Skip to content

Commit 5cbc452

Browse files
Tom FayDmitriyLewen
Tom Fay
and
DmitriyLewen
authored
feat(mariner): Add support for Azure Linux (#7186)
Co-authored-by: DmitriyLewen <[email protected]> Co-authored-by: DmitriyLewen <[email protected]>
1 parent 5f78045 commit 5cbc452

File tree

28 files changed

+224
-215
lines changed

28 files changed

+224
-215
lines changed

‎docs/community/contribute/pr.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,7 @@ os:
121121
- redhat
122122
- alma
123123
- rocky
124-
- mariner
124+
- azure
125125
- oracle
126126
- debian
127127
- ubuntu

‎docs/docs/coverage/os/cbl-mariner.md renamed to ‎docs/docs/coverage/os/azure.md

+14-9
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
1-
# CBL-Mariner
1+
# Azure Linux (CBL-Mariner)
2+
3+
*CBL-Mariner was rebranded to Azure Linux for version 3.0 onwards.*
4+
25
Trivy supports the following scanners for OS packages.
36

47
| Version | SBOM | Vulnerability | License |
@@ -7,6 +10,8 @@ Trivy supports the following scanners for OS packages.
710
| 1.0 (Distroless) | ✔ | ✔ | |
811
| 2.0 | ✔ | ✔ | ✔ |
912
| 2.0 (Distroless) | ✔ | ✔ | |
13+
| 3.0 | ✔ | ✔ | ✔ |
14+
| 3.0 (Distroless) | ✔ | ✔ | |
1015

1116

1217
The following table provides an outline of the targets Trivy supports.
@@ -15,6 +20,7 @@ The following table provides an outline of the targets Trivy supports.
1520
| ------- | :-------------: | :-------------: | :----------: |
1621
| 1.0 | ✔ | ✔ | amd64, arm64 |
1722
| 2.0 | ✔ | ✔ | amd64, arm64 |
23+
| 3.0 | ✔ | ✔ | amd64, arm64 |
1824

1925
The table below outlines the features offered by Trivy.
2026

@@ -24,22 +30,22 @@ The table below outlines the features offered by Trivy.
2430
| [Dependency graph][dependency-graph] | ✓ |
2531

2632
## SBOM
27-
Trivy detects packages that have been installed through package managers such as `dnf` and `yum`.
33+
Trivy detects packages that have been installed through package managers such as `tdnf`, `dnf` and `yum`.
2834

2935
## Vulnerability
30-
CBL-Mariner offers its own security advisories, and these are utilized when scanning CBL-Mariner for vulnerabilities.
36+
Azure Linux offers its own security advisories, and these are utilized when scanning Azure Linux for vulnerabilities.
3137

3238
### Data Source
3339
See [here](../../scanner/vulnerability.md#data-sources).
3440

3541
### Fixed Version
36-
Trivy takes fixed versions from [CBL-Mariner OVAL][oval].
42+
Trivy takes fixed versions from [Azure Linux OVAL][oval].
3743

3844
### Severity
39-
Trivy calculates the severity of an issue based on the severity provided in [CBL-Mariner OVAL][oval].
45+
Trivy calculates the severity of an issue based on the severity provided in [Azure Linux OVAL][oval].
4046

4147
### Status
42-
Trivy supports the following [vulnerability statuses] for CBL-Mariner.
48+
Trivy supports the following [vulnerability statuses] for Azure Linux.
4349

4450
| Status | Supported |
4551
| :-----------------: | :-------: |
@@ -55,12 +61,11 @@ Trivy supports the following [vulnerability statuses] for CBL-Mariner.
5561
Trivy identifies licenses by examining the metadata of RPM packages.
5662

5763
!!! note
58-
License detection is not supported for CBL-Mariner Distroless.
64+
License detection is not supported for Azure Linux Distroless images.
5965

6066

6167
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
62-
[cbl-mariner]: https://github.com/microsoft/CBL-Mariner
6368

64-
[oval]: https://github.com/microsoft/CBL-MarinerVulnerabilityData/
69+
[oval]: https://github.com/microsoft/AzureLinuxVulnerabilityData/
6570

6671
[vulnerability statuses]: ../../configuration/filtering.md#by-status

‎docs/docs/coverage/os/index.md

+19-19
Original file line numberDiff line numberDiff line change
@@ -9,25 +9,25 @@ Trivy supports operating systems for
99

1010
## Supported OS
1111

12-
| OS | Supported Versions | Package Managers |
13-
|--------------------------------------|-------------------------------------|------------------|
14-
| [Alpine Linux](alpine.md) | 2.2 - 2.7, 3.0 - 3.20, edge | apk |
15-
| [Wolfi Linux](wolfi.md) | (n/a) | apk |
16-
| [Chainguard](chainguard.md) | (n/a) | apk |
17-
| [Red Hat Enterprise Linux](rhel.md) | 6, 7, 8 | dnf/yum/rpm |
18-
| [CentOS](centos.md)[^1] | 6, 7, 8 | dnf/yum/rpm |
19-
| [AlmaLinux](alma.md) | 8, 9 | dnf/yum/rpm |
20-
| [Rocky Linux](rocky.md) | 8, 9 | dnf/yum/rpm |
21-
| [Oracle Linux](oracle.md) | 5, 6, 7, 8 | dnf/yum/rpm |
22-
| [CBL-Mariner](cbl-mariner.md) | 1.0, 2.0 | dnf/yum/rpm |
23-
| [Amazon Linux](amazon.md) | 1, 2, 2023 | dnf/yum/rpm |
24-
| [openSUSE Leap](suse.md) | 42, 15 | zypper/rpm |
25-
| [openSUSE Tumbleweed](suse.md) | (n/a) | zypper/rpm |
26-
| [SUSE Enterprise Linux](suse.md) | 11, 12, 15 | zypper/rpm |
27-
| [Photon OS](photon.md) | 1.0, 2.0, 3.0, 4.0 | tndf/yum/rpm |
28-
| [Debian GNU/Linux](debian.md) | 7, 8, 9, 10, 11, 12 | apt/dpkg |
29-
| [Ubuntu](ubuntu.md) | All versions supported by Canonical | apt/dpkg |
30-
| [OSs with installed Conda](conda.md) | - | conda |
12+
| OS | Supported Versions | Package Managers |
13+
|---------------------------------------|-------------------------------------|------------------|
14+
| [Alpine Linux](alpine.md) | 2.2 - 2.7, 3.0 - 3.20, edge | apk |
15+
| [Wolfi Linux](wolfi.md) | (n/a) | apk |
16+
| [Chainguard](chainguard.md) | (n/a) | apk |
17+
| [Red Hat Enterprise Linux](rhel.md) | 6, 7, 8 | dnf/yum/rpm |
18+
| [CentOS](centos.md)[^1] | 6, 7, 8 | dnf/yum/rpm |
19+
| [AlmaLinux](alma.md) | 8, 9 | dnf/yum/rpm |
20+
| [Rocky Linux](rocky.md) | 8, 9 | dnf/yum/rpm |
21+
| [Oracle Linux](oracle.md) | 5, 6, 7, 8 | dnf/yum/rpm |
22+
| [Azure Linux (CBL-Mariner)](azure.md) | 1.0, 2.0, 3.0 | tdnf/dnf/yum/rpm |
23+
| [Amazon Linux](amazon.md) | 1, 2, 2023 | dnf/yum/rpm |
24+
| [openSUSE Leap](suse.md) | 42, 15 | zypper/rpm |
25+
| [openSUSE Tumbleweed](suse.md) | (n/a) | zypper/rpm |
26+
| [SUSE Enterprise Linux](suse.md) | 11, 12, 15 | zypper/rpm |
27+
| [Photon OS](photon.md) | 1.0, 2.0, 3.0, 4.0 | tndf/yum/rpm |
28+
| [Debian GNU/Linux](debian.md) | 7, 8, 9, 10, 11, 12 | apt/dpkg |
29+
| [Ubuntu](ubuntu.md) | All versions supported by Canonical | apt/dpkg |
30+
| [OSs with installed Conda](conda.md) | - | conda |
3131

3232
## Supported container images
3333

‎docs/docs/scanner/vulnerability.md

+17-17
Original file line numberDiff line numberDiff line change
@@ -19,22 +19,22 @@ See [here](../coverage/os/index.md#supported-os) for the supported OSes.
1919

2020
### Data Sources
2121

22-
| OS | Source |
23-
| ------------- | ------------------------------------------------------------ |
24-
| Arch Linux | [Vulnerable Issues][arch] |
25-
| Alpine Linux | [secdb][alpine] |
26-
| Wolfi Linux | [secdb][wolfi] |
27-
| Chainguard | [secdb][chainguard] |
28-
| Amazon Linux | [Amazon Linux Security Center][amazon] |
29-
| Debian | [Security Bug Tracker][debian-tracker] / [OVAL][debian-oval] |
30-
| Ubuntu | [Ubuntu CVE Tracker][ubuntu] |
31-
| RHEL/CentOS | [OVAL][rhel-oval] / [Security Data][rhel-api] |
32-
| AlmaLinux | [AlmaLinux Product Errata][alma] |
33-
| Rocky Linux | [Rocky Linux UpdateInfo][rocky] |
34-
| Oracle Linux | [OVAL][oracle] |
35-
| CBL-Mariner | [OVAL][mariner] |
36-
| OpenSUSE/SLES | [CVRF][suse] |
37-
| Photon OS | [Photon Security Advisory][photon] |
22+
| OS | Source |
23+
|---------------------------|--------------------------------------------------------------|
24+
| Arch Linux | [Vulnerable Issues][arch] |
25+
| Alpine Linux | [secdb][alpine] |
26+
| Wolfi Linux | [secdb][wolfi] |
27+
| Chainguard | [secdb][chainguard] |
28+
| Amazon Linux | [Amazon Linux Security Center][amazon] |
29+
| Debian | [Security Bug Tracker][debian-tracker] / [OVAL][debian-oval] |
30+
| Ubuntu | [Ubuntu CVE Tracker][ubuntu] |
31+
| RHEL/CentOS | [OVAL][rhel-oval] / [Security Data][rhel-api] |
32+
| AlmaLinux | [AlmaLinux Product Errata][alma] |
33+
| Rocky Linux | [Rocky Linux UpdateInfo][rocky] |
34+
| Oracle Linux | [OVAL][oracle] |
35+
| Azure Linux (CBL-Mariner) | [OVAL][azure] |
36+
| OpenSUSE/SLES | [CVRF][suse] |
37+
| Photon OS | [Photon Security Advisory][photon] |
3838

3939
#### Data Source Selection
4040
Trivy **only** consumes security advisories from the sources listed in the above table.
@@ -288,7 +288,7 @@ Total: 7 (UNKNOWN: 0, LOW: 1, MEDIUM: 1, HIGH: 3, CRITICAL: 2)
288288
[oracle]: https://linux.oracle.com/security/oval/
289289
[suse]: http://ftp.suse.com/pub/projects/security/cvrf/
290290
[photon]: https://packages.vmware.com/photon/photon_cve_metadata/
291-
[mariner]: https://github.com/microsoft/CBL-MarinerVulnerabilityData/
291+
[azure]: https://github.com/microsoft/AzureLinuxVulnerabilityData/
292292
293293
[php-ghsa]: https://github.com/advisories?query=ecosystem%3Acomposer
294294
[python-ghsa]: https://github.com/advisories?query=ecosystem%3Apip

‎go.mod

+1-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ require (
2626
github.com/aquasecurity/testdocker v0.0.0-20240613070307-2c3868d658ac
2727
github.com/aquasecurity/tml v0.6.1
2828
github.com/aquasecurity/trivy-checks v0.13.0
29-
github.com/aquasecurity/trivy-db v0.0.0-20240701103400-8e907467e9ab
29+
github.com/aquasecurity/trivy-db v0.0.0-20240718084044-d23a6ca8ba04
3030
github.com/aquasecurity/trivy-java-db v0.0.0-20240109071736-184bd7481d48
3131
github.com/aquasecurity/trivy-kubernetes v0.6.7-0.20240707095038-0300bc49b68b
3232
github.com/aws/aws-sdk-go-v2 v1.30.3

‎go.sum

+2-2
Original file line numberDiff line numberDiff line change
@@ -771,8 +771,8 @@ github.com/aquasecurity/tml v0.6.1 h1:y2ZlGSfrhnn7t4ZJ/0rotuH+v5Jgv6BDDO5jB6A9gw
771771
github.com/aquasecurity/tml v0.6.1/go.mod h1:OnYMWY5lvI9ejU7yH9LCberWaaTBW7hBFsITiIMY2yY=
772772
github.com/aquasecurity/trivy-checks v0.13.0 h1:na6PTdY4U0uK/fjz3HNRYBxvYSJ8vgTb57a5T8Y5t9w=
773773
github.com/aquasecurity/trivy-checks v0.13.0/go.mod h1:Xec/SMVGV66I7RgUqOX9MEr+YxBqHXDVLTYmpspPi3E=
774-
github.com/aquasecurity/trivy-db v0.0.0-20240701103400-8e907467e9ab h1:EmpLGFgRJOstPWDpL4KW+Xap4zRYxyctXDTj5luMQdE=
775-
github.com/aquasecurity/trivy-db v0.0.0-20240701103400-8e907467e9ab/go.mod h1:f+wSW9D5txv8S+tw4D4WNOibaUJYwvNnQuQlGQ8gO6c=
774+
github.com/aquasecurity/trivy-db v0.0.0-20240718084044-d23a6ca8ba04 h1:6/T8sFdNVG/AwOGoK6X55h7hF7LYqK8bsuPz8iEz8jM=
775+
github.com/aquasecurity/trivy-db v0.0.0-20240718084044-d23a6ca8ba04/go.mod h1:0T6oy2t1Iedt+yi3Ml5cpOYp5FZT4MI1/mx+3p+PIs8=
776776
github.com/aquasecurity/trivy-java-db v0.0.0-20240109071736-184bd7481d48 h1:JVgBIuIYbwG+ekC5lUHUpGJboPYiCcxiz06RCtz8neI=
777777
github.com/aquasecurity/trivy-java-db v0.0.0-20240109071736-184bd7481d48/go.mod h1:Ldya37FLi0e/5Cjq2T5Bty7cFkzUDwTcPeQua+2M8i8=
778778
github.com/aquasecurity/trivy-kubernetes v0.6.7-0.20240707095038-0300bc49b68b h1:h7gsIzHyrxpQnayOuQI0kX7+8rVcqhV6G5bM3KVFyJU=

‎integration/testdata/mariner-1.0.json.golden

+4-4
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
"Metadata": {
77
"OS": {
88
"Family": "cbl-mariner",
9-
"Name": "1.0.20220122"
9+
"Name": "1.0"
1010
},
1111
"ImageID": "sha256:8cdcbf18341ed8afa5322e7b0077f8ef3f46896882c921df5f97c51b369f6767",
1212
"DiffIDs": [
@@ -34,15 +34,15 @@
3434
},
3535
"Results": [
3636
{
37-
"Target": "testdata/fixtures/images/mariner-1.0.tar.gz (cbl-mariner 1.0.20220122)",
37+
"Target": "testdata/fixtures/images/mariner-1.0.tar.gz (cbl-mariner 1.0)",
3838
"Class": "os-pkgs",
3939
"Type": "cbl-mariner",
4040
"Vulnerabilities": [
4141
{
4242
"VulnerabilityID": "CVE-2022-0261",
4343
"PkgName": "vim",
4444
"PkgIdentifier": {
45-
"PURL": "pkg:rpm/cbl-mariner/[email protected]?arch=x86_64\u0026distro=cbl-mariner-1.0.20220122",
45+
"PURL": "pkg:rpm/cbl-mariner/[email protected]?arch=x86_64\u0026distro=cbl-mariner-1.0",
4646
"UID": "3f08cd76fa5ba73d"
4747
},
4848
"InstalledVersion": "8.2.4081-1.cm1",
@@ -79,7 +79,7 @@
7979
"VulnerabilityID": "CVE-2022-0158",
8080
"PkgName": "vim",
8181
"PkgIdentifier": {
82-
"PURL": "pkg:rpm/cbl-mariner/[email protected]?arch=x86_64\u0026distro=cbl-mariner-1.0.20220122",
82+
"PURL": "pkg:rpm/cbl-mariner/[email protected]?arch=x86_64\u0026distro=cbl-mariner-1.0",
8383
"UID": "3f08cd76fa5ba73d"
8484
},
8585
"InstalledVersion": "8.2.4081-1.cm1",

‎mkdocs.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ nav:
7575
- AlmaLinux: docs/coverage/os/alma.md
7676
- Alpine Linux: docs/coverage/os/alpine.md
7777
- Amazon Linux: docs/coverage/os/amazon.md
78-
- CBL-Mariner: docs/coverage/os/cbl-mariner.md
78+
- Azure Linux (CBL-Mariner): docs/coverage/os/azure.md
7979
- CentOS: docs/coverage/os/centos.md
8080
- Chainguard: docs/coverage/os/chainguard.md
8181
- Conda: docs/coverage/os/conda.md

‎pkg/detector/ospkg/mariner/mariner.go renamed to ‎pkg/detector/ospkg/azure/azure.go

+15-7
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
1-
package mariner
1+
package azure
22

33
import (
44
"context"
55

66
version "github.com/knqyf263/go-rpm-version"
77
"golang.org/x/xerrors"
88

9-
"github.com/aquasecurity/trivy-db/pkg/vulnsrc/mariner"
9+
"github.com/aquasecurity/trivy-db/pkg/vulnsrc/azure"
1010
osver "github.com/aquasecurity/trivy/pkg/detector/ospkg/version"
1111
ftypes "github.com/aquasecurity/trivy/pkg/fanal/types"
1212
"github.com/aquasecurity/trivy/pkg/log"
@@ -16,16 +16,24 @@ import (
1616

1717
// Scanner implements the CBL-Mariner scanner
1818
type Scanner struct {
19-
vs mariner.VulnSrc
19+
vs azure.VulnSrc
2020
}
2121

2222
// NewScanner is the factory method for Scanner
23-
func NewScanner() *Scanner {
23+
func newScanner(distribution azure.Distribution) *Scanner {
2424
return &Scanner{
25-
vs: mariner.NewVulnSrc(),
25+
vs: azure.NewVulnSrc(distribution),
2626
}
2727
}
2828

29+
func NewAzureScanner() *Scanner {
30+
return newScanner(azure.Azure)
31+
}
32+
33+
func NewMarinerScanner() *Scanner {
34+
return newScanner(azure.Mariner)
35+
}
36+
2937
// Detect vulnerabilities in package using CBL-Mariner scanner
3038
func (s *Scanner) Detect(ctx context.Context, osVer string, _ *ftypes.Repository, pkgs []ftypes.Package) ([]types.DetectedVulnerability, error) {
3139
// e.g. 1.0.20210127
@@ -36,10 +44,10 @@ func (s *Scanner) Detect(ctx context.Context, osVer string, _ *ftypes.Repository
3644

3745
var vulns []types.DetectedVulnerability
3846
for _, pkg := range pkgs {
39-
// CBL Mariner OVAL contains source package names only.
47+
// Azure Linux OVAL contains source package names only.
4048
advisories, err := s.vs.Get(osVer, pkg.SrcName)
4149
if err != nil {
42-
return nil, xerrors.Errorf("failed to get CBL-Mariner advisories: %w", err)
50+
return nil, xerrors.Errorf("failed to get Azure Linux advisories: %w", err)
4351
}
4452

4553
sourceVersion := version.NewVersion(utils.FormatSrcVersion(pkg))

0 commit comments

Comments
 (0)