Skip to content

Commit 88ba460

Browse files
knqyf263DmitriyLewen
knqyf263
and
DmitriyLewen
authored
feat(vex): VEX Repository support (#7206)
Signed-off-by: knqyf263 <[email protected]> Co-authored-by: DmitriyLewen <[email protected]>
1 parent 174b1e3 commit 88ba460

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

77 files changed

+3497
-643
lines changed

‎.github/workflows/test.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -151,7 +151,7 @@ jobs:
151151
runs-on: ${{ matrix.operating-system }}
152152
strategy:
153153
matrix:
154-
operating-system: [ubuntu-latest-m, windows-latest, macos-latest]
154+
operating-system: [ubuntu-latest, windows-latest, macos-latest]
155155
env:
156156
DOCKER_CLI_EXPERIMENTAL: "enabled"
157157
steps:

‎docs/docs/configuration/cache.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,11 @@
11
# Cache
22
The cache directory includes
33

4+
- Cache of previous scans (Scan cache).
45
- [Vulnerability Database][trivy-db][^1]
56
- [Java Index Database][trivy-java-db][^2]
67
- [Misconfiguration Checks][misconf-checks][^3]
7-
- Cache of previous scans.
8+
- [VEX Repositories](../supply-chain/vex/repo.md)
89

910
The cache option is common to all scanners.
1011

‎docs/docs/configuration/filtering.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -493,7 +493,7 @@ You can find more example checks [here](https://github.com/aquasecurity/trivy/tr
493493
| Secret | |
494494
| License | |
495495
496-
Please refer to the [VEX documentation](../supply-chain/vex.md) for the details.
496+
Please refer to the [VEX documentation](../supply-chain/vex/index.md) for the details.
497497
498498
499499
[^1]: license name is used as id for `.trivyignore.yaml` files.

‎docs/docs/references/configuration/cli/trivy.md

+1
Original file line numberDiff line numberDiff line change
@@ -56,5 +56,6 @@ trivy [global flags] command [flags] target
5656
* [trivy sbom](trivy_sbom.md) - Scan SBOM for vulnerabilities and licenses
5757
* [trivy server](trivy_server.md) - Server mode
5858
* [trivy version](trivy_version.md) - Print the version
59+
* [trivy vex](trivy_vex.md) - [EXPERIMENTAL] VEX utilities
5960
* [trivy vm](trivy_vm.md) - [EXPERIMENTAL] Scan a virtual machine image
6061

‎docs/docs/references/configuration/cli/trivy_clean.md

+1
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ trivy clean [flags]
2828
-h, --help help for clean
2929
--java-db remove Java database
3030
--scan-cache remove scan cache (container and VM image analysis results)
31+
--vex-repo remove VEX repositories
3132
--vuln-db remove vulnerability database
3233
```
3334

‎docs/docs/references/configuration/cli/trivy_filesystem.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -82,14 +82,15 @@ trivy filesystem [flags] PATH
8282
--skip-dirs strings specify the directories or glob patterns to skip
8383
--skip-files strings specify the files or glob patterns to skip
8484
--skip-java-db-update skip updating Java index database
85+
--skip-vex-repo-update [EXPERIMENTAL] Skip VEX Repository update
8586
-t, --template string output template
8687
--tf-exclude-downloaded-modules exclude misconfigurations for downloaded terraform modules
8788
--tf-vars strings specify paths to override the Terraform tfvars files
8889
--token string for authentication in client/server mode
8990
--token-header string specify a header name for token in client/server mode (default "Trivy-Token")
9091
--trace enable more verbose trace output for custom queries
9192
--username strings username. Comma-separated usernames allowed.
92-
--vex string [EXPERIMENTAL] file path to VEX
93+
--vex strings [EXPERIMENTAL] VEX sources ("repo" or file path)
9394
```
9495

9596
### Options inherited from parent commands

‎docs/docs/references/configuration/cli/trivy_image.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -103,13 +103,14 @@ trivy image [flags] IMAGE_NAME
103103
--skip-dirs strings specify the directories or glob patterns to skip
104104
--skip-files strings specify the files or glob patterns to skip
105105
--skip-java-db-update skip updating Java index database
106+
--skip-vex-repo-update [EXPERIMENTAL] Skip VEX Repository update
106107
-t, --template string output template
107108
--tf-exclude-downloaded-modules exclude misconfigurations for downloaded terraform modules
108109
--token string for authentication in client/server mode
109110
--token-header string specify a header name for token in client/server mode (default "Trivy-Token")
110111
--trace enable more verbose trace output for custom queries
111112
--username strings username. Comma-separated usernames allowed.
112-
--vex string [EXPERIMENTAL] file path to VEX
113+
--vex strings [EXPERIMENTAL] VEX sources ("repo" or file path)
113114
```
114115

115116
### Options inherited from parent commands

‎docs/docs/references/configuration/cli/trivy_kubernetes.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -98,12 +98,13 @@ trivy kubernetes [flags] [CONTEXT]
9898
--skip-files strings specify the files or glob patterns to skip
9999
--skip-images skip the downloading and scanning of images (vulnerabilities and secrets) in the cluster resources
100100
--skip-java-db-update skip updating Java index database
101+
--skip-vex-repo-update [EXPERIMENTAL] Skip VEX Repository update
101102
-t, --template string output template
102103
--tf-exclude-downloaded-modules exclude misconfigurations for downloaded terraform modules
103104
--tolerations strings specify node-collector job tolerations (example: key1=value1:NoExecute,key2=value2:NoSchedule)
104105
--trace enable more verbose trace output for custom queries
105106
--username strings username. Comma-separated usernames allowed.
106-
--vex string [EXPERIMENTAL] file path to VEX
107+
--vex strings [EXPERIMENTAL] VEX sources ("repo" or file path)
107108
```
108109

109110
### Options inherited from parent commands

‎docs/docs/references/configuration/cli/trivy_repository.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,7 @@ trivy repository [flags] (REPO_PATH | REPO_URL)
8181
--skip-dirs strings specify the directories or glob patterns to skip
8282
--skip-files strings specify the files or glob patterns to skip
8383
--skip-java-db-update skip updating Java index database
84+
--skip-vex-repo-update [EXPERIMENTAL] Skip VEX Repository update
8485
--tag string pass the tag name to be scanned
8586
-t, --template string output template
8687
--tf-exclude-downloaded-modules exclude misconfigurations for downloaded terraform modules
@@ -89,7 +90,7 @@ trivy repository [flags] (REPO_PATH | REPO_URL)
8990
--token-header string specify a header name for token in client/server mode (default "Trivy-Token")
9091
--trace enable more verbose trace output for custom queries
9192
--username strings username. Comma-separated usernames allowed.
92-
--vex string [EXPERIMENTAL] file path to VEX
93+
--vex strings [EXPERIMENTAL] VEX sources ("repo" or file path)
9394
```
9495

9596
### Options inherited from parent commands

‎docs/docs/references/configuration/cli/trivy_rootfs.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -83,14 +83,15 @@ trivy rootfs [flags] ROOTDIR
8383
--skip-dirs strings specify the directories or glob patterns to skip
8484
--skip-files strings specify the files or glob patterns to skip
8585
--skip-java-db-update skip updating Java index database
86+
--skip-vex-repo-update [EXPERIMENTAL] Skip VEX Repository update
8687
-t, --template string output template
8788
--tf-exclude-downloaded-modules exclude misconfigurations for downloaded terraform modules
8889
--tf-vars strings specify paths to override the Terraform tfvars files
8990
--token string for authentication in client/server mode
9091
--token-header string specify a header name for token in client/server mode (default "Trivy-Token")
9192
--trace enable more verbose trace output for custom queries
9293
--username strings username. Comma-separated usernames allowed.
93-
--vex string [EXPERIMENTAL] file path to VEX
94+
--vex strings [EXPERIMENTAL] VEX sources ("repo" or file path)
9495
```
9596

9697
### Options inherited from parent commands

‎docs/docs/references/configuration/cli/trivy_sbom.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -58,10 +58,11 @@ trivy sbom [flags] SBOM_PATH
5858
--skip-dirs strings specify the directories or glob patterns to skip
5959
--skip-files strings specify the files or glob patterns to skip
6060
--skip-java-db-update skip updating Java index database
61+
--skip-vex-repo-update [EXPERIMENTAL] Skip VEX Repository update
6162
-t, --template string output template
6263
--token string for authentication in client/server mode
6364
--token-header string specify a header name for token in client/server mode (default "Trivy-Token")
64-
--vex string [EXPERIMENTAL] file path to VEX
65+
--vex strings [EXPERIMENTAL] VEX sources ("repo" or file path)
6566
```
6667

6768
### Options inherited from parent commands

‎docs/docs/references/configuration/cli/trivy_vex.md

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
## trivy vex
2+
3+
[EXPERIMENTAL] VEX utilities
4+
5+
### Options
6+
7+
```
8+
-h, --help help for vex
9+
```
10+
11+
### Options inherited from parent commands
12+
13+
```
14+
--cache-dir string cache directory (default "/path/to/cache")
15+
-c, --config string config path (default "trivy.yaml")
16+
-d, --debug debug mode
17+
--generate-default-config write the default config to trivy-default.yaml
18+
--insecure allow insecure server connections
19+
-q, --quiet suppress progress bar and log output
20+
--timeout duration timeout (default 5m0s)
21+
-v, --version show version
22+
```
23+
24+
### SEE ALSO
25+
26+
* [trivy](trivy.md) - Unified security scanner
27+
* [trivy vex repo](trivy_vex_repo.md) - Manage VEX repositories
28+

‎docs/docs/references/configuration/cli/trivy_vex_repo.md

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
## trivy vex repo
2+
3+
Manage VEX repositories
4+
5+
### Examples
6+
7+
```
8+
# Initialize the configuration file
9+
$ trivy vex repo init
10+
11+
# List VEX repositories
12+
$ trivy vex repo list
13+
14+
# Download the VEX repositories
15+
$ trivy vex repo download
16+
17+
```
18+
19+
### Options
20+
21+
```
22+
-h, --help help for repo
23+
```
24+
25+
### Options inherited from parent commands
26+
27+
```
28+
--cache-dir string cache directory (default "/path/to/cache")
29+
-c, --config string config path (default "trivy.yaml")
30+
-d, --debug debug mode
31+
--generate-default-config write the default config to trivy-default.yaml
32+
--insecure allow insecure server connections
33+
-q, --quiet suppress progress bar and log output
34+
--timeout duration timeout (default 5m0s)
35+
-v, --version show version
36+
```
37+
38+
### SEE ALSO
39+
40+
* [trivy vex](trivy_vex.md) - [EXPERIMENTAL] VEX utilities
41+
* [trivy vex repo download](trivy_vex_repo_download.md) - Download the VEX repositories
42+
* [trivy vex repo init](trivy_vex_repo_init.md) - Initialize a configuration file
43+
* [trivy vex repo list](trivy_vex_repo_list.md) - List VEX repositories
44+

‎docs/docs/references/configuration/cli/trivy_vex_repo_download.md

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
## trivy vex repo download
2+
3+
Download the VEX repositories
4+
5+
### Synopsis
6+
7+
Downloads enabled VEX repositories. If specific repository names are provided as arguments, only those repositories will be downloaded. Otherwise, all enabled repositories are downloaded.
8+
9+
```
10+
trivy vex repo download [REPO_NAMES] [flags]
11+
```
12+
13+
### Options
14+
15+
```
16+
-h, --help help for download
17+
```
18+
19+
### Options inherited from parent commands
20+
21+
```
22+
--cache-dir string cache directory (default "/path/to/cache")
23+
-c, --config string config path (default "trivy.yaml")
24+
-d, --debug debug mode
25+
--generate-default-config write the default config to trivy-default.yaml
26+
--insecure allow insecure server connections
27+
-q, --quiet suppress progress bar and log output
28+
--timeout duration timeout (default 5m0s)
29+
-v, --version show version
30+
```
31+
32+
### SEE ALSO
33+
34+
* [trivy vex repo](trivy_vex_repo.md) - Manage VEX repositories
35+

‎docs/docs/references/configuration/cli/trivy_vex_repo_init.md

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
## trivy vex repo init
2+
3+
Initialize a configuration file
4+
5+
```
6+
trivy vex repo init [flags]
7+
```
8+
9+
### Options
10+
11+
```
12+
-h, --help help for init
13+
```
14+
15+
### Options inherited from parent commands
16+
17+
```
18+
--cache-dir string cache directory (default "/path/to/cache")
19+
-c, --config string config path (default "trivy.yaml")
20+
-d, --debug debug mode
21+
--generate-default-config write the default config to trivy-default.yaml
22+
--insecure allow insecure server connections
23+
-q, --quiet suppress progress bar and log output
24+
--timeout duration timeout (default 5m0s)
25+
-v, --version show version
26+
```
27+
28+
### SEE ALSO
29+
30+
* [trivy vex repo](trivy_vex_repo.md) - Manage VEX repositories
31+

‎docs/docs/references/configuration/cli/trivy_vex_repo_list.md

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
## trivy vex repo list
2+
3+
List VEX repositories
4+
5+
```
6+
trivy vex repo list [flags]
7+
```
8+
9+
### Options
10+
11+
```
12+
-h, --help help for list
13+
```
14+
15+
### Options inherited from parent commands
16+
17+
```
18+
--cache-dir string cache directory (default "/path/to/cache")
19+
-c, --config string config path (default "trivy.yaml")
20+
-d, --debug debug mode
21+
--generate-default-config write the default config to trivy-default.yaml
22+
--insecure allow insecure server connections
23+
-q, --quiet suppress progress bar and log output
24+
--timeout duration timeout (default 5m0s)
25+
-v, --version show version
26+
```
27+
28+
### SEE ALSO
29+
30+
* [trivy vex repo](trivy_vex_repo.md) - Manage VEX repositories
31+

‎docs/docs/references/configuration/cli/trivy_vm.md

+2-1
Original file line numberDiff line numberDiff line change
@@ -72,11 +72,12 @@ trivy vm [flags] VM_IMAGE
7272
--skip-dirs strings specify the directories or glob patterns to skip
7373
--skip-files strings specify the files or glob patterns to skip
7474
--skip-java-db-update skip updating Java index database
75+
--skip-vex-repo-update [EXPERIMENTAL] Skip VEX Repository update
7576
-t, --template string output template
7677
--tf-exclude-downloaded-modules exclude misconfigurations for downloaded terraform modules
7778
--token string for authentication in client/server mode
7879
--token-header string specify a header name for token in client/server mode (default "Trivy-Token")
79-
--vex string [EXPERIMENTAL] file path to VEX
80+
--vex strings [EXPERIMENTAL] VEX sources ("repo" or file path)
8081
```
8182

8283
### Options inherited from parent commands

‎docs/docs/supply-chain/vex.md renamed to ‎docs/docs/supply-chain/vex/file.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
1-
# Vulnerability Exploitability Exchange (VEX)
1+
# Local VEX Files
22

33
!!! warning "EXPERIMENTAL"
44
This feature might change without preserving backwards compatibility.
55

6-
Trivy supports filtering detected vulnerabilities using [the Vulnerability Exploitability Exchange (VEX)](https://www.ntia.gov/files/ntia/publications/vex_one-page_summary.pdf), a standardized format for sharing and exchanging information about vulnerabilities.
7-
By providing VEX during scanning, it is possible to filter vulnerabilities based on their status.
8-
Currently, Trivy supports the following three formats:
6+
In addition to [VEX repositories](./repo.md), Trivy also supports the use of local VEX files for vulnerability filtering.
7+
This method is useful when you have specific VEX documents that you want to apply to your scans.
8+
Currently, Trivy supports the following formats:
99

1010
- [CycloneDX](https://cyclonedx.org/capabilities/vex/)
1111
- [OpenVEX](https://github.com/openvex/spec)

‎docs/docs/supply-chain/vex/index.md

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Vulnerability Exploitability Exchange (VEX)
2+
3+
!!! warning "EXPERIMENTAL"
4+
This feature might change without preserving backwards compatibility.
5+
6+
Trivy supports filtering detected vulnerabilities using the [Vulnerability Exploitability eXchange (VEX)](https://www.ntia.gov/files/ntia/publications/vex_one-page_summary.pdf), a standardized format for sharing and exchanging information about vulnerabilities.
7+
By providing VEX during scanning, it is possible to filter vulnerabilities based on their status.
8+
9+
## VEX Usage Methods
10+
11+
Trivy currently supports two methods for utilizing VEX:
12+
13+
1. [VEX Repository](./repo.md)
14+
2. [Local VEX Files](./file.md)
15+
16+
### Enabling VEX
17+
To enable VEX, use the `--vex` option.
18+
You can specify the method to use:
19+
20+
- To enable the VEX Repository: `--vex repo`
21+
- To use a local VEX file: `--vex /path/to/vex-document.json`
22+
23+
```bash
24+
$ trivy image ghcr.io/aquasecurity/trivy:0.52.0 --vex repo
25+
```
26+
27+
You can enable both methods simultaneously.
28+
The order of specification determines the priority:
29+
30+
- `--vex repo --vex /path/to/vex-document.json`: VEX Repository has priority
31+
- `--vex /path/to/vex-document.json --vex repo`: Local file has priority
32+
33+
For detailed information on each method, please refer to each page.

0 commit comments

Comments
 (0)