Skip to content

Commit 8d0ae1f

Browse files
knqyf263DmitriyLewen
knqyf263
and
DmitriyLewen
authored
feat!: add clean subcommand (#6993)
Signed-off-by: knqyf263 <[email protected]> Co-authored-by: DmitriyLewen <[email protected]> Co-authored-by: DmitriyLewen <[email protected]>
1 parent de201dc commit 8d0ae1f

35 files changed

+496
-210
lines changed

‎.github/DISCUSSION_TEMPLATE/bugs.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ body:
116116
label: Checklist
117117
description: Have you tried the following?
118118
options:
119-
- label: Run `trivy image --reset`
119+
- label: Run `trivy clean --all`
120120
- label: Read [the troubleshooting](https://aquasecurity.github.io/trivy/latest/docs/references/troubleshooting/)
121121
- type: markdown
122122
attributes:

‎docs/docs/configuration/cache.md

+7-6
Original file line numberDiff line numberDiff line change
@@ -9,24 +9,25 @@ The cache directory includes
99
The cache option is common to all scanners.
1010

1111
## Clear Caches
12-
The `--clear-cache` option removes caches.
13-
14-
**The scan is not performed.**
12+
`trivy clean` subcommand removes caches.
1513

1614
```
17-
$ trivy image --clear-cache
15+
$ trivy clean --scan-cache
1816
```
1917

2018
<details>
2119
<summary>Result</summary>
2220

2321
```
24-
2019-11-15T15:13:26.209+0200 INFO Reopening vulnerability DB
25-
2019-11-15T15:13:26.209+0200 INFO Removing image caches...
22+
2024-06-21T21:58:21+04:00 INFO Removing scan cache...
2623
```
2724

2825
</details>
2926

27+
If you want to delete cached vulnerability databases, use `--vuln-db`.
28+
You can also delete all caches with `--all`.
29+
See `trivy clean --help` for details.
30+
3031
## Cache Directory
3132
Specify where the cache is stored with `--cache-dir`.
3233

‎docs/docs/configuration/db.md

+4-2
Original file line numberDiff line numberDiff line change
@@ -78,8 +78,10 @@ $ trivy image --java-db-repository registry.gitlab.com/gitlab-org/security-produ
7878
`java-db-registry:latest` => `java-db-registry:latest`, but `java-db-registry` => `java-db-registry:1`.
7979

8080
## Remove DBs
81-
The `--reset` flag removes all caches and databases.
81+
"trivy clean" command removes caches and databases.
8282

8383
```
84-
$ trivy image --reset
84+
$ trivy clean --vuln-db --java-db
85+
2024-06-24T11:42:31+06:00 INFO Removing vulnerability database...
86+
2024-06-24T11:42:31+06:00 INFO Removing Java database...
8587
```

‎docs/docs/references/configuration/cli/trivy.md

+1
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ trivy [global flags] command [flags] target
4343

4444
### SEE ALSO
4545

46+
* [trivy clean](trivy_clean.md) - Remove cached files
4647
* [trivy config](trivy_config.md) - Scan config files for misconfigurations
4748
* [trivy convert](trivy_convert.md) - Convert Trivy JSON report into a different format
4849
* [trivy filesystem](trivy_filesystem.md) - Scan local filesystem

‎docs/docs/references/configuration/cli/trivy_clean.md

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
## trivy clean
2+
3+
Remove cached files
4+
5+
```
6+
trivy clean [flags]
7+
```
8+
9+
### Examples
10+
11+
```
12+
# Remove all caches
13+
$ trivy clean --all
14+
15+
# Remove scan cache
16+
$ trivy clean --scan-cache
17+
18+
# Remove vulnerability database
19+
$ trivy clean --vuln-db
20+
21+
```
22+
23+
### Options
24+
25+
```
26+
-a, --all remove all caches
27+
--checks-bundle remove checks bundle
28+
-h, --help help for clean
29+
--java-db remove Java database
30+
--scan-cache remove scan cache (container and VM image analysis results)
31+
--vuln-db remove vulnerability database
32+
```
33+
34+
### Options inherited from parent commands
35+
36+
```
37+
--cache-dir string cache directory (default "/path/to/cache")
38+
-c, --config string config path (default "trivy.yaml")
39+
-d, --debug debug mode
40+
--generate-default-config write the default config to trivy-default.yaml
41+
--insecure allow insecure server connections
42+
-q, --quiet suppress progress bar and log output
43+
--timeout duration timeout (default 5m0s)
44+
-v, --version show version
45+
```
46+
47+
### SEE ALSO
48+
49+
* [trivy](trivy.md) - Unified security scanner
50+

‎docs/docs/references/configuration/cli/trivy_config.md

-2
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@ trivy config [flags] DIR
1414
--cf-params strings specify paths to override the CloudFormation parameters files
1515
--check-namespaces strings Rego namespaces
1616
--checks-bundle-repository string OCI registry URL to retrieve checks bundle from (default "ghcr.io/aquasecurity/trivy-checks:0")
17-
--clear-cache clear image caches without scanning
1817
--compliance string compliance report to generate
1918
--config-check strings specify the paths to the Rego check files or to the directories containing them, applying config files
2019
--config-data strings specify paths from which data for the Rego checks will be recursively loaded
@@ -45,7 +44,6 @@ trivy config [flags] DIR
4544
--redis-tls enable redis TLS with public certificates, if using redis as cache backend
4645
--registry-token string registry token
4746
--report string specify a compliance report format for the output (all,summary) (default "all")
48-
--reset-checks-bundle remove checks bundle
4947
-s, --severity strings severities of security issues to be displayed (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL) (default [UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL])
5048
--skip-check-update skip fetching rego check updates
5149
--skip-dirs strings specify the directories or glob patterns to skip

‎docs/docs/references/configuration/cli/trivy_filesystem.md

-3
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@ trivy filesystem [flags] PATH
2424
--cf-params strings specify paths to override the CloudFormation parameters files
2525
--check-namespaces strings Rego namespaces
2626
--checks-bundle-repository string OCI registry URL to retrieve checks bundle from (default "ghcr.io/aquasecurity/trivy-checks:0")
27-
--clear-cache clear image caches without scanning
2827
--compliance string compliance report to generate
2928
--config-check strings specify the paths to the Rego check files or to the directories containing them, applying config files
3029
--config-data strings specify paths from which data for the Rego checks will be recursively loaded
@@ -71,8 +70,6 @@ trivy filesystem [flags] PATH
7170
--registry-token string registry token
7271
--rekor-url string [EXPERIMENTAL] address of rekor STL server (default "https://rekor.sigstore.dev")
7372
--report string specify a compliance report format for the output (all,summary) (default "all")
74-
--reset remove all caches and database
75-
--reset-checks-bundle remove checks bundle
7673
--sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor)
7774
--scanners strings comma-separated list of what security issues to detect (vuln,misconfig,secret,license) (default [vuln,secret])
7875
--secret-config string specify a path to config file for secret scanning (default "trivy-secret.yaml")

‎docs/docs/references/configuration/cli/trivy_image.md

-3
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,6 @@ trivy image [flags] IMAGE_NAME
3838
--cache-ttl duration cache TTL when using redis as cache backend
3939
--check-namespaces strings Rego namespaces
4040
--checks-bundle-repository string OCI registry URL to retrieve checks bundle from (default "ghcr.io/aquasecurity/trivy-checks:0")
41-
--clear-cache clear image caches without scanning
4241
--compliance string compliance report to generate (docker-cis)
4342
--config-check strings specify the paths to the Rego check files or to the directories containing them, applying config files
4443
--config-data strings specify paths from which data for the Rego checks will be recursively loaded
@@ -92,8 +91,6 @@ trivy image [flags] IMAGE_NAME
9291
--rekor-url string [EXPERIMENTAL] address of rekor STL server (default "https://rekor.sigstore.dev")
9392
--removed-pkgs detect vulnerabilities of removed packages (only for Alpine)
9493
--report string specify a format for the compliance report. (all,summary) (default "summary")
95-
--reset remove all caches and database
96-
--reset-checks-bundle remove checks bundle
9794
--sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor)
9895
--scanners strings comma-separated list of what security issues to detect (vuln,misconfig,secret,license) (default [vuln,secret])
9996
--secret-config string specify a path to config file for secret scanning (default "trivy-secret.yaml")

‎docs/docs/references/configuration/cli/trivy_kubernetes.md

-3
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,6 @@ trivy kubernetes [flags] [CONTEXT]
3434
--cache-ttl duration cache TTL when using redis as cache backend
3535
--check-namespaces strings Rego namespaces
3636
--checks-bundle-repository string OCI registry URL to retrieve checks bundle from (default "ghcr.io/aquasecurity/trivy-checks:0")
37-
--clear-cache clear image caches without scanning
3837
--compliance string compliance report to generate (k8s-nsa,k8s-cis,k8s-pss-baseline,k8s-pss-restricted)
3938
--config-check strings specify the paths to the Rego check files or to the directories containing them, applying config files
4039
--config-data strings specify paths from which data for the Rego checks will be recursively loaded
@@ -87,8 +86,6 @@ trivy kubernetes [flags] [CONTEXT]
8786
--registry-token string registry token
8887
--rekor-url string [EXPERIMENTAL] address of rekor STL server (default "https://rekor.sigstore.dev")
8988
--report string specify a report format for the output (all,summary) (default "all")
90-
--reset remove all caches and database
91-
--reset-checks-bundle remove checks bundle
9289
--sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor)
9390
--scanners strings comma-separated list of what security issues to detect (vuln,misconfig,secret,rbac) (default [vuln,misconfig,secret,rbac])
9491
--secret-config string specify a path to config file for secret scanning (default "trivy-secret.yaml")

‎docs/docs/references/configuration/cli/trivy_repository.md

-3
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@ trivy repository [flags] (REPO_PATH | REPO_URL)
2424
--cf-params strings specify paths to override the CloudFormation parameters files
2525
--check-namespaces strings Rego namespaces
2626
--checks-bundle-repository string OCI registry URL to retrieve checks bundle from (default "ghcr.io/aquasecurity/trivy-checks:0")
27-
--clear-cache clear image caches without scanning
2827
--commit string pass the commit hash to be scanned
2928
--config-check strings specify the paths to the Rego check files or to the directories containing them, applying config files
3029
--config-data strings specify paths from which data for the Rego checks will be recursively loaded
@@ -70,8 +69,6 @@ trivy repository [flags] (REPO_PATH | REPO_URL)
7069
--redis-tls enable redis TLS with public certificates, if using redis as cache backend
7170
--registry-token string registry token
7271
--rekor-url string [EXPERIMENTAL] address of rekor STL server (default "https://rekor.sigstore.dev")
73-
--reset remove all caches and database
74-
--reset-checks-bundle remove checks bundle
7572
--sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor)
7673
--scanners strings comma-separated list of what security issues to detect (vuln,misconfig,secret,license) (default [vuln,secret])
7774
--secret-config string specify a path to config file for secret scanning (default "trivy-secret.yaml")

‎docs/docs/references/configuration/cli/trivy_rootfs.md

-3
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@ trivy rootfs [flags] ROOTDIR
2727
--cf-params strings specify paths to override the CloudFormation parameters files
2828
--check-namespaces strings Rego namespaces
2929
--checks-bundle-repository string OCI registry URL to retrieve checks bundle from (default "ghcr.io/aquasecurity/trivy-checks:0")
30-
--clear-cache clear image caches without scanning
3130
--config-check strings specify the paths to the Rego check files or to the directories containing them, applying config files
3231
--config-data strings specify paths from which data for the Rego checks will be recursively loaded
3332
--custom-headers strings custom headers in client mode
@@ -72,8 +71,6 @@ trivy rootfs [flags] ROOTDIR
7271
--redis-tls enable redis TLS with public certificates, if using redis as cache backend
7372
--registry-token string registry token
7473
--rekor-url string [EXPERIMENTAL] address of rekor STL server (default "https://rekor.sigstore.dev")
75-
--reset remove all caches and database
76-
--reset-checks-bundle remove checks bundle
7774
--sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor)
7875
--scanners strings comma-separated list of what security issues to detect (vuln,misconfig,secret,license) (default [vuln,secret])
7976
--secret-config string specify a path to config file for secret scanning (default "trivy-secret.yaml")

‎docs/docs/references/configuration/cli/trivy_sbom.md

-2
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ trivy sbom [flags] SBOM_PATH
2222
```
2323
--cache-backend string cache backend (e.g. redis://localhost:6379) (default "fs")
2424
--cache-ttl duration cache TTL when using redis as cache backend
25-
--clear-cache clear image caches without scanning
2625
--compliance string compliance report to generate
2726
--custom-headers strings custom headers in client mode
2827
--db-repository string OCI repository to retrieve trivy-db from (default "ghcr.io/aquasecurity/trivy-db:2")
@@ -49,7 +48,6 @@ trivy sbom [flags] SBOM_PATH
4948
--redis-key string redis key file location, if using redis as cache backend
5049
--redis-tls enable redis TLS with public certificates, if using redis as cache backend
5150
--rekor-url string [EXPERIMENTAL] address of rekor STL server (default "https://rekor.sigstore.dev")
52-
--reset remove all caches and database
5351
--sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor)
5452
--scanners strings comma-separated list of what security issues to detect (vuln,license) (default [vuln])
5553
--server string server address in client mode

‎docs/docs/references/configuration/cli/trivy_server.md

-2
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ trivy server [flags]
2222
```
2323
--cache-backend string cache backend (e.g. redis://localhost:6379) (default "fs")
2424
--cache-ttl duration cache TTL when using redis as cache backend
25-
--clear-cache clear image caches without scanning
2625
--db-repository string OCI repository to retrieve trivy-db from (default "ghcr.io/aquasecurity/trivy-db:2")
2726
--download-db-only download/update vulnerability database but don't run a scan
2827
--enable-modules strings [EXPERIMENTAL] module names to enable
@@ -36,7 +35,6 @@ trivy server [flags]
3635
--redis-key string redis key file location, if using redis as cache backend
3736
--redis-tls enable redis TLS with public certificates, if using redis as cache backend
3837
--registry-token string registry token
39-
--reset remove all caches and database
4038
--skip-db-update skip updating vulnerability database
4139
--token string for authentication in client/server mode
4240
--token-header string specify a header name for token in client/server mode (default "Trivy-Token")

‎docs/docs/references/configuration/cli/trivy_vm.md

-3
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@ trivy vm [flags] VM_IMAGE
2424
--cache-backend string cache backend (e.g. redis://localhost:6379) (default "fs")
2525
--cache-ttl duration cache TTL when using redis as cache backend
2626
--checks-bundle-repository string OCI registry URL to retrieve checks bundle from (default "ghcr.io/aquasecurity/trivy-checks:0")
27-
--clear-cache clear image caches without scanning
2827
--compliance string compliance report to generate
2928
--custom-headers strings custom headers in client mode
3029
--db-repository string OCI repository to retrieve trivy-db from (default "ghcr.io/aquasecurity/trivy-db:2")
@@ -62,8 +61,6 @@ trivy vm [flags] VM_IMAGE
6261
--redis-key string redis key file location, if using redis as cache backend
6362
--redis-tls enable redis TLS with public certificates, if using redis as cache backend
6463
--rekor-url string [EXPERIMENTAL] address of rekor STL server (default "https://rekor.sigstore.dev")
65-
--reset remove all caches and database
66-
--reset-checks-bundle remove checks bundle
6764
--sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (oci,rekor)
6865
--scanners strings comma-separated list of what security issues to detect (vuln,misconfig,secret,license) (default [vuln,secret])
6966
--secret-config string specify a path to config file for secret scanning (default "trivy-secret.yaml")

‎docs/docs/references/troubleshooting.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -264,10 +264,10 @@ $ brew install aquasecurity/trivy/trivy
264264
## Others
265265
### Unknown error
266266

267-
Try again with `--reset` option:
267+
Try again after running `trivy clean --all`:
268268

269269
```
270-
$ trivy image --reset
270+
$ trivy clean --all
271271
```
272272

273273
[air-gapped]: ../advanced/air-gap.md

‎docs/tutorials/integrations/gitlab-ci.md

-2
Original file line numberDiff line numberDiff line change
@@ -85,8 +85,6 @@ container_scanning:
8585
FULL_IMAGE_NAME: $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG
8686
script:
8787
- trivy --version
88-
# cache cleanup is needed when scanning images with the same tags, it does not remove the database
89-
- time trivy image --clear-cache
9088
# update vulnerabilities db
9189
- time trivy image --download-db-only
9290
# Builds report and puts it in the default workdir $CI_PROJECT_DIR, so `artifacts:` can take it from there

‎mkdocs.yml

+1
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,7 @@ nav:
152152
- Configuration:
153153
- CLI:
154154
- Overview: docs/references/configuration/cli/trivy.md
155+
- Clean: docs/references/configuration/cli/trivy_clean.md
155156
- Config: docs/references/configuration/cli/trivy_config.md
156157
- Convert: docs/references/configuration/cli/trivy_convert.md
157158
- Filesystem: docs/references/configuration/cli/trivy_filesystem.md

‎pkg/cache/client.go

+5-34
Original file line numberDiff line numberDiff line change
@@ -20,11 +20,6 @@ const (
2020
TypeRedis Type = "redis"
2121
)
2222

23-
type Client struct {
24-
dir string
25-
Cache
26-
}
27-
2823
type Type string
2924

3025
type Options struct {
@@ -115,9 +110,8 @@ func NewType(backend string) (Type, error) {
115110
}
116111
}
117112

118-
// NewClient returns a new cache client
119-
func NewClient(dir string, opts Options) (*Client, error) {
120-
client := &Client{dir: dir}
113+
// New returns a new cache client
114+
func New(dir string, opts Options) (Cache, error) {
121115
if opts.Type == TypeRedis {
122116
log.Info("Redis cache", log.String("url", opts.Redis.BackendMasked()))
123117
options, err := redis.ParseURL(opts.Redis.Backend)
@@ -142,38 +136,15 @@ func NewClient(dir string, opts Options) (*Client, error) {
142136
}
143137
}
144138

145-
client.Cache = NewRedisCache(options, opts.TTL)
146-
return client, nil
139+
return NewRedisCache(options, opts.TTL), nil
147140
}
148141

149142
// standalone mode
150-
var err error
151-
client.Cache, err = NewFSCache(dir)
143+
fsCache, err := NewFSCache(dir)
152144
if err != nil {
153145
return nil, xerrors.Errorf("unable to initialize fs cache: %w", err)
154146
}
155-
return client, nil
156-
}
157-
158-
// Reset resets the cache
159-
func (c *Client) Reset() error {
160-
log.Info("Removing all caches...")
161-
if err := c.Clear(); err != nil {
162-
return xerrors.Errorf("failed to remove the cache: %w", err)
163-
}
164-
if err := os.RemoveAll(c.dir); err != nil {
165-
return xerrors.Errorf("failed to remove the directory (%s) : %w", c.dir, err)
166-
}
167-
return nil
168-
}
169-
170-
// ClearArtifacts clears the artifact cache
171-
func (c *Client) ClearArtifacts() error {
172-
log.Info("Removing artifact caches...")
173-
if err := c.Clear(); err != nil {
174-
return xerrors.Errorf("failed to remove the cache: %w", err)
175-
}
176-
return nil
147+
return fsCache, nil
177148
}
178149

179150
// GetTLSConfig gets tls config from CA, Cert and Key file

0 commit comments

Comments
 (0)