10352851867

Committed 12 Aug 2024 01:28PM UTC coverage: 72.111% (-0.02%) from 72.132%

Build # 10352851867

Build Type

push

github

Committed by

web-flow

Commit Message

Revert "Bump trivy to v0.54.1 and fix breaking changes" (#2421)

Revert "Bump trivy to v0.54.1 and fix breaking changes (#2399)"

This reverts commit dab2d95b3.

Run Details

6 of 8 new or added lines in 3 files covered. (75.0%)

2 existing lines in 1 file now uncovered.

8132 of 11277 relevant lines covered (72.11%)

16.22 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

85.0

/internal/vulnerability/runner.go

// Licensed to Elasticsearch B.V. under one or more contributor
// license agreements. See the NOTICE file distributed with
// this work for additional information regarding copyright
// ownership. Elasticsearch B.V. licenses this file to you under
// the Apache License, Version 2.0 (the "License"); you may
// not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing,
// software distributed under the License is distributed on an
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
// KIND, either express or implied.  See the License for the
// specific language governing permissions and limitations
// under the License.

package vulnerability

import (
        "context"
        "errors"
        "time"

        "github.com/aquasecurity/trivy/pkg/commands/artifact"
        "github.com/aquasecurity/trivy/pkg/flag"
        trivy_types "github.com/aquasecurity/trivy/pkg/types"
        "github.com/elastic/elastic-agent-libs/logp"
)

type VulnerabilityRunner struct {
        log    *logp.Logger
        runner artifact.Runner
}

func NewVulnerabilityRunner(log *logp.Logger) (VulnerabilityRunner, error) {
        ctx := context.Background()
        log.Debug("NewVulnerabilityRunner: New")

        if err := clearTrivyCache(ctx, log); err != nil {
                log.Errorf("error during runner cache clearing %s", err.Error())
        }

        opts := flag.Options{
                GlobalOptions: flag.GlobalOptions{
                        // TODO: Make configurable
                        Timeout: 1 * time.Hour,
                        Quiet:   false,
                        Debug:   true,
                },
                VulnerabilityOptions: flag.VulnerabilityOptions{
                        VulnType: []string{trivy_types.VulnTypeOS, trivy_types.VulnTypeLibrary},
                },
                ScanOptions: flag.ScanOptions{
                        Scanners: []trivy_types.Scanner{trivy_types.VulnerabilityScanner},
                        RekorURL: "https://rekor.sigstore.dev",
                },
                DBOptions: flag.DBOptions{
                        NoProgress:       true,
                        DBRepository:     "ghcr.io/aquasecurity/trivy-db",
                        JavaDBRepository: "ghcr.io/aquasecurity/trivy-java-db",
                },
        }

        runner, err := artifact.NewRunner(ctx, opts)
        if err != nil {
                log.Error("NewVulnerabilityRunner: NewRunner error: ", err)
                return VulnerabilityRunner{}, err
        }

        return VulnerabilityRunner{
                log:    log,
                runner: runner,
        }, nil
}

func (f VulnerabilityRunner) GetRunner() artifact.Runner {
        return f.runner
}

func clearTrivyCache(ctx context.Context, log *logp.Logger) error {
        log.Info("Starting VulnerabilityRunner.ClearCache")
        defer log.Info("Ending VulnerabilityRunner.ClearCache")

        // These are the three available cli settings for clean/reset translated to flag.Options object.
        //         {CacheOptions: flag.CacheOptions{ClearCache: true}},
        //         {DBOptions: flag.DBOptions{Reset: true}},
        //         {MisconfOptions: flag.MisconfOptions{ResetPolicyBundle: true}},
        // In our case we will use only the ClearCache option.

        errs := make([]error, 0, 2)
        r, err := artifact.NewRunner(ctx, flag.Options{CacheOptions: flag.CacheOptions{ClearCache: true}})
        if err != nil {
                if !errors.Is(err, artifact.SkipScan) {
                        errs = append(errs, err)
                }
        }

        // it should never go here (NewRunner should always return artifact.SkipScan and nil runner), but just in case it goes, lets close the runner.
        if r != nil {
                errs = append(errs, r.Close(ctx))
        }

        return errors.Join(errs...)
}

1	// Licensed to Elasticsearch B.V. under one or more contributor
2	// license agreements. See the NOTICE file distributed with
3	// this work for additional information regarding copyright
4	// ownership. Elasticsearch B.V. licenses this file to you under
5	// the Apache License, Version 2.0 (the "License"); you may
6	// not use this file except in compliance with the License.
7	// You may obtain a copy of the License at
8	//
9	// http://www.apache.org/licenses/LICENSE-2.0
10	//
11	// Unless required by applicable law or agreed to in writing,
12	// software distributed under the License is distributed on an
13	// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14	// KIND, either express or implied. See the License for the
15	// specific language governing permissions and limitations
16	// under the License.
17
18	package vulnerability
19
20	import (
21	"context"
22	"errors"
23	"time"
24
25	"github.com/aquasecurity/trivy/pkg/commands/artifact"
26	"github.com/aquasecurity/trivy/pkg/flag"
27	trivy_types "github.com/aquasecurity/trivy/pkg/types"
28	"github.com/elastic/elastic-agent-libs/logp"
29	)
30
31	type VulnerabilityRunner struct {
32	log *logp.Logger
33	runner artifact.Runner
34	}
35
36	func NewVulnerabilityRunner(log *logp.Logger) (VulnerabilityRunner, error) {	4✔
37	ctx := context.Background()	4✔
38	log.Debug("NewVulnerabilityRunner: New")	4✔
39		4✔
40	if err := clearTrivyCache(ctx, log); err != nil {	4✔
41	log.Errorf("error during runner cache clearing %s", err.Error())	×
42	}	×
43
44	opts := flag.Options{	4✔
45	GlobalOptions: flag.GlobalOptions{	4✔
46	// TODO: Make configurable	4✔
47	Timeout: 1 * time.Hour,	4✔
48	Quiet: false,	4✔
49	Debug: true,	4✔
50	},	4✔
51	VulnerabilityOptions: flag.VulnerabilityOptions{	4✔
52	VulnType: []string{trivy_types.VulnTypeOS, trivy_types.VulnTypeLibrary},	4✔
53	},	4✔
54	ScanOptions: flag.ScanOptions{	4✔
55	Scanners: []trivy_types.Scanner{trivy_types.VulnerabilityScanner},	4✔
56	RekorURL: "https://rekor.sigstore.dev",	4✔
57	},	4✔
58	DBOptions: flag.DBOptions{	4✔
59	NoProgress: true,	4✔
60	DBRepository: "ghcr.io/aquasecurity/trivy-db",	4✔
61	JavaDBRepository: "ghcr.io/aquasecurity/trivy-java-db",	4✔
62	},	4✔
63	}	4✔
64		4✔
65	runner, err := artifact.NewRunner(ctx, opts)	4✔
66	if err != nil {	4✔
67	log.Error("NewVulnerabilityRunner: NewRunner error: ", err)	×
68	return VulnerabilityRunner{}, err	×
69	}	×
70
71	return VulnerabilityRunner{	4✔
72	log: log,	4✔
73	runner: runner,	4✔
74	}, nil	4✔
75	}
76
77	func (f VulnerabilityRunner) GetRunner() artifact.Runner {	5✔
78	return f.runner	5✔
79	}	5✔
80
81	func clearTrivyCache(ctx context.Context, log *logp.Logger) error {	4✔
82	log.Info("Starting VulnerabilityRunner.ClearCache")	4✔
83	defer log.Info("Ending VulnerabilityRunner.ClearCache")	4✔
84		4✔
85	// These are the three available cli settings for clean/reset translated to flag.Options object.	4✔
86	// {CacheOptions: flag.CacheOptions{ClearCache: true}},	4✔
87	// {DBOptions: flag.DBOptions{Reset: true}},	4✔
88	// {MisconfOptions: flag.MisconfOptions{ResetPolicyBundle: true}},	4✔
89	// In our case we will use only the ClearCache option.	4✔
90		4✔
91	errs := make([]error, 0, 2)	4✔
92	r, err := artifact.NewRunner(ctx, flag.Options{CacheOptions: flag.CacheOptions{ClearCache: true}})	4✔
93	if err != nil {	8✔
94	if !errors.Is(err, artifact.SkipScan) {	4✔
95	errs = append(errs, err)	×
96	}	×
97	}
98
99	// it should never go here (NewRunner should always return artifact.SkipScan and nil runner), but just in case it goes, lets close the runner.
100	if r != nil {	4✔
UNCOV 101	errs = append(errs, r.Close(ctx))	×
UNCOV 102	}	×
103
104	return errors.Join(errs...)	4✔
105	}

elastic / cloudbeat / 10352851867

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous