mirror of
https://github.com/aquasecurity/trivy.git
synced 2025-12-23 07:29:00 -08:00
39 lines
3.1 KiB
Markdown
39 lines
3.1 KiB
Markdown
# Language-specific Packages
|
|
|
|
`Trivy` automatically detects the following files in the container and scans vulnerabilities in the application dependencies.
|
|
|
|
| Language | File | Image[^7] | Rootfs[^8] | Filesystem[^9] | Repository[^10] |Dev dependencies |
|
|
|----------|--------------------------|:---------:|:----------:|:--------------:|:--------------:|-----------------|
|
|
| Ruby | Gemfile.lock | - | - | ✅ | ✅ | included |
|
|
| | gemspec | ✅ | ✅ | - | - | included |
|
|
| Python | Pipfile.lock | - | - | ✅ | ✅ | excluded |
|
|
| | poetry.lock | - | - | ✅ | ✅ | included |
|
|
| | requirements.txt | - | - | ✅ | ✅ | included |
|
|
| | egg package[^1] | ✅ | ✅ | - | - | excluded |
|
|
| | wheel package[^2] | ✅ | ✅ | - | - | excluded |
|
|
| PHP | composer.lock | ✅ | ✅ | ✅ | ✅ | excluded |
|
|
| Node.js | package-lock.json | - | - | ✅ | ✅ | excluded |
|
|
| | yarn.lock | - | - | ✅ | ✅ | included |
|
|
| | package.json | ✅ | ✅ | - | - | excluded |
|
|
| .NET | packages.lock.json | ✅ | ✅ | ✅ | ✅ | included |
|
|
| Java | JAR/WAR/PAR/EAR[^3][^4] | ✅ | ✅ | - | - | included |
|
|
| | pom.xml[^5] | - | - | ✅ | ✅ | excluded |
|
|
| Go | Binaries built by Go[^6] | ✅ | ✅ | - | - | excluded |
|
|
| | go.sum | - | - | ✅ | ✅ | included |
|
|
| Rust | Cargo.lock | ✅ | ✅ | ✅ | ✅ | included |
|
|
|
|
The path of these files does not matter.
|
|
|
|
Example: [Dockerfile](https://github.com/aquasecurity/trivy-ci-test/blob/main/Dockerfile)
|
|
|
|
[^1]: `*.egg-info`, `*.egg-info/PKG-INFO`, `*.egg` and `EGG-INFO/PKG-INFO`
|
|
[^2]: `.dist-info/META-DATA`
|
|
[^3]: `*.jar`, `*.war`, `*.par` and `*.ear`
|
|
[^4]: It requires Internet access
|
|
[^5]: It requires Internet access when the POM doesn't exist in your local repository
|
|
[^6]: UPX-compressed binaries don't work
|
|
[^7]: ✅ means "enabled" and `-` means "disabled" in the image scanning
|
|
[^8]: ✅ means "enabled" and `-` means "disabled" in the rootfs scanning
|
|
[^9]: ✅ means "enabled" and `-` means "disabled" in the filesystem scanning
|
|
[^10]: ✅ means "enabled" and `-` means "disabled" in the git repository scanning
|