IMAGE_NAME]

2
docs/docs/target/filesystem.md
View File

@@ -23,7 +23,7 @@ $ trivy fs ~/src/github.com/aquasecurity/trivy-ci-test/Pipfile.lock
### Vulnerabilities
It is enabled by default.
Trivy will look for vulnerabilities based on lock files such as Gemfile.lock and package-lock.json.
See [here](../scanner/vulnerability/index.md) for the detail.
See [here](../scanner/vulnerability.md) for the detail.
```
$ trivy fs ~/src/github.com/aquasecurity/trivy-ci-test

4
docs/docs/target/repository.md
View File

@@ -34,13 +34,13 @@ $ trivy repo https://github.com/aquasecurity/trivy-ci-test
## Rationale
`trivy repo` is designed to scan code repositories, and it is intended to be used for scanning local/remote repositories in your machine or in your CI environment.
Therefore, unlike container/VM image scanning, it targets lock files such as package-lock.json and does not target artifacts like JAR files, binary files, etc.
See [here](../scanner/vulnerability/language/index.md) for the detail.
See [here](../scanner/vulnerability.md#language-specific-packages) for the detail.
## Scanners
### Vulnerabilities
It is enabled by default.
Trivy will look for vulnerabilities based on lock files such as Gemfile.lock and package-lock.json.
See [here](../scanner/vulnerability/index.md) for the detail.
See [here](../scanner/vulnerability.md) for the detail.
```
$ trivy repo ~/src/github.com/aquasecurity/trivy-ci-test

2
docs/docs/target/rootfs.md
View File

@@ -12,4 +12,4 @@ $ trivy rootfs /path/to/rootfs
!!! note
Rootfs scanning works differently from the Filesystem scanning.
You should use `trivy fs` to scan your local projects in CI/CD.
See [here](../scanner/vulnerability/index.md) for the differences.
See [here](../scanner/vulnerability.md) for the differences.

2
docs/docs/target/vm.md
View File

@@ -144,7 +144,7 @@ Trivy supports VM image scanning for
It is enabled by default.
You can simply specify your VM image location.
It detects known vulnerabilities in your VM image.
See [here](../scanner/vulnerability/index.md) for the detail.
See [here](../scanner/vulnerability.md) for the detail.
```
$ trivy vm [YOUR_VM_IMAGE]

58
docs/getting-started/coverage.md
View File

@@ -1,58 +0,0 @@
# Scanning Coverage
Trivy can detect security issues in many different platforms and languages. This page gives a general overview of that coverage, and can help answer the frequently asked question "Does Trivy support X?". For more detailed information about the specific features and options, check the relevant scanner documentation.
## Vulnerabilities & SBOM
### Programming languages
Trivy detects code dependencies for the purpose of SBOM generation and vulnerability detection. The following programming languages have some level of support:
- Ruby
- Python
- PHP
- Node.js
- .NET
- Java
- Go
- Rust
- C/C++
- Elixir
- Dart
- Swift
Some features might be not be universally supported. For a full supportability matrix, [see here](../docs/scanner/vulnerability/language/index.md).
### OS
Trivy detects installed packages for the purpose of vulnerability detection. The following package managers are supported:
- Alpine Linux
- Wolfi Linux
- Chainguard
- Red Hat Universal Base Image
- Red Hat Enterprise Linux
- CentOS
- AlmaLinux
- Rocky Linux
- Oracle Linux
- CBL-Mariner
- Amazon Linux
- openSUSE Leap
- SUSE Enterprise Linux
- Photon OS
- Debian GNU/Linux
- Ubuntu
- Distroless
Some features might be not be universally supported. For a full supportability matrix, [see here](../docs/scanner/vulnerability/os.md).
## IaC & configuration
Trivy reads IaC & configuration languages for the purpose of misconfiguration detection and custom checks.
- Kubernetes
- Dockerfile, Containerfile
- Terraform
- CloudFormation
- Azure ARM Template
- Helm Chart
For more information about checks [see here](../docs/scanner/misconfiguration/policy/builtin.md).

2
docs/getting-started/faq.md
View File

@@ -6,7 +6,7 @@
### Does Trivy support X?
Check out the [Scanning coverage page](./coverage.md)
Check out the [Scanning coverage page](../docs/coverage/index.md).
### Is there a paid version of Trivy?

2
docs/index.md
View File

@@ -127,7 +127,7 @@ Contact us about any matter by opening a GitHub Discussion [here][discussions]
[Ecosystem]: ./ecosystem/index.md
[Installation]: getting-started/installation.md
[pronunciation]: #how-to-pronounce-the-name-trivy
[Scanning Coverage]: getting-started/coverage.md
[Scanning Coverage]: ./docs/coverage/index.md
[aquasec]: https://aquasec.com
[oss]: https://www.aquasec.com/products/open-source-projects/

54
mkdocs.yml
View File

@@ -10,7 +10,6 @@ nav:
- Getting Started:
- Overview: index.md
- Installation: getting-started/installation.md
- Scanning coverage: getting-started/coverage.md
- FAQ: getting-started/faq.md
- Tutorials:
- Overview: tutorials/overview.md
@@ -48,17 +47,7 @@ nav:
- AWS: docs/target/aws.md
- SBOM: docs/target/sbom.md
- Scanner:
- Vulnerability:
- Overview: docs/scanner/vulnerability/index.md
- OS Packages: docs/scanner/vulnerability/os.md
- Language-specific Packages:
- Overview: docs/scanner/vulnerability/language/index.md
- Go: docs/scanner/vulnerability/language/golang.md
- Java: docs/scanner/vulnerability/language/java.md
- Node.js: docs/scanner/vulnerability/language/nodejs.md
- PHP: docs/scanner/vulnerability/language/php.md
- Python: docs/scanner/vulnerability/language/python.md
- Rust: docs/scanner/vulnerability/language/rust.md
- Vulnerability: docs/scanner/vulnerability.md
- Misconfiguration:
- Overview: docs/scanner/misconfiguration/index.md
- Policy:
@@ -74,6 +63,47 @@ nav:
- Debugging Policies: docs/scanner/misconfiguration/custom/debug.md
- Secret: docs/scanner/secret.md
- License: docs/scanner/license.md
- Coverage:
- Overview: docs/coverage/index.md
- OS:
- Overview: docs/coverage/os/index.md
- AlmaLinux: docs/coverage/os/alma.md
- Alpine Linux: docs/coverage/os/alpine.md
- Amazon Linux: docs/coverage/os/amazon.md
- CBL-Mariner: docs/coverage/os/cbl-mariner.md
- CentOS: docs/coverage/os/centos.md
- Chainguard: docs/coverage/os/chainguard.md
- Debian: docs/coverage/os/debian.md
- Google Distroless: docs/coverage/os/google-distroless.md
- Oracle Linux: docs/coverage/os/oracle.md
- Photon OS: docs/coverage/os/photon.md
- Red Hat: docs/coverage/os/rhel.md
- Rocky Linux: docs/coverage/os/rocky.md
- SUSE: docs/coverage/os/suse.md
- Ubuntu: docs/coverage/os/ubuntu.md
- Wolfi: docs/coverage/os/wolfi.md
- Language:
- Overview: docs/coverage/language/index.md
- C/C++: docs/coverage/language/c.md
- Dart: docs/coverage/language/dart.md
- .NET: docs/coverage/language/dotnet.md
- Elixir: docs/coverage/language/elixir.md
- Go: docs/coverage/language/golang.md
- Java: docs/coverage/language/java.md
- Node.js: docs/coverage/language/nodejs.md
- PHP: docs/coverage/language/php.md
- Python: docs/coverage/language/python.md
- Ruby: docs/coverage/language/ruby.md
- Rust: docs/coverage/language/rust.md
- Swift: docs/coverage/language/swift.md
- IaC:
- Overview: docs/coverage/iac/index.md
- Azure ARM Template: docs/coverage/iac/azure-arm.md
- CloudFormation: docs/coverage/iac/cloudformation.md
- Docker: docs/coverage/iac/docker.md
- Helm: docs/coverage/iac/helm.md
- Kubernetes: docs/coverage/iac/kubernetes.md
- Terraform: docs/coverage/iac/terraform.md
- Configuration:
- Overview: docs/configuration/index.md
- Filtering: docs/configuration/filtering.md

4
pkg/purl/purl.go
View File

@@ -112,6 +112,8 @@ func (p *PackageURL) PackageType() string {
return ftypes.Cocoapods
case packageurl.TypeHex:
return ftypes.Hex
case packageurl.TypeConan:
return ftypes.Conan
case TypeDart: // TODO: replace with packageurl.TypeDart once they add it.
return ftypes.Pub
}
@@ -331,6 +333,8 @@ func purlType(t string) string {
return packageurl.TypeSwift
case ftypes.Hex:
return packageurl.TypeHex
case ftypes.Conan:
return packageurl.TypeConan
case ftypes.Pub:
return TypeDart // TODO: replace with packageurl.TypeDart once they add it.
case os.Alpine: