Skip to content

Commit efdb68d

Browse files
msmeissnknqyf263
msmeissn
and
knqyf263
authored
feat(suse): added SUSE Linux Enterprise Micro support (#7294)
Signed-off-by: Marcus Meissner <[email protected]> Signed-off-by: knqyf263 <[email protected]> Co-authored-by: knqyf263 <[email protected]>
1 parent ef0a27d commit efdb68d

23 files changed

+453
-136
lines changed

‎docs/docs/coverage/os/index.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,8 @@ Trivy supports operating systems for
2323
| [Amazon Linux](amazon.md) | 1, 2, 2023 | dnf/yum/rpm |
2424
| [openSUSE Leap](suse.md) | 42, 15 | zypper/rpm |
2525
| [openSUSE Tumbleweed](suse.md) | (n/a) | zypper/rpm |
26-
| [SUSE Enterprise Linux](suse.md) | 11, 12, 15 | zypper/rpm |
26+
| [SUSE Linux Enterprise](suse.md) | 11, 12, 15 | zypper/rpm |
27+
| [SUSE Linux Enterprise Micro](suse.md)| 5, 6 | zypper/rpm |
2728
| [Photon OS](photon.md) | 1.0, 2.0, 3.0, 4.0 | tndf/yum/rpm |
2829
| [Debian GNU/Linux](debian.md) | 7, 8, 9, 10, 11, 12 | apt/dpkg |
2930
| [Ubuntu](ubuntu.md) | All versions supported by Canonical | apt/dpkg |

‎docs/docs/coverage/os/suse.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,8 @@ Trivy supports the following distributions:
33

44
- openSUSE Leap
55
- openSUSE Tumbleweed
6-
- SUSE Enterprise Linux (SLE)
6+
- SUSE Linux Enterprise (SLE)
7+
- SUSE Linux Enterprise Micro
78

89
Please see [here](index.md#supported-os) for supported versions.
910

‎integration/client_server_test.go

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -220,6 +220,13 @@ func TestClientServer(t *testing.T) {
220220
},
221221
golden: "testdata/opensuse-tumbleweed.json.golden",
222222
},
223+
{
224+
name: "sle micro rancher 5.4",
225+
args: csArgs{
226+
Input: "testdata/fixtures/images/sle-micro-rancher-5.4_ndb.tar.gz",
227+
},
228+
golden: "testdata/sl-micro-rancher5.4.json.golden",
229+
},
223230
{
224231
name: "photon 3.0",
225232
args: csArgs{

‎integration/docker_engine_test.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -198,6 +198,12 @@ func TestDockerEngine(t *testing.T) {
198198
input: "testdata/fixtures/images/opensuse-tumbleweed.tar.gz",
199199
golden: "testdata/opensuse-tumbleweed.json.golden",
200200
},
201+
{
202+
name: "sle micro rancher 5.4",
203+
imageTag: "ghcr.io/aquasecurity/trivy-test-images:sle-micro-rancher-5.4_ndb",
204+
input: "testdata/fixtures/images/sle-micro-rancher-5.4_ndb.tar.gz",
205+
golden: "testdata/sl-micro-rancher5.4.json.golden",
206+
},
201207
{
202208
name: "photon 3.0",
203209
imageTag: "ghcr.io/aquasecurity/trivy-test-images:photon-30",

‎integration/standalone_tar_test.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -341,6 +341,14 @@ func TestTar(t *testing.T) {
341341
},
342342
golden: "testdata/opensuse-tumbleweed.json.golden",
343343
},
344+
{
345+
name: "sle micro rancher 5.4",
346+
args: args{
347+
Format: types.FormatJSON,
348+
Input: "testdata/fixtures/images/sle-micro-rancher-5.4_ndb.tar.gz",
349+
},
350+
golden: "testdata/sl-micro-rancher5.4.json.golden",
351+
},
344352
{
345353
name: "photon 3.0",
346354
args: args{

‎integration/testdata/fixtures/db/suse.yaml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
- bucket: "SUSE Linux Enterprise 15-SP3"
2+
pairs:
3+
- bucket: libopenssl1_1
4+
pairs:
5+
- key: "SUSE-SU-2022:2251-1"
6+
value:
7+
FixedVersion: 1.1.1d-150200.11.48.1
8+
- bucket: openssl-1_1
9+
pairs:
10+
- key: "SUSE-SU-2022:2251-1"
11+
value:
12+
FixedVersion: 1.1.1d-150200.11.48.1
13+
- bucket: "SUSE Linux Enterprise Micro 5.3"
14+
pairs:
15+
- bucket: libopenssl1_1
16+
pairs:
17+
- key: "SUSE-SU-2023:0311-1"
18+
value:
19+
FixedVersion: 1.1.1l-150400.7.22.1

‎integration/testdata/fixtures/db/vulnerability.yaml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1349,6 +1349,15 @@
13491349
- "https://www.suse.com/security/cve/CVE-2023-2975/"
13501350
- "https://www.suse.com/security/cve/CVE-2023-3446/"
13511351
- "https://www.suse.com/support/security/rating/"
1352+
- key: SUSE-SU-2022:2251-1
1353+
value:
1354+
Title: "Security update for openssl-1_1"
1355+
Description: "This update for openssl-1_1 fixes the following issues:\nCVE-2022-1292: Fixed command injection in c_rehash (bsc#1199166).\nCVE-2022-2068: Fixed more shell code injection issues in c_rehash. (bsc#1200550)"
1356+
Severity: MEDIUM
1357+
References:
1358+
- "https://www.suse.com/security/cve/CVE-2022-1292/"
1359+
- "https://www.suse.com/security/cve/CVE-2022-2068/"
1360+
- "https://www.suse.com/support/security/rating/"
13521361
- key: CVE-2022-22965
13531362
value:
13541363
Title: "spring-framework: RCE via Data Binding on JDK 9+"

‎integration/testdata/opensuse-leap-151.json.golden

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@
6666
"PkgID": "[email protected]_64",
6767
"PkgName": "libopenssl1_1",
6868
"PkgIdentifier": {
69-
"PURL": "pkg:rpm/opensuse.leap/[email protected]?arch=x86_64\u0026distro=opensuse.leap-15.1",
69+
"PURL": "pkg:rpm/opensuse/[email protected]?arch=x86_64\u0026distro=opensuse.leap-15.1",
7070
"UID": "898b73ddd0412f57"
7171
},
7272
"InstalledVersion": "1.1.0i-lp151.8.3.1",
@@ -99,7 +99,7 @@
9999
"PkgID": "[email protected]_64",
100100
"PkgName": "openssl-1_1",
101101
"PkgIdentifier": {
102-
"PURL": "pkg:rpm/opensuse.leap/[email protected]?arch=x86_64\u0026distro=opensuse.leap-15.1",
102+
"PURL": "pkg:rpm/opensuse/[email protected]?arch=x86_64\u0026distro=opensuse.leap-15.1",
103103
"UID": "58980d005de43f54"
104104
},
105105
"InstalledVersion": "1.1.0i-lp151.8.3.1",

‎integration/testdata/opensuse-tumbleweed.json.golden

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@
6969
"PkgID": "[email protected]_64",
7070
"PkgName": "libopenssl3",
7171
"PkgIdentifier": {
72-
"PURL": "pkg:rpm/opensuse.tumbleweed/[email protected]?arch=x86_64\u0026distro=opensuse.tumbleweed-20240607",
72+
"PURL": "pkg:rpm/opensuse/[email protected]?arch=x86_64\u0026distro=opensuse.tumbleweed-20240607",
7373
"UID": "f051425f385d2b99"
7474
},
7575
"InstalledVersion": "3.1.4-9.1",

‎integration/testdata/sl-micro-rancher5.4.json.golden

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"SchemaVersion": 2,
3+
"CreatedAt": "2021-08-25T12:20:30.000000005Z",
4+
"ArtifactName": "testdata/fixtures/images/sle-micro-rancher-5.4_ndb.tar.gz",
5+
"ArtifactType": "container_image",
6+
"Metadata": {
7+
"OS": {
8+
"Family": "suse linux enterprise micro",
9+
"Name": "5.4"
10+
},
11+
"ImageID": "sha256:c45ec974938acac29c893b5d273d73e4ebdd7e6a97b6fa861dfbd8dd430b9016",
12+
"DiffIDs": [
13+
"sha256:7cdd3aec849d122d63dc83a5e1e2fb89b341c67b03e25979131ca335a463bb57"
14+
],
15+
"ImageConfig": {
16+
"architecture": "amd64",
17+
"author": "SUSE LLC (https://www.suse.com/)",
18+
"created": "2024-09-03T17:54:39Z",
19+
"history": [
20+
{
21+
"author": "SUSE LLC \u003chttps://www.suse.com/\u003e",
22+
"created": "2024-09-03T17:54:39Z",
23+
"created_by": "KIWI 9.24.43"
24+
}
25+
],
26+
"os": "linux",
27+
"rootfs": {
28+
"type": "layers",
29+
"diff_ids": [
30+
"sha256:7cdd3aec849d122d63dc83a5e1e2fb89b341c67b03e25979131ca335a463bb57"
31+
]
32+
},
33+
"config": {
34+
"Cmd": [
35+
"/bin/bash"
36+
],
37+
"Labels": {
38+
"com.suse.eula": "sle-eula",
39+
"com.suse.image-type": "sle-micro",
40+
"com.suse.release-stage": "released",
41+
"com.suse.sle.micro.rancher.created": "2024-09-03T17:53:32.129328086Z",
42+
"com.suse.sle.micro.rancher.description": "Image containing a micro environment for containers based on the SLE Micro for Rancher.",
43+
"com.suse.sle.micro.rancher.disturl": "obs://build.suse.de/SUSE:SLE-15-SP4:Update:Products:Micro54:Update:CR/images/fcaa3a91b132f1955fa900b902aef7f2-SLE-Micro-Rancher",
44+
"com.suse.sle.micro.rancher.reference": "registry.suse.com/suse/sle-micro-rancher/5.4:%PKG_VERSION%-%RELEASE",
45+
"com.suse.sle.micro.rancher.title": "SLE Micro for Rancher Base Container",
46+
"com.suse.sle.micro.rancher.url": "https://www.suse.com/products/micro/",
47+
"com.suse.sle.micro.rancher.vendor": "SUSE LLC",
48+
"com.suse.sle.micro.rancher.version": "5.4",
49+
"com.suse.supportlevel": "l3",
50+
"org.openbuildservice.disturl": "obs://build.suse.de/SUSE:SLE-15-SP4:Update:Products:Micro54:Update:CR/images/fcaa3a91b132f1955fa900b902aef7f2-SLE-Micro-Rancher",
51+
"org.opencontainers.image.created": "2024-09-03T17:53:32.129328086Z",
52+
"org.opencontainers.image.description": "Image containing a micro environment for containers based on the SLE Micro for Rancher.",
53+
"org.opencontainers.image.title": "SLE Micro for Rancher Base Container",
54+
"org.opencontainers.image.url": "https://www.suse.com/products/micro/",
55+
"org.opencontainers.image.vendor": "SUSE LLC",
56+
"org.opencontainers.image.version": "5.4",
57+
"org.suse.reference": "registry.suse.com/suse/sle-micro-rancher/5.4:%PKG_VERSION%-%RELEASE"
58+
}
59+
}
60+
}
61+
},
62+
"Results": [
63+
{
64+
"Target": "testdata/fixtures/images/sle-micro-rancher-5.4_ndb.tar.gz (suse linux enterprise micro 5.4)",
65+
"Class": "os-pkgs",
66+
"Type": "suse linux enterprise micro"
67+
}
68+
]
69+
}

‎pkg/detector/ospkg/detect.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ var (
4444
ftypes.OpenSUSETumbleweed: suse.NewScanner(suse.OpenSUSETumbleweed),
4545
ftypes.OpenSUSELeap: suse.NewScanner(suse.OpenSUSE),
4646
ftypes.SLES: suse.NewScanner(suse.SUSEEnterpriseLinux),
47+
ftypes.SLEMicro: suse.NewScanner(suse.SUSEEnterpriseLinuxMicro),
4748
ftypes.Photon: photon.NewScanner(),
4849
ftypes.Wolfi: wolfi.NewScanner(),
4950
ftypes.Chainguard: chainguard.NewScanner(),

‎pkg/detector/ospkg/suse/suse.go

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,18 @@ var (
4444
// 6 months after SLES 15 SP7 release
4545
// "15.7": time.Date(2031, 7, 31, 23, 59, 59, 0, time.UTC),
4646
}
47+
slemicroEolDates = map[string]time.Time{
48+
// Source: https://www.suse.com/lifecycle/
49+
"5.0": time.Date(2022, 3, 31, 23, 59, 59, 0, time.UTC),
50+
"5.1": time.Date(2025, 10, 31, 23, 59, 59, 0, time.UTC),
51+
"5.2": time.Date(2026, 4, 30, 23, 59, 59, 0, time.UTC),
52+
"5.3": time.Date(2026, 10, 30, 23, 59, 59, 0, time.UTC),
53+
"5.4": time.Date(2027, 4, 30, 23, 59, 59, 0, time.UTC),
54+
"5.5": time.Date(2027, 10, 31, 23, 59, 59, 0, time.UTC),
55+
"6.0": time.Date(2028, 6, 30, 23, 59, 59, 0, time.UTC),
56+
// 6.1 will be released late 2024
57+
// "6.1": time.Date(2028, 11, 30, 23, 59, 59, 0, time.UTC),
58+
}
4759

4860
opensuseEolDates = map[string]time.Time{
4961
// Source: https://en.opensuse.org/Lifetime
@@ -66,6 +78,8 @@ type Type int
6678
const (
6779
// SUSEEnterpriseLinux is Linux Enterprise version
6880
SUSEEnterpriseLinux Type = iota
81+
// SUSE Linux Enterprise Micro is the micro series
82+
SUSEEnterpriseLinuxMicro
6983
// OpenSUSE for open versions
7084
OpenSUSE
7185
OpenSUSETumbleweed
@@ -83,6 +97,10 @@ func NewScanner(t Type) *Scanner {
8397
return &Scanner{
8498
vs: susecvrf.NewVulnSrc(susecvrf.SUSEEnterpriseLinux),
8599
}
100+
case SUSEEnterpriseLinuxMicro:
101+
return &Scanner{
102+
vs: susecvrf.NewVulnSrc(susecvrf.SUSEEnterpriseLinuxMicro),
103+
}
86104
case OpenSUSE:
87105
return &Scanner{
88106
vs: susecvrf.NewVulnSrc(susecvrf.OpenSUSE),
@@ -135,6 +153,9 @@ func (s *Scanner) IsSupportedVersion(ctx context.Context, osFamily ftypes.OSType
135153
if osFamily == ftypes.SLES {
136154
return osver.Supported(ctx, slesEolDates, osFamily, osVer)
137155
}
156+
if osFamily == ftypes.SLEMicro {
157+
return osver.Supported(ctx, slemicroEolDates, osFamily, osVer)
158+
}
138159
// tumbleweed is a rolling release, it has no version and no eol
139160
if osFamily == ftypes.OpenSUSETumbleweed {
140161
return true

‎pkg/detector/ospkg/suse/suse_test.go

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,86 @@ func TestScanner_Detect(t *testing.T) {
111111
},
112112
},
113113
},
114+
{
115+
name: "happy path: suse sle 15sp3",
116+
fixtures: []string{
117+
"testdata/fixtures/suse.yaml",
118+
"testdata/fixtures/data-source.yaml",
119+
},
120+
distribution: suse.SUSEEnterpriseLinux,
121+
args: args{
122+
osVer: "15.3",
123+
pkgs: []ftypes.Package{
124+
{
125+
Name: "libopenssl1_1",
126+
Version: "1.1.1d",
127+
Release: "150200.11.47.1",
128+
SrcName: "libopenssl1_1",
129+
SrcVersion: "1.1.1d",
130+
SrcRelease: "150200.11.47.1",
131+
Layer: ftypes.Layer{
132+
DiffID: "sha256:932da51564135c98a49a34a193d6cd363d8fa4184d957fde16c9d8527b3f3b02",
133+
},
134+
},
135+
},
136+
},
137+
want: []types.DetectedVulnerability{
138+
{
139+
PkgName: "libopenssl1_1",
140+
VulnerabilityID: "SUSE-SU-2022:2251-1",
141+
InstalledVersion: "1.1.1d-150200.11.47.1",
142+
FixedVersion: "1.1.1d-150200.11.48.1",
143+
Layer: ftypes.Layer{
144+
DiffID: "sha256:932da51564135c98a49a34a193d6cd363d8fa4184d957fde16c9d8527b3f3b02",
145+
},
146+
DataSource: &dbTypes.DataSource{
147+
ID: vulnerability.SuseCVRF,
148+
Name: "SUSE CVRF",
149+
URL: "https://ftp.suse.com/pub/projects/security/cvrf/",
150+
},
151+
},
152+
},
153+
},
154+
{
155+
name: "happy path: suse sle micro 15.3",
156+
fixtures: []string{
157+
"testdata/fixtures/suse.yaml",
158+
"testdata/fixtures/data-source.yaml",
159+
},
160+
distribution: suse.SUSEEnterpriseLinuxMicro,
161+
args: args{
162+
osVer: "5.3",
163+
pkgs: []ftypes.Package{
164+
{
165+
Name: "libopenssl1_1",
166+
Version: "1.1.1l",
167+
Release: "150400.7.21.1",
168+
SrcName: "libopenssl1_1",
169+
SrcVersion: "1.1.1l",
170+
SrcRelease: "150400.7.21.1",
171+
Layer: ftypes.Layer{
172+
DiffID: "sha256:932da51564135c98a49a34a193d6cd363d8fa4184d957fde16c9d8527b3f3b02",
173+
},
174+
},
175+
},
176+
},
177+
want: []types.DetectedVulnerability{
178+
{
179+
PkgName: "libopenssl1_1",
180+
VulnerabilityID: "SUSE-SU-2023:0311-1",
181+
InstalledVersion: "1.1.1l-150400.7.21.1",
182+
FixedVersion: "1.1.1l-150400.7.22.1",
183+
Layer: ftypes.Layer{
184+
DiffID: "sha256:932da51564135c98a49a34a193d6cd363d8fa4184d957fde16c9d8527b3f3b02",
185+
},
186+
DataSource: &dbTypes.DataSource{
187+
ID: vulnerability.SuseCVRF,
188+
Name: "SUSE CVRF",
189+
URL: "https://ftp.suse.com/pub/projects/security/cvrf/",
190+
},
191+
},
192+
},
193+
},
114194
{
115195
name: "broken bucket",
116196
fixtures: []string{

‎pkg/detector/ospkg/suse/testdata/fixtures/data-source.yaml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,8 @@
1515
ID: "suse-cvrf"
1616
Name: "SUSE CVRF"
1717
URL: "https://ftp.suse.com/pub/projects/security/cvrf/"
18+
- key: SUSE Linux Enterprise Micro 5.3
19+
value:
20+
ID: "suse-cvrf"
21+
Name: "SUSE CVRF"
22+
URL: "https://ftp.suse.com/pub/projects/security/cvrf/"

‎pkg/detector/ospkg/suse/testdata/fixtures/suse.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,23 @@
88
- key: CVE-2021-0001
99
value:
1010
FixedVersion: ""
11+
- bucket: SUSE Linux Enterprise 15.3
12+
pairs:
13+
- bucket: libopenssl1_1
14+
pairs:
15+
- key: "SUSE-SU-2022:2251-1"
16+
value:
17+
FixedVersion: 1.1.1d-150200.11.48.1
18+
- bucket: openssl-1_1
19+
pairs:
20+
- key: "SUSE-SU-2022:2251-1"
21+
value:
22+
FixedVersion: 1.1.1d-150200.11.48.1
23+
- bucket: SUSE Linux Enterprise Micro 5.3
24+
pairs:
25+
- bucket: libopenssl1_1
26+
pairs:
27+
- key: "SUSE-SU-2023:0311-1"
28+
value:
29+
FixedVersion: 1.1.1l-150400.7.22.1
30+

‎pkg/fanal/analyzer/os/release/release.go

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,11 @@ func (a osReleaseAnalyzer) Analyze(_ context.Context, input analyzer.AnalysisInp
5555
family = types.OpenSUSELeap
5656
case "sles":
5757
family = types.SLES
58+
// There are various rebrands of SLE Micro, there is also one brief (and reverted rebrand)
59+
// for SLE Micro 6.0. which was called "SL Micro 6.0" until very short before release
60+
// and there is a "SLE Micro for Rancher" rebrand, which is used by SUSEs K8S based offerings.
61+
case "sle-micro", "sl-micro", "sle-micro-rancher":
62+
family = types.SLEMicro
5863
case "photon":
5964
family = types.Photon
6065
case "wolfi":

0 commit comments

Comments
 (0)