Skip to content

Commit ed647d6

Browse files
msmeissnDmitriyLewen
authored and
skahn007gl
committed
feat: add openSUSE tumbleweed detection and scanning (aquasecurity#6965)
Co-authored-by: DmitriyLewen <[email protected]> Co-authored-by: DmitriyLewen <[email protected]>
1 parent d354a37 commit ed647d6

File tree

15 files changed

+3705
-19
lines changed

15 files changed

+3705
-19
lines changed

‎docs/docs/coverage/os/index.md

+1
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ Trivy supports operating systems for
2222
| [CBL-Mariner](cbl-mariner.md) | 1.0, 2.0 | dnf/yum/rpm |
2323
| [Amazon Linux](amazon.md) | 1, 2, 2023 | dnf/yum/rpm |
2424
| [openSUSE Leap](suse.md) | 42, 15 | zypper/rpm |
25+
| [openSUSE Tumbleweed](suse.md) | (n/a) | zypper/rpm |
2526
| [SUSE Enterprise Linux](suse.md) | 11, 12, 15 | zypper/rpm |
2627
| [Photon OS](photon.md) | 1.0, 2.0, 3.0, 4.0 | tndf/yum/rpm |
2728
| [Debian GNU/Linux](debian.md) | 7, 8, 9, 10, 11, 12 | apt/dpkg |

‎docs/docs/coverage/os/suse.md

+3-2
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
Trivy supports the following distributions:
33

44
- openSUSE Leap
5+
- openSUSE Tumbleweed
56
- SUSE Enterprise Linux (SLE)
67

78
Please see [here](index.md#supported-os) for supported versions.
@@ -35,6 +36,6 @@ Trivy identifies licenses by examining the metadata of RPM packages.
3536

3637

3738
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies
38-
[cvrf]: http://ftp.suse.com/pub/projects/security/cvrf/
39+
[cvrf]: https://ftp.suse.com/pub/projects/security/cvrf/
3940

40-
[vulnerability statuses]: ../../configuration/filtering.md#by-status
41+
[vulnerability statuses]: ../../configuration/filtering.md#by-status

‎integration/client_server_test.go

+7
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,13 @@ func TestClientServer(t *testing.T) {
212212
},
213213
golden: "testdata/opensuse-leap-151.json.golden",
214214
},
215+
{
216+
name: "opensuse tumbleweed",
217+
args: csArgs{
218+
Input: "testdata/fixtures/images/opensuse-tumbleweed.tar.gz",
219+
},
220+
golden: "testdata/opensuse-tumbleweed.json.golden",
221+
},
215222
{
216223
name: "photon 3.0",
217224
args: csArgs{

‎integration/docker_engine_test.go

+6
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,12 @@ func TestDockerEngine(t *testing.T) {
192192
input: "testdata/fixtures/images/opensuse-leap-151.tar.gz",
193193
golden: "testdata/opensuse-leap-151.json.golden",
194194
},
195+
{
196+
name: "opensuse tumbleweed",
197+
imageTag: "ghcr.io/aquasecurity/trivy-test-images:opensuse-tumbleweed",
198+
input: "testdata/fixtures/images/opensuse-tumbleweed.tar.gz",
199+
golden: "testdata/opensuse-tumbleweed.json.golden",
200+
},
195201
{
196202
name: "photon 3.0",
197203
imageTag: "ghcr.io/aquasecurity/trivy-test-images:photon-30",

‎integration/standalone_tar_test.go

+8
Original file line numberDiff line numberDiff line change
@@ -322,6 +322,14 @@ func TestTar(t *testing.T) {
322322
},
323323
golden: "testdata/opensuse-leap-151.json.golden",
324324
},
325+
{
326+
name: "opensuse tumbleweed",
327+
args: args{
328+
Format: types.FormatJSON,
329+
Input: "testdata/fixtures/images/opensuse-tumbleweed.tar.gz",
330+
},
331+
golden: "testdata/opensuse-tumbleweed.json.golden",
332+
},
325333
{
326334
name: "photon 3.0",
327335
args: args{

‎integration/testdata/fixtures/db/opensuse.yaml

+8-1
Original file line numberDiff line numberDiff line change
@@ -9,4 +9,11 @@
99
pairs:
1010
- key: "openSUSE-SU-2020:0062-1"
1111
value:
12-
FixedVersion: 1.1.0i-lp151.8.6.1
12+
FixedVersion: 1.1.0i-lp151.8.6.1
13+
- bucket: "openSUSE Tumbleweed"
14+
pairs:
15+
- bucket: libopenssl3
16+
pairs:
17+
- key: "openSUSE-SU-2024:13065-1"
18+
value:
19+
FixedVersion: 3.1.5-9.1 # changed for test

‎integration/testdata/fixtures/db/vulnerability.yaml

+9
Original file line numberDiff line numberDiff line change
@@ -1340,6 +1340,15 @@
13401340
- https://nvd.nist.gov/vuln/detail/CVE-2022-24775
13411341
PublishedDate: "2022-03-25T19:26:33Z"
13421342
LastModifiedDate: "2022-06-14T20:02:29Z"
1343+
- key: openSUSE-SU-2024:13065-1
1344+
value:
1345+
Title: "libopenssl-3-devel-3.1.1-3.1 on GA media"
1346+
Description: "These are all security issues fixed in the libopenssl-3-devel-3.1.1-3.1 package on the GA media of openSUSE Tumbleweed."
1347+
Severity: MEDIUM
1348+
References:
1349+
- "https://www.suse.com/security/cve/CVE-2023-2975/"
1350+
- "https://www.suse.com/security/cve/CVE-2023-3446/"
1351+
- "https://www.suse.com/support/security/rating/"
13431352
- key: CVE-2022-22965
13441353
value:
13451354
Title: "spring-framework: RCE via Data Binding on JDK 9+"

‎integration/testdata/opensuse-tumbleweed.json.golden

+94
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
{
2+
"SchemaVersion": 2,
3+
"CreatedAt": "2021-08-25T12:20:30.000000005Z",
4+
"ArtifactName": "testdata/fixtures/images/opensuse-tumbleweed.tar.gz",
5+
"ArtifactType": "container_image",
6+
"Metadata": {
7+
"OS": {
8+
"Family": "opensuse.tumbleweed",
9+
"Name": "20240607"
10+
},
11+
"ImageID": "sha256:580e73f5c823232e6587136e9f5428a89afdf77a123bb8575d08208e0cc34b12",
12+
"DiffIDs": [
13+
"sha256:7a335bdf2d91d6d158da360054aa7e477d708187d43fe9d0ac20144cdf90f763"
14+
],
15+
"ImageConfig": {
16+
"architecture": "amd64",
17+
"author": "Fabian Vogt \[email protected]\u003e",
18+
"created": "2024-06-07T17:19:44Z",
19+
"history": [
20+
{
21+
"author": "Fabian Vogt \[email protected]\u003e",
22+
"created": "2024-06-07T17:19:44Z",
23+
"created_by": "KIWI 10.0.19",
24+
"comment": "openSUSE Tumbleweed 20240607 Base Container"
25+
}
26+
],
27+
"os": "linux",
28+
"rootfs": {
29+
"type": "layers",
30+
"diff_ids": [
31+
"sha256:7a335bdf2d91d6d158da360054aa7e477d708187d43fe9d0ac20144cdf90f763"
32+
]
33+
},
34+
"config": {
35+
"Cmd": [
36+
"/bin/bash"
37+
],
38+
"Labels": {
39+
"org.openbuildservice.disturl": "obs://build.opensuse.org/openSUSE:Factory/images/b068e2522114e1c009e9bfa1b5cb1146-opensuse-tumbleweed-image:docker",
40+
"org.opencontainers.image.created": "2024-06-07T17:19:38.229693664Z",
41+
"org.opencontainers.image.description": "Image containing a minimal environment for containers based on openSUSE Tumbleweed.",
42+
"org.opencontainers.image.source": "https://build.opensuse.org/package/show/openSUSE:Factory/opensuse-tumbleweed-image?rev=b068e2522114e1c009e9bfa1b5cb1146",
43+
"org.opencontainers.image.title": "openSUSE Tumbleweed Base Container",
44+
"org.opencontainers.image.url": "https://www.opensuse.org/",
45+
"org.opencontainers.image.vendor": "openSUSE Project",
46+
"org.opencontainers.image.version": "20240607.30.45",
47+
"org.opensuse.base.created": "2024-06-07T17:19:38.229693664Z",
48+
"org.opensuse.base.description": "Image containing a minimal environment for containers based on openSUSE Tumbleweed.",
49+
"org.opensuse.base.disturl": "obs://build.opensuse.org/openSUSE:Factory/images/b068e2522114e1c009e9bfa1b5cb1146-opensuse-tumbleweed-image:docker",
50+
"org.opensuse.base.reference": "registry.opensuse.org/opensuse/tumbleweed:20240607.30.45",
51+
"org.opensuse.base.source": "https://build.opensuse.org/package/show/openSUSE:Factory/opensuse-tumbleweed-image?rev=b068e2522114e1c009e9bfa1b5cb1146",
52+
"org.opensuse.base.title": "openSUSE Tumbleweed Base Container",
53+
"org.opensuse.base.url": "https://www.opensuse.org/",
54+
"org.opensuse.base.vendor": "openSUSE Project",
55+
"org.opensuse.base.version": "20240607.30.45",
56+
"org.opensuse.reference": "registry.opensuse.org/opensuse/tumbleweed:20240607.30.45"
57+
}
58+
}
59+
}
60+
},
61+
"Results": [
62+
{
63+
"Target": "testdata/fixtures/images/opensuse-tumbleweed.tar.gz (opensuse.tumbleweed 20240607)",
64+
"Class": "os-pkgs",
65+
"Type": "opensuse.tumbleweed",
66+
"Vulnerabilities": [
67+
{
68+
"VulnerabilityID": "openSUSE-SU-2024:13065-1",
69+
"PkgID": "[email protected]_64",
70+
"PkgName": "libopenssl3",
71+
"PkgIdentifier": {
72+
"PURL": "pkg:rpm/opensuse.tumbleweed/[email protected]?arch=x86_64\u0026distro=opensuse.tumbleweed-20240607",
73+
"UID": "f051425f385d2b99"
74+
},
75+
"InstalledVersion": "3.1.4-9.1",
76+
"FixedVersion": "3.1.5-9.1",
77+
"Status": "fixed",
78+
"Layer": {
79+
"Digest": "sha256:427d16a14c45614f51357aeebee0dfe209a1cebfc044b3b724b6ea35663b3111",
80+
"DiffID": "sha256:7a335bdf2d91d6d158da360054aa7e477d708187d43fe9d0ac20144cdf90f763"
81+
},
82+
"Title": "libopenssl-3-devel-3.1.1-3.1 on GA media",
83+
"Description": "These are all security issues fixed in the libopenssl-3-devel-3.1.1-3.1 package on the GA media of openSUSE Tumbleweed.",
84+
"Severity": "MEDIUM",
85+
"References": [
86+
"https://www.suse.com/security/cve/CVE-2023-2975/",
87+
"https://www.suse.com/security/cve/CVE-2023-3446/",
88+
"https://www.suse.com/support/security/rating/"
89+
]
90+
}
91+
]
92+
}
93+
]
94+
}

‎pkg/detector/ospkg/detect.go

+16-15
Original file line numberDiff line numberDiff line change
@@ -30,21 +30,22 @@ var (
3030
ErrUnsupportedOS = xerrors.New("unsupported os")
3131

3232
drivers = map[ftypes.OSType]Driver{
33-
ftypes.Alpine: alpine.NewScanner(),
34-
ftypes.Alma: alma.NewScanner(),
35-
ftypes.Amazon: amazon.NewScanner(),
36-
ftypes.CBLMariner: mariner.NewScanner(),
37-
ftypes.Debian: debian.NewScanner(),
38-
ftypes.Ubuntu: ubuntu.NewScanner(),
39-
ftypes.RedHat: redhat.NewScanner(),
40-
ftypes.CentOS: redhat.NewScanner(),
41-
ftypes.Rocky: rocky.NewScanner(),
42-
ftypes.Oracle: oracle.NewScanner(),
43-
ftypes.OpenSUSELeap: suse.NewScanner(suse.OpenSUSE),
44-
ftypes.SLES: suse.NewScanner(suse.SUSEEnterpriseLinux),
45-
ftypes.Photon: photon.NewScanner(),
46-
ftypes.Wolfi: wolfi.NewScanner(),
47-
ftypes.Chainguard: chainguard.NewScanner(),
33+
ftypes.Alpine: alpine.NewScanner(),
34+
ftypes.Alma: alma.NewScanner(),
35+
ftypes.Amazon: amazon.NewScanner(),
36+
ftypes.CBLMariner: mariner.NewScanner(),
37+
ftypes.Debian: debian.NewScanner(),
38+
ftypes.Ubuntu: ubuntu.NewScanner(),
39+
ftypes.RedHat: redhat.NewScanner(),
40+
ftypes.CentOS: redhat.NewScanner(),
41+
ftypes.Rocky: rocky.NewScanner(),
42+
ftypes.Oracle: oracle.NewScanner(),
43+
ftypes.OpenSUSETumbleweed: suse.NewScanner(suse.OpenSUSETumbleweed),
44+
ftypes.OpenSUSELeap: suse.NewScanner(suse.OpenSUSE),
45+
ftypes.SLES: suse.NewScanner(suse.SUSEEnterpriseLinux),
46+
ftypes.Photon: photon.NewScanner(),
47+
ftypes.Wolfi: wolfi.NewScanner(),
48+
ftypes.Chainguard: chainguard.NewScanner(),
4849
}
4950
)
5051

‎pkg/detector/ospkg/suse/suse.go

+9
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@ const (
6868
SUSEEnterpriseLinux Type = iota
6969
// OpenSUSE for open versions
7070
OpenSUSE
71+
OpenSUSETumbleweed
7172
)
7273

7374
// Scanner implements the SUSE scanner
@@ -86,6 +87,10 @@ func NewScanner(t Type) *Scanner {
8687
return &Scanner{
8788
vs: susecvrf.NewVulnSrc(susecvrf.OpenSUSE),
8889
}
90+
case OpenSUSETumbleweed:
91+
return &Scanner{
92+
vs: susecvrf.NewVulnSrc(susecvrf.OpenSUSETumbleweed),
93+
}
8994
}
9095
return nil
9196
}
@@ -130,5 +135,9 @@ func (s *Scanner) IsSupportedVersion(ctx context.Context, osFamily ftypes.OSType
130135
if osFamily == ftypes.SLES {
131136
return osver.Supported(ctx, slesEolDates, osFamily, osVer)
132137
}
138+
// tumbleweed is a rolling release, it has no version and no eol
139+
if osFamily == ftypes.OpenSUSETumbleweed {
140+
return true
141+
}
133142
return osver.Supported(ctx, opensuseEolDates, osFamily, osVer)
134143
}

‎pkg/detector/ospkg/suse/suse_test.go

+50
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,46 @@ func TestScanner_Detect(t *testing.T) {
7171
},
7272
},
7373
},
74+
{
75+
name: "happy path: tumbleweed",
76+
fixtures: []string{
77+
"testdata/fixtures/tumbleweed.yaml",
78+
"testdata/fixtures/data-source.yaml",
79+
},
80+
distribution: suse.OpenSUSETumbleweed,
81+
args: args{
82+
osVer: "",
83+
pkgs: []ftypes.Package{
84+
{
85+
Name: "singularity-ce",
86+
Version: "4.1.3",
87+
Release: "1.0",
88+
SrcName: "postgresql",
89+
SrcVersion: "4.1.3",
90+
SrcRelease: "1.1",
91+
Layer: ftypes.Layer{
92+
DiffID: "sha256:932da51564135c98a49a34a193d6cd363d8fa4184d957fde16c9d8527b3f3b02",
93+
},
94+
},
95+
},
96+
},
97+
want: []types.DetectedVulnerability{
98+
{
99+
PkgName: "singularity-ce",
100+
VulnerabilityID: "openSUSE-SU-2024:14059-1",
101+
InstalledVersion: "4.1.3-1.0",
102+
FixedVersion: "4.1.3-1.1",
103+
Layer: ftypes.Layer{
104+
DiffID: "sha256:932da51564135c98a49a34a193d6cd363d8fa4184d957fde16c9d8527b3f3b02",
105+
},
106+
DataSource: &dbTypes.DataSource{
107+
ID: vulnerability.SuseCVRF,
108+
Name: "SUSE CVRF",
109+
URL: "https://ftp.suse.com/pub/projects/security/cvrf/",
110+
},
111+
},
112+
},
113+
},
74114
{
75115
name: "broken bucket",
76116
fixtures: []string{
@@ -122,6 +162,16 @@ func TestScanner_IsSupportedVersion(t *testing.T) {
122162
args args
123163
want bool
124164
}{
165+
{
166+
name: "opensuse.tumbleweed",
167+
now: time.Date(2019, 5, 31, 23, 59, 59, 0, time.UTC),
168+
args: args{
169+
osFamily: "opensuse.tumbleweed",
170+
osVer: "",
171+
},
172+
distribution: suse.OpenSUSETumbleweed,
173+
want: true,
174+
},
125175
{
126176
name: "opensuse.leap42.3",
127177
now: time.Date(2019, 5, 31, 23, 59, 59, 0, time.UTC),

‎pkg/detector/ospkg/suse/testdata/fixtures/data-source.yaml

+6-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,10 @@
11
- bucket: data-source
22
pairs:
3+
- key: openSUSE Tumbleweed
4+
value:
5+
ID: "suse-cvrf"
6+
Name: "SUSE CVRF"
7+
URL: "https://ftp.suse.com/pub/projects/security/cvrf/"
38
- key: openSUSE Leap 15.3
49
value:
510
ID: "suse-cvrf"
@@ -9,4 +14,4 @@
914
value:
1015
ID: "suse-cvrf"
1116
Name: "SUSE CVRF"
12-
URL: "https://ftp.suse.com/pub/projects/security/cvrf/"
17+
URL: "https://ftp.suse.com/pub/projects/security/cvrf/"

‎pkg/detector/ospkg/suse/testdata/fixtures/tumbleweed.yaml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
- bucket: openSUSE Tumbleweed
2+
pairs:
3+
- bucket: singularity-ce
4+
pairs:
5+
- key: openSUSE-SU-2024:14059-1
6+
value:
7+
FixedVersion: "4.1.3-1.1"

‎pkg/fanal/test/integration/library_test.go

+9
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,15 @@ var tests = []testCase{
9898
Family: "opensuse.leap",
9999
},
100100
},
101+
{
102+
name: "happy path, opensuse tumbleweed",
103+
remoteImageName: "ghcr.io/aquasecurity/trivy-test-images:opensuse-tumbleweed",
104+
imageFile: "../../../../integration/testdata/fixtures/images/opensuse-tumbleweed.tar.gz",
105+
wantOS: types.OS{
106+
Name: "20240607",
107+
Family: "opensuse.tumbleweed",
108+
},
109+
},
101110
{
102111
// from registry.suse.com/suse/sle15:15.3.17.8.16
103112
name: "happy path, suse 15.3 (NDB)",

0 commit comments

Comments
 (0)