Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

sbom: allow collector to scan library packages and any relationships #33409

Merged
merged 4 commits into from
Jan 28, 2025
Merged

sbom: allow collector to scan library packages and any relationships #33409

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
38f4934
sbom: allow collector to scan library packages and any relationships
paulcacheux Jan 27, 2025
4badc9d
remove unused fields
paulcacheux Jan 27, 2025
19ef245
fetch packages from application as well
paulcacheux Jan 27, 2025
b27e283
`inv -e tidy`
paulcacheux Jan 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -183,7 +183,7 @@ require (
github.com/acobaugh/osrelease v0.1.0
github.com/alecthomas/participle v0.7.1 // indirect
github.com/alecthomas/units v0.0.0-20240626203959-61d1e3462e30
github.com/aquasecurity/trivy-db v0.0.0-20240910133327-7e0f4d2ed4c1
github.com/aquasecurity/trivy-db v0.0.0-20240910133327-7e0f4d2ed4c1 // indirect
github.com/avast/retry-go/v4 v4.6.0
github.com/aws/aws-lambda-go v1.37.0
github.com/aws/aws-sdk-go v1.55.6 // indirect
Expand Down
39 changes: 12 additions & 27 deletions pkg/util/trivy/trivy.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,6 @@ import (
"github.com/DataDog/datadog-agent/pkg/sbom"
"github.com/DataDog/datadog-agent/pkg/util/log"
"github.com/DataDog/datadog-agent/pkg/util/option"
"github.com/aquasecurity/trivy-db/pkg/db"
"github.com/aquasecurity/trivy/pkg/fanal/analyzer"
"github.com/aquasecurity/trivy/pkg/fanal/applier"
"github.com/aquasecurity/trivy/pkg/fanal/artifact"
Expand All @@ -33,10 +32,7 @@ import (
"github.com/aquasecurity/trivy/pkg/fanal/walker"
"github.com/aquasecurity/trivy/pkg/sbom/cyclonedx"
"github.com/aquasecurity/trivy/pkg/scanner"
"github.com/aquasecurity/trivy/pkg/scanner/langpkg"
"github.com/aquasecurity/trivy/pkg/scanner/ospkg"
"github.com/aquasecurity/trivy/pkg/types"
"github.com/aquasecurity/trivy/pkg/vulnerability"

// This is required to load sqlite based RPM databases
_ "modernc.org/sqlite"
Expand Down Expand Up @@ -64,9 +60,6 @@ type Collector struct {
config collectorConfig
cacheInitialized sync.Once
persistentCache CacheWithCleaner
osScanner ospkg.Scanner
langScanner langpkg.Scanner
vulnClient vulnerability.Client
marshaler cyclonedx.Marshaler
wmeta option.Option[workloadmeta.Component]
}
Expand Down Expand Up @@ -158,11 +151,8 @@ func NewCollector(cfg config.Component, wmeta option.Option[workloadmeta.Compone
maxCacheSize: cfg.GetInt("sbom.cache.max_disk_size"),
overlayFSSupport: cfg.GetBool("sbom.container_image.overlayfs_direct_scan"),
},
osScanner: ospkg.NewScanner(),
langScanner: langpkg.NewScanner(),
vulnClient: vulnerability.NewClient(db.Config{}),
marshaler: cyclonedx.NewMarshaler(""),
wmeta: wmeta,
marshaler: cyclonedx.NewMarshaler(""),
wmeta: wmeta,
}, nil
}

Expand Down Expand Up @@ -294,21 +284,18 @@ func (d *driver) Scan(_ context.Context, target, artifactKey string, blobKeys []
return nil, ftypes.OS{}, xerrors.Errorf("failed to apply layers: %w", err)
}

scanTarget := types.ScanTarget{
Name: target,
OS: detail.OS,
Repository: detail.Repository,
Packages: detail.Packages,
}

result := types.Result{
Target: fmt.Sprintf("%s (%s %s)", target, detail.OS.Family, detail.OS.Name),
Class: types.ClassOSPkg,
Type: scanTarget.OS.Family,
Type: detail.OS.Family,
}

sort.Sort(scanTarget.Packages)
result.Packages = scanTarget.Packages
sort.Sort(detail.Packages)
result.Packages = detail.Packages
for _, app := range detail.Applications {
sort.Sort(app.Packages)
result.Packages = append(result.Packages, app.Packages...)
}

return []types.Result{result}, detail.OS, nil
}
Expand All @@ -328,11 +315,9 @@ func (c *Collector) scan(ctx context.Context, artifact artifact.Artifact, applie

trivyReport, err := s.ScanArtifact(ctx, types.ScanOptions{
ScanRemovedPackages: false,
PkgTypes: []types.PkgType{types.PkgTypeOS},
PkgRelationships: []ftypes.Relationship{
ftypes.RelationshipUnknown,
},
Scanners: types.Scanners{types.SBOMScanner},
PkgTypes: []types.PkgType{types.PkgTypeOS, types.PkgTypeLibrary},
PkgRelationships: ftypes.Relationships,
Scanners: types.Scanners{types.SBOMScanner},
})
if err != nil {
return nil, err
Expand Down
Loading