Skip to content

Commit 27117f8

Browse files
knqyf263DmitriyLewen
knqyf263
and
DmitriyLewen
authored
feat(cli): add trivy auth (#7664)
Signed-off-by: knqyf263 <[email protected]> Co-authored-by: DmitriyLewen <[email protected]>
1 parent 1f2e91b commit 27117f8

23 files changed

+512
-23
lines changed

‎contrib/Trivy.gitlab-ci.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,9 @@ Trivy_container_scanning:
1212
before_script:
1313
- export TRIVY_VERSION=${TRIVY_VERSION:-v0.19.2}
1414
- apk add --no-cache curl docker-cli
15-
- docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
1615
- curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin ${TRIVY_VERSION}
1716
- curl -sSL -o /tmp/trivy-gitlab.tpl https://github.com/aquasecurity/trivy/raw/${TRIVY_VERSION}/contrib/gitlab.tpl
17+
- trivy auth login --username "$CI_REGISTRY_USER" --password "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
1818
script:
1919
- trivy --exit-code 0 --cache-dir .trivycache/ --no-progress --format template --template "@/tmp/trivy-gitlab.tpl" -o gl-container-scanning-report.json $IMAGE
2020
cache:

‎docs/docs/advanced/private-registries/index.md

+21-13
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,30 @@
11
Trivy can download images from a private registry without the need for installing Docker or any other 3rd party tools.
22
This makes it easy to run within a CI process.
33

4-
## Credential
5-
To use Trivy with private images, simply install it and provide your credentials:
4+
## Login
5+
You can log in to a private registry using the `trivy auth login` command.
6+
It uses the Docker configuration file (`~/.docker/config.json`) to store the credentials under the hood, and the configuration file path can be configured by `DOCKER_CONFIG` environment variable.
7+
8+
```shell
9+
$ cat ~/my_password.txt | trivy auth login --username foo --password-stdin ghcr.io
10+
$ trivy image ghcr.io/your/private_image
11+
```
12+
13+
## Passing Credentials
14+
You can also provide your credentials when scanning.
615

716
```shell
817
$ TRIVY_USERNAME=YOUR_USERNAME TRIVY_PASSWORD=YOUR_PASSWORD trivy image YOUR_PRIVATE_IMAGE
918
```
1019

20+
!!! warning
21+
When passing credentials via environment variables or CLI flags, Trivy will attempt to use these credentials for all registries encountered during scanning, regardless of the target registry.
22+
This can potentially lead to unintended credential exposure.
23+
To mitigate this risk:
24+
25+
1. Set credentials cautiously and only when necessary.
26+
2. Prefer using `trivy auth config` to pre-configure credentials with specific registries, which ensures credentials are only sent to appropriate registries.
27+
1128
Trivy also supports providing credentials through CLI flags:
1229

1330
```shell
@@ -17,6 +34,7 @@ $ TRIVY_PASSWORD=YOUR_PASSWORD trivy image --username YOUR_USERNAME YOUR_PRIVATE
1734
!!! warning
1835
The CLI flag `--password` is available, but its use is not recommended for security reasons.
1936

37+
2038
You can also store your credentials in `trivy.yaml`.
2139
For more information, please refer to [the documentation](../../references/configuration/config-file.md).
2240

@@ -35,15 +53,5 @@ In the example above, Trivy attempts to use two pairs of credentials:
3553

3654
Please note that the number of usernames and passwords must be the same.
3755

38-
## docker login
39-
If you have Docker configured locally and have set up the credentials, Trivy can access them.
40-
41-
```shell
42-
$ docker login ghcr.io
43-
Username:
44-
Password:
45-
$ trivy image ghcr.io/your/private_image
46-
```
47-
4856
!!! note
49-
`docker login` can be used with any container runtime, such as Podman.
57+
`--password-stdin` doesn't support comma-separated passwords.

‎docs/docs/references/configuration/cli/trivy.md

+1
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ trivy [global flags] command [flags] target
4343

4444
### SEE ALSO
4545

46+
* [trivy auth](trivy_auth.md) - Authentication
4647
* [trivy clean](trivy_clean.md) - Remove cached files
4748
* [trivy config](trivy_config.md) - Scan config files for misconfigurations
4849
* [trivy convert](trivy_convert.md) - Convert Trivy JSON report into a different format

‎docs/docs/references/configuration/cli/trivy_auth.md

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
## trivy auth
2+
3+
Authentication
4+
5+
### Options
6+
7+
```
8+
-h, --help help for auth
9+
```
10+
11+
### Options inherited from parent commands
12+
13+
```
14+
--cache-dir string cache directory (default "/path/to/cache")
15+
-c, --config string config path (default "trivy.yaml")
16+
-d, --debug debug mode
17+
--generate-default-config write the default config to trivy-default.yaml
18+
--insecure allow insecure server connections
19+
-q, --quiet suppress progress bar and log output
20+
--timeout duration timeout (default 5m0s)
21+
-v, --version show version
22+
```
23+
24+
### SEE ALSO
25+
26+
* [trivy](trivy.md) - Unified security scanner
27+
* [trivy auth login](trivy_auth_login.md) - Log in to a registry
28+
* [trivy auth logout](trivy_auth_logout.md) - Log out of a registry
29+

‎docs/docs/references/configuration/cli/trivy_auth_login.md

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
## trivy auth login
2+
3+
Log in to a registry
4+
5+
```
6+
trivy auth login SERVER [flags]
7+
```
8+
9+
### Examples
10+
11+
```
12+
# Log in to reg.example.com
13+
cat ~/my_password.txt | trivy auth login --username foo --password-stdin reg.example.com
14+
```
15+
16+
### Options
17+
18+
```
19+
-h, --help help for login
20+
--password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons.
21+
--password-stdin password from stdin. Comma-separated passwords are not supported.
22+
--username strings username. Comma-separated usernames allowed.
23+
```
24+
25+
### Options inherited from parent commands
26+
27+
```
28+
--cache-dir string cache directory (default "/path/to/cache")
29+
-c, --config string config path (default "trivy.yaml")
30+
-d, --debug debug mode
31+
--generate-default-config write the default config to trivy-default.yaml
32+
--insecure allow insecure server connections
33+
-q, --quiet suppress progress bar and log output
34+
--timeout duration timeout (default 5m0s)
35+
-v, --version show version
36+
```
37+
38+
### SEE ALSO
39+
40+
* [trivy auth](trivy_auth.md) - Authentication
41+

‎docs/docs/references/configuration/cli/trivy_auth_logout.md

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
## trivy auth logout
2+
3+
Log out of a registry
4+
5+
```
6+
trivy auth logout SERVER [flags]
7+
```
8+
9+
### Examples
10+
11+
```
12+
# Log out of reg.example.com
13+
trivy auth logout reg.example.com
14+
```
15+
16+
### Options
17+
18+
```
19+
-h, --help help for logout
20+
```
21+
22+
### Options inherited from parent commands
23+
24+
```
25+
--cache-dir string cache directory (default "/path/to/cache")
26+
-c, --config string config path (default "trivy.yaml")
27+
-d, --debug debug mode
28+
--generate-default-config write the default config to trivy-default.yaml
29+
--insecure allow insecure server connections
30+
-q, --quiet suppress progress bar and log output
31+
--timeout duration timeout (default 5m0s)
32+
-v, --version show version
33+
```
34+
35+
### SEE ALSO
36+
37+
* [trivy auth](trivy_auth.md) - Authentication
38+

‎docs/docs/references/configuration/cli/trivy_config.md

+1
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ trivy config [flags] DIR
3939
-o, --output string output file name
4040
--output-plugin-arg string [EXPERIMENTAL] output plugin arguments
4141
--password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons.
42+
--password-stdin password from stdin. Comma-separated passwords are not supported.
4243
--redis-ca string redis ca file location, if using redis as cache backend
4344
--redis-cert string redis certificate file location, if using redis as cache backend
4445
--redis-key string redis key file location, if using redis as cache backend

‎docs/docs/references/configuration/cli/trivy_filesystem.md

+1
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@ trivy filesystem [flags] PATH
6868
--output-plugin-arg string [EXPERIMENTAL] output plugin arguments
6969
--parallel int number of goroutines enabled for parallel scanning, set 0 to auto-detect parallelism (default 5)
7070
--password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons.
71+
--password-stdin password from stdin. Comma-separated passwords are not supported.
7172
--pkg-relationships strings list of package relationships (unknown,root,direct,indirect) (default [unknown,root,direct,indirect])
7273
--pkg-types strings list of package types (os,library) (default [os,library])
7374
--redis-ca string redis ca file location, if using redis as cache backend

‎docs/docs/references/configuration/cli/trivy_image.md

+1
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,7 @@ trivy image [flags] IMAGE_NAME
8686
--output-plugin-arg string [EXPERIMENTAL] output plugin arguments
8787
--parallel int number of goroutines enabled for parallel scanning, set 0 to auto-detect parallelism (default 5)
8888
--password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons.
89+
--password-stdin password from stdin. Comma-separated passwords are not supported.
8990
--pkg-relationships strings list of package relationships (unknown,root,direct,indirect) (default [unknown,root,direct,indirect])
9091
--pkg-types strings list of package types (os,library) (default [os,library])
9192
--platform string set platform in the form os/arch if image is multi-platform capable

‎docs/docs/references/configuration/cli/trivy_kubernetes.md

+1
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,7 @@ trivy kubernetes [flags] [CONTEXT]
8383
--output-plugin-arg string [EXPERIMENTAL] output plugin arguments
8484
--parallel int number of goroutines enabled for parallel scanning, set 0 to auto-detect parallelism (default 5)
8585
--password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons.
86+
--password-stdin password from stdin. Comma-separated passwords are not supported.
8687
--pkg-relationships strings list of package relationships (unknown,root,direct,indirect) (default [unknown,root,direct,indirect])
8788
--pkg-types strings list of package types (os,library) (default [os,library])
8889
--qps float specify the maximum QPS to the master from this client (default 5)

‎docs/docs/references/configuration/cli/trivy_repository.md

+1
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@ trivy repository [flags] (REPO_PATH | REPO_URL)
6868
--output-plugin-arg string [EXPERIMENTAL] output plugin arguments
6969
--parallel int number of goroutines enabled for parallel scanning, set 0 to auto-detect parallelism (default 5)
7070
--password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons.
71+
--password-stdin password from stdin. Comma-separated passwords are not supported.
7172
--pkg-relationships strings list of package relationships (unknown,root,direct,indirect) (default [unknown,root,direct,indirect])
7273
--pkg-types strings list of package types (os,library) (default [os,library])
7374
--redis-ca string redis ca file location, if using redis as cache backend

‎docs/docs/references/configuration/cli/trivy_rootfs.md

+1
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,7 @@ trivy rootfs [flags] ROOTDIR
7070
--output-plugin-arg string [EXPERIMENTAL] output plugin arguments
7171
--parallel int number of goroutines enabled for parallel scanning, set 0 to auto-detect parallelism (default 5)
7272
--password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons.
73+
--password-stdin password from stdin. Comma-separated passwords are not supported.
7374
--pkg-relationships strings list of package relationships (unknown,root,direct,indirect) (default [unknown,root,direct,indirect])
7475
--pkg-types strings list of package types (os,library) (default [os,library])
7576
--redis-ca string redis ca file location, if using redis as cache backend

‎docs/docs/references/configuration/cli/trivy_sbom.md

+1
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@ trivy sbom [flags] SBOM_PATH
4848
-o, --output string output file name
4949
--output-plugin-arg string [EXPERIMENTAL] output plugin arguments
5050
--password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons.
51+
--password-stdin password from stdin. Comma-separated passwords are not supported.
5152
--pkg-relationships strings list of package relationships (unknown,root,direct,indirect) (default [unknown,root,direct,indirect])
5253
--pkg-types strings list of package types (os,library) (default [os,library])
5354
--redis-ca string redis ca file location, if using redis as cache backend

‎docs/docs/references/configuration/cli/trivy_server.md

+1
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ trivy server [flags]
3030
--module-dir string specify directory to the wasm modules that will be loaded (default "$HOME/.trivy/modules")
3131
--no-progress suppress progress bar
3232
--password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons.
33+
--password-stdin password from stdin. Comma-separated passwords are not supported.
3334
--redis-ca string redis ca file location, if using redis as cache backend
3435
--redis-cert string redis certificate file location, if using redis as cache backend
3536
--redis-key string redis key file location, if using redis as cache backend

‎docs/docs/references/configuration/config-file.md

+3
Original file line numberDiff line numberDiff line change
@@ -461,6 +461,9 @@ registry:
461461
# Same as '--password'
462462
password: []
463463

464+
# Same as '--password-stdin'
465+
password-stdin: false
466+
464467
# Same as '--registry-token'
465468
token: ""
466469

‎docs/docs/target/container_image.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -297,7 +297,7 @@ Trivy supports registries that comply with the following specifications.
297297
- [Docker Registry HTTP API V2](https://docs.docker.com/registry/spec/api/)
298298
- [OCI Distribution Specification](https://github.com/opencontainers/distribution-spec)
299299

300-
You can configure credentials with `docker login`.
300+
You can configure credentials with `trivy auth login`.
301301
See [here](../advanced/private-registries/index.md) for the detail.
302302

303303
### Tar Files

‎go.mod

+1-1
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ require (
4343
github.com/cheggaaa/pb/v3 v3.1.5
4444
github.com/containerd/containerd v1.7.22
4545
github.com/csaf-poc/csaf_distribution/v3 v3.0.0
46+
github.com/docker/cli v27.2.1+incompatible
4647
github.com/docker/docker v27.3.1+incompatible
4748
github.com/docker/go-connections v0.5.0
4849
github.com/fatih/color v1.17.0
@@ -210,7 +211,6 @@ require (
210211
github.com/digitorus/timestamp v0.0.0-20231217203849-220c5c2851b7 // indirect
211212
github.com/distribution/reference v0.6.0 // indirect
212213
github.com/dlclark/regexp2 v1.4.0 // indirect
213-
github.com/docker/cli v27.2.1+incompatible // indirect
214214
github.com/docker/distribution v2.8.3+incompatible // indirect
215215
github.com/docker/docker-credential-helpers v0.8.2 // indirect
216216
github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect

‎integration/registry_test.go

+33-6
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,7 @@ type registryOption struct {
117117
Username string
118118
Password string
119119
RegistryToken bool
120+
AuthLogin bool
120121
}
121122

122123
func TestRegistry(t *testing.T) {
@@ -164,7 +165,6 @@ func TestRegistry(t *testing.T) {
164165
imageFile: "testdata/fixtures/images/alpine-310.tar.gz",
165166
os: "alpine 3.10.2",
166167
option: registryOption{
167-
AuthURL: authURL,
168168
Username: authUsername,
169169
Password: authPassword,
170170
},
@@ -183,13 +183,24 @@ func TestRegistry(t *testing.T) {
183183
},
184184
golden: "testdata/alpine-310.json.golden",
185185
},
186+
{
187+
name: "authenticate with 'trivy auth login'",
188+
imageName: "alpine:3.10",
189+
imageFile: "testdata/fixtures/images/alpine-310.tar.gz",
190+
os: "alpine 3.10.2",
191+
option: registryOption{
192+
Username: authUsername,
193+
Password: authPassword,
194+
AuthLogin: true,
195+
},
196+
golden: "testdata/alpine-310.json.golden",
197+
},
186198
{
187199
name: "amazonlinux 2",
188200
imageName: "amazonlinux:2",
189201
imageFile: "testdata/fixtures/images/amazon-2.tar.gz",
190202
os: "amazon 2 (Karoo)",
191203
option: registryOption{
192-
AuthURL: authURL,
193204
Username: authUsername,
194205
Password: authPassword,
195206
},
@@ -201,7 +212,6 @@ func TestRegistry(t *testing.T) {
201212
imageFile: "testdata/fixtures/images/debian-buster.tar.gz",
202213
os: "debian 10.1",
203214
option: registryOption{
204-
AuthURL: authURL,
205215
Username: authUsername,
206216
Password: authPassword,
207217
},
@@ -226,6 +236,7 @@ func TestRegistry(t *testing.T) {
226236
require.NoError(t, err)
227237

228238
osArgs, err := scan(t, imageRef, baseDir, tt.option)
239+
require.NoError(t, err)
229240

230241
// Run Trivy
231242
runTest(t, osArgs, tt.golden, "", types.FormatJSON, runOptions{
@@ -262,7 +273,7 @@ func scan(t *testing.T, imageRef name.Reference, baseDir string, opt registryOpt
262273
"json",
263274
"--image-src",
264275
"remote",
265-
"--skip-update",
276+
"--skip-db-update",
266277
imageRef.Name(),
267278
}
268279

@@ -273,14 +284,30 @@ func setupEnv(t *testing.T, imageRef name.Reference, baseDir string, opt registr
273284
t.Setenv("TRIVY_INSECURE", "true")
274285

275286
if opt.Username != "" && opt.Password != "" {
276-
if opt.RegistryToken {
287+
switch {
288+
case opt.RegistryToken:
277289
// Get a registry token in advance
278290
token, err := requestRegistryToken(imageRef, baseDir, opt)
279291
if err != nil {
280292
return err
281293
}
282294
t.Setenv("TRIVY_REGISTRY_TOKEN", token)
283-
} else {
295+
case opt.AuthLogin:
296+
t.Setenv("DOCKER_CONFIG", t.TempDir())
297+
err := execute([]string{
298+
"auth",
299+
"login",
300+
"--username",
301+
opt.Username,
302+
"--password",
303+
opt.Password,
304+
"--insecure",
305+
imageRef.Context().RegistryStr(),
306+
})
307+
if err != nil {
308+
return err
309+
}
310+
default:
284311
t.Setenv("TRIVY_USERNAME", opt.Username)
285312
t.Setenv("TRIVY_PASSWORD", opt.Password)
286313
}

‎mkdocs.yml

+4
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,10 @@ nav:
158158
- Configuration:
159159
- CLI:
160160
- Overview: docs/references/configuration/cli/trivy.md
161+
- Auth:
162+
- Auth: docs/references/configuration/cli/trivy_auth.md
163+
- Auth Login: docs/references/configuration/cli/trivy_auth_login.md
164+
- Auth Logout: docs/references/configuration/cli/trivy_auth_logout.md
161165
- Clean: docs/references/configuration/cli/trivy_clean.md
162166
- Config: docs/references/configuration/cli/trivy_config.md
163167
- Convert: docs/references/configuration/cli/trivy_convert.md

0 commit comments

Comments
 (0)