Upstream/harbor
1
0
Fork 0
mirror of https://github.com/goharbor/harbor.git synced 2024-11-22 02:05:41 +01:00
Code Issues Projects Releases Wiki Activity

Add support for trivy db_repository and java_db_repository

Browse Source 
Signed-off-by: Quentin Bouteiller <quentin.bouteiller@values-associates.com>
This commit is contained in:
Quentin Bouteiller 2024-11-15 14:53:21 +01:00
parent bccfd5fb41
commit 0af2129dd9
No known key found for this signature in database
GPG Key ID: 84BC5935860985ED
3 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
make/harbor.yml.tmpl
View File

@ -102,6 +102,11 @@ trivy:
# `/home/scanner/.cache/trivy/java-db/trivy-java.db` path
skip_java_db_update: false
#
# OCI repository to retrieve the trivy vulnerability database from.
db_repository: ghcr.io/aquasecurity/trivy-db
# OCI repository to retrieve the Java trivy vulnerability database from.
java_db_repository: ghcr.io/aquasecurity/trivy-java-db
#
# The offline_scan option prevents Trivy from sending API requests to identify dependencies.
# Scanning JAR files and pom.xml may require Internet access for better detection, but this option tries to avoid it.
# For example, the offline mode will not try to resolve transitive dependencies in pom.xml when the dependency doesn't

2
make/photon/prepare/templates/trivy-adapter/env.jinja
View File

@ -11,6 +11,8 @@ SCANNER_TRIVY_SEVERITY=UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
SCANNER_TRIVY_IGNORE_UNFIXED={{trivy_ignore_unfixed}}
SCANNER_TRIVY_SKIP_UPDATE={{trivy_skip_update}}
SCANNER_TRIVY_SKIP_JAVA_DB_UPDATE={{trivy_skip_java_db_update}}
SCANNER_TRIVY_DB_REPOSITORY={{trivy_db_repository}}
SCANNER_TRIVY_JAVA_DB_REPOSITORY={{trivy_java_db_repository}}
SCANNER_TRIVY_OFFLINE_SCAN={{trivy_offline_scan}}
SCANNER_TRIVY_SECURITY_CHECKS={{trivy_security_check}}
SCANNER_TRIVY_GITHUB_TOKEN={{trivy_github_token}}

2
make/photon/prepare/utils/configs.py
View File

@ -213,6 +213,8 @@ def parse_yaml_config(config_file_path, with_trivy):
config_dict['trivy_github_token'] = trivy_configs.get("github_token") or ''
config_dict['trivy_skip_update'] = trivy_configs.get("skip_update") or False
config_dict['trivy_skip_java_db_update'] = trivy_configs.get("skip_java_db_update") or False
config_dict['trivy_db_repository'] = trivy_configs.get("db_repository") or 'ghcr.io/aquasecurity/trivy-db'
config_dict['trivy_java_db_repository'] = trivy_configs.get("java_db_repository") or 'ghcr.io/aquasecurity/trivy-java-db'
config_dict['trivy_offline_scan'] = trivy_configs.get("offline_scan") or False
config_dict['trivy_security_check'] = trivy_configs.get("security_check") or 'vuln'
config_dict['trivy_ignore_unfixed'] = trivy_configs.get("ignore_unfixed") or False