Skip to content

Commit

Permalink
remove dependency on github.com/aquasecurity/trivy
Browse files Browse the repository at this point in the history 
This fixes trivy forcing a toolchain directive down our throats.
  • Loading branch information
@majewsky
majewsky committed Feb 11, 2025
1 parent b7f15b1 commit c76f577
Show file tree
Hide file tree
Showing 143 changed files with 653 additions and 89,363 deletions.
13 changes: 6 additions & 7 deletions go.mod
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@ go 1.23

require (
github.com/alicebob/miniredis/v2 v2.34.0
github.com/aquasecurity/trivy v0.59.0
github.com/databus23/goslo.policy v0.0.0-20210929125152-81bf2876dbdb
github.com/dlmiddlecote/sqlstats v1.0.2
github.com/docker/distribution v2.8.3+incompatible
Expand All @@ -14,6 +13,7 @@ require (
github.com/golang-jwt/jwt/v5 v5.2.1
github.com/gophercloud/gophercloud/v2 v2.4.0
github.com/gorilla/mux v1.8.1
github.com/majewsky/gg v0.0.0-20250111151300-e739523ac1f9
github.com/majewsky/schwift/v2 v2.0.0
github.com/opencontainers/go-digest v1.0.0
github.com/opencontainers/image-spec v1.1.0
Expand All @@ -30,13 +30,13 @@ require (

require (
github.com/alicebob/gopher-json v0.0.0-20230218143504-906a9b012302 // indirect
github.com/aquasecurity/trivy-db v0.0.0-20241209111357-8c398f13db0e // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
github.com/distribution/reference v0.6.0 // indirect
github.com/docker/docker v27.5.0+incompatible // indirect
github.com/golang-migrate/migrate/v4 v4.18.2 // indirect
github.com/google/go-containerregistry v0.20.3 // indirect
github.com/hashicorp/errwrap v1.1.0 // indirect
github.com/hashicorp/go-multierror v1.1.1 // indirect
github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
Expand All @@ -45,18 +45,17 @@ require (
github.com/klauspost/compress v1.17.11 // indirect
github.com/lib/pq v1.10.9 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/package-url/packageurl-go v0.1.3 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/prometheus/client_model v0.6.1 // indirect
github.com/prometheus/common v0.62.0 // indirect
github.com/prometheus/procfs v0.15.1 // indirect
github.com/rabbitmq/amqp091-go v1.10.0 // indirect
github.com/samber/lo v1.49.0 // indirect
github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
github.com/spf13/pflag v1.0.5 // indirect
github.com/yuin/gopher-lua v1.1.1 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.59.0 // indirect
go.opentelemetry.io/otel/trace v1.34.0 // indirect
go.uber.org/atomic v1.11.0 // indirect
golang.org/x/sys v0.29.0 // indirect
golang.org/x/text v0.21.0 // indirect
golang.org/x/xerrors v0.0.0-20240716161551-93cc26a95ae9 // indirect
google.golang.org/protobuf v1.36.4 // indirect
)
16 changes: 2 additions & 14 deletions go.sum
View file
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,6 @@ github.com/alicebob/gopher-json v0.0.0-20230218143504-906a9b012302 h1:uvdUDbHQHO
github.com/alicebob/gopher-json v0.0.0-20230218143504-906a9b012302/go.mod h1:SGnFV6hVsYE877CKEZ6tDNTjaSXYUk6QqoIK6PrAtcc=
github.com/alicebob/miniredis/v2 v2.34.0 h1:mBFWMaJSNL9RwdGRyEDoAAv8OQc5UlEhLDQggTglU/0=
github.com/alicebob/miniredis/v2 v2.34.0/go.mod h1:kWShP4b58T1CW0Y5dViCd5ztzrDqRWqM3nksiyXk5s8=
github.com/aquasecurity/trivy v0.59.0 h1:ENMpySR/efn8lflYSP37KqPpYXVxklqf0HIpLsVkLfg=
github.com/aquasecurity/trivy v0.59.0/go.mod h1:dJIzxTfeSrUGtDBtbg2AiMbAnbVjo97lsLC9eyAawZI=
github.com/aquasecurity/trivy-db v0.0.0-20241209111357-8c398f13db0e h1:O5j5SeCNBrXApgBTOobO06q4LMxJxIhcSGE7H6Y154E=
github.com/aquasecurity/trivy-db v0.0.0-20241209111357-8c398f13db0e/go.mod h1:gS8VhlNxhraiq60BBnJw9kGtjeMspQ9E8pX24jCL4jg=
github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
Expand Down Expand Up @@ -80,8 +76,6 @@ github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5y
github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
github.com/google/go-containerregistry v0.20.3 h1:oNx7IdTI936V8CQRveCjaxOiegWwvM7kqkbXTpyiovI=
github.com/google/go-containerregistry v0.20.3/go.mod h1:w00pIgBRDVUDFM6bq+Qx8lwNWK+cxgCuX1vd3PIBDNI=
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
github.com/gophercloud/gophercloud/v2 v2.4.0 h1:XhP5tVEH3ni66NSNK1+0iSO6kaGPH/6srtx6Cr+8eCg=
github.com/gophercloud/gophercloud/v2 v2.4.0/go.mod h1:uJWNpTgJPSl2gyzJqcU/pIAhFUWvIkp8eE8M15n9rs4=
Expand Down Expand Up @@ -112,6 +106,8 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0
github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
github.com/majewsky/gg v0.0.0-20250111151300-e739523ac1f9 h1:pCBu+GMJPAHuDzTxY5mHu4ZrcNLSaSOVcOPT5kEL82g=
github.com/majewsky/gg v0.0.0-20250111151300-e739523ac1f9/go.mod h1:UuSpnSxdfn97ZDeuzcVk6kloht60WJ0H9zTeqI+PQXs=
github.com/majewsky/schwift/v2 v2.0.0 h1:Rgzv/18yMAej3bBZWoxYmS2lZMiCKD6P451dU8TyQtE=
github.com/majewsky/schwift/v2 v2.0.0/go.mod h1:qqN4N7s2+jhwebBgxFZm/e2NOqDzNphwb7SnAIB5G+4=
github.com/mattn/go-sqlite3 v1.14.6/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
Expand All @@ -135,8 +131,6 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
github.com/package-url/packageurl-go v0.1.3 h1:4juMED3hHiz0set3Vq3KeQ75KD1avthoXLtmE3I0PLs=
github.com/package-url/packageurl-go v0.1.3/go.mod h1:nKAWB8E6uk1MHqiS/lQb9pYBGH2+mdJ2PJc2s50dQY0=
github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
Expand Down Expand Up @@ -174,8 +168,6 @@ github.com/redis/go-redis/v9 v9.7.0/go.mod h1:f6zhXITC7JUJIlPEiBOTXxJgPLdZcA93Ge
github.com/rs/cors v1.11.1 h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=
github.com/rs/cors v1.11.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
github.com/samber/lo v1.49.0 h1:AGnTnQrg1jpFuwECPUSoxZCfVH5W22b605kWSry3YxM=
github.com/samber/lo v1.49.0/go.mod h1:dO6KHFzUKXgP8LDhU0oI8d2hekjXnGOu0DB8Jecxd6o=
github.com/sapcc/go-api-declarations v1.13.2 h1:dPYYsjwKGObSAm6+K+dYCiLQWunYuWkywlZnuXfjsmk=
github.com/sapcc/go-api-declarations v1.13.2/go.mod h1:83R3hTANhuRXt/pXDby37IJetw8l7DG41s33Tp9NXxI=
github.com/sapcc/go-bits v0.0.0-20250130092643-87f841392737 h1:L99i3+H739jgnYUASCjCve1xDkHRFMJBifkN4LkANNg=
Expand Down Expand Up @@ -232,10 +224,6 @@ golang.org/x/sys v0.0.0-20191220142924-d4481acd189f/go.mod h1:h1NjWce9XRLGQEsW7w
golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
golang.org/x/xerrors v0.0.0-20240716161551-93cc26a95ae9 h1:LLhsEBxRTBLuKlQxFBYUOU8xyFgXv6cOTp2HASDlsDk=
golang.org/x/xerrors v0.0.0-20240716161551-93cc26a95ae9/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
google.golang.org/protobuf v1.36.4 h1:6A3ZDJHn/eNqc1i+IdefRzy/9PokBTPvcqMySR7NNIM=
google.golang.org/protobuf v1.36.4/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
Expand Down
31 changes: 6 additions & 25 deletions internal/keppel/security_scan_policy.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,9 +21,7 @@ package keppel
import (
"encoding/json"
"fmt"
"time"

stypes "github.com/aquasecurity/trivy/pkg/module/serialize"
"github.com/sapcc/go-bits/errext"
"github.com/sapcc/go-bits/regexpext"

Expand Down Expand Up @@ -135,8 +133,8 @@ func (p SecurityScanPolicy) MatchesRepository(repo models.Repository) bool {
}

// MatchesVulnerability evaluates the vulnerability regexes and checkin this policy.
func (p SecurityScanPolicy) MatchesVulnerability(vuln stypes.DetectedVulnerability) bool {
if p.ExceptFixReleased && trivy.FixIsReleased(vuln) {
func (p SecurityScanPolicy) MatchesVulnerability(vuln trivy.DetectedVulnerability) bool {
if p.ExceptFixReleased && vuln.FixIsReleased() {
return false
}

Expand Down Expand Up @@ -178,7 +176,7 @@ func GetSecurityScanPolicies(account models.Account, repo models.Repository) (Se

// PolicyForVulnerability returns the first policy from this set that matches
// the vulnerability, or nil if no policy matches.
func (s SecurityScanPolicySet) PolicyForVulnerability(vuln stypes.DetectedVulnerability) *SecurityScanPolicy {
func (s SecurityScanPolicySet) PolicyForVulnerability(vuln trivy.DetectedVulnerability) *SecurityScanPolicy {
for _, p := range s {
if p.MatchesVulnerability(vuln) {
return &p
Expand All @@ -187,22 +185,6 @@ func (s SecurityScanPolicySet) PolicyForVulnerability(vuln stypes.DetectedVulner
return nil
}

// enrichedReport has the same fields as trivy.Report, plus the fields that our
// EnrichReport adds.
//
// We cannot just inline the existing type because that's not supported by the
// encoding/json library: <https://github.com/golang/go/issues/6213>
type enrichedReport struct {
SchemaVersion int `json:",omitempty"`
CreatedAt time.Time `json:",omitempty"`
ArtifactName string `json:",omitempty"`
ArtifactType string `json:",omitempty"`
Metadata trivy.Metadata `json:",omitempty"`
Results stypes.Results `json:",omitempty"`

ApplicablePolicies map[string]SecurityScanPolicy `json:"X-Keppel-Applicable-Policies,omitempty"`
}

// EnrichReport computes and inserts the "X-Keppel-Applicable-Policies" field
// if the report is `--format json`. Other formats are not altered.
func (s SecurityScanPolicySet) EnrichReport(payload *trivy.ReportPayload) error {
Expand All @@ -211,8 +193,7 @@ func (s SecurityScanPolicySet) EnrichReport(payload *trivy.ReportPayload) error
}

// decode relevant fields from report
var parsedReport enrichedReport
err := json.Unmarshal(payload.Contents, &parsedReport)
parsedReport, err := trivy.UnmarshalReportFromJSON(payload.Contents)
if err != nil {
return fmt.Errorf("cannot parse Trivy vulnerability report: %w", err)
}
Expand All @@ -232,8 +213,8 @@ func (s SecurityScanPolicySet) EnrichReport(payload *trivy.ReportPayload) error
if len(applicablePolicies) == 0 {
return nil
}
parsedReport.ApplicablePolicies = applicablePolicies
payload.Contents, err = json.Marshal(parsedReport)
parsedReport.AddField("X-Keppel-Applicable-Policies", applicablePolicies)
payload.Contents, err = parsedReport.MarshalJSON()
if err != nil {
return fmt.Errorf("cannot serialize enriched Trivy vulnerability report: %w", err)
}
Expand Down
Loading

0 comments on commit c76f577

Please sign in to comment.