diff --git a/Makefile b/Makefile index a0cc5863e..f01fc5a3e 100644 --- a/Makefile +++ b/Makefile @@ -103,7 +103,7 @@ CLAIRVERSION=v2.1.1 NOTARYMIGRATEVERSION=v3.5.4 CLAIRADAPTERVERSION=v1.0.1 TRIVYVERSION=v0.5.2 -TRIVYADAPTERVERSION=v0.4.0 +TRIVYADAPTERVERSION=v0.5.0 # version of chartmuseum CHARTMUSEUMVERSION=v0.9.0 diff --git a/make/harbor.yml.tmpl b/make/harbor.yml.tmpl index 6f9495f05..4baed025d 100644 --- a/make/harbor.yml.tmpl +++ b/make/harbor.yml.tmpl @@ -61,6 +61,14 @@ clair: # Trivy configuration trivy: + # ignoreUnfixed The flag to display only fixed vulnerabilities + ignore_unfixed: false + # skipUpdate The flag to enable or disable Trivy DB downloads from GitHub + # + # You might want to enable this flag in test or CI/CD environments to avoid GitHub rate limiting issues. + # If the flag is enabled you have to manually download the `trivy.db` file and mount it in the + # /home/scanner/.cache/trivy/db/trivy.db path. + skip_update: false # github_token The GitHub access token to download Trivy DB # # Trivy DB contains vulnerability information from NVD, Red Hat, and many other upstream vulnerability databases. diff --git a/make/photon/prepare/templates/trivy-adapter/env.jinja b/make/photon/prepare/templates/trivy-adapter/env.jinja index b07db6f04..d12636615 100644 --- a/make/photon/prepare/templates/trivy-adapter/env.jinja +++ b/make/photon/prepare/templates/trivy-adapter/env.jinja @@ -7,7 +7,8 @@ SCANNER_TRIVY_CACHE_DIR=/home/scanner/.cache/trivy SCANNER_TRIVY_REPORTS_DIR=/home/scanner/.cache/reports SCANNER_TRIVY_VULN_TYPE=os,library SCANNER_TRIVY_SEVERITY=UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL -SCANNER_TRIVY_IGNORE_UNFIXED=false +SCANNER_TRIVY_IGNORE_UNFIXED={{trivy_ignore_unfixed}} +SCANNER_TRIVY_SKIP_UPDATE={{trivy_skip_update}} SCANNER_TRIVY_GITHUB_TOKEN={{trivy_github_token}} HTTP_PROXY={{trivy_http_proxy}} HTTPS_PROXY={{trivy_https_proxy}} diff --git a/make/photon/prepare/utils/configs.py b/make/photon/prepare/utils/configs.py index 877301446..e5fcc9f6a 100644 --- a/make/photon/prepare/utils/configs.py +++ b/make/photon/prepare/utils/configs.py @@ -241,8 +241,9 @@ def parse_yaml_config(config_file_path, with_notary, with_clair, with_trivy, wit # Trivy configs, optional trivy_configs = configs.get("trivy") or {} - trivy_github_token = trivy_configs.get("github_token") or '' - config_dict['trivy_github_token'] = trivy_github_token + config_dict['trivy_github_token'] = trivy_configs.get("github_token") or '' + config_dict['trivy_skip_update'] = trivy_configs.get("skip_update") or False + config_dict['trivy_ignore_unfixed'] = trivy_configs.get("ignore_unfixed") or False # Chart configs chart_configs = configs.get("chart") or {}