Added --only-update option #43

Code-Hex · 2019-05-21T10:57:17Z

What

Added --only-update option. use this option, we can update vulnerability database only that we are specified distributions.

Why

If we are creating an docker image based on one distribution (for example, use only alpine image), it is too much to update all DBs. therefore we necessary to wait to update for long time.

tomoyamachi · 2019-05-21T12:01:27Z

LGTM😄

knqyf263 · 2019-05-21T15:45:43Z

@Code-Hex Thanks! LGTM! However, please wait for a while as we may consider

knqyf263 · 2019-05-22T07:05:14Z

pkg/vulnsrc/vulnsrc.go

+ vulnerability.Ubuntu: ubuntu.Update,
+}
+
+func UpdateAll() (err error) {


Would you commonize UpdateAll() and OnlyUpdate()?

knqyf263 · 2019-05-22T07:05:26Z

pkg/vulnsrc/vulnsrc.go

- if err = redhat.Update(dir, updatedFiles); err != nil {
- return xerrors.Errorf("error in RedHat update: %w", err)
- }
+func OnlyUpdate(names []string) error {


Suggested change

func OnlyUpdate(names []string) error {

func Update(names []string) error {

knqyf263 · 2019-05-22T07:06:09Z

pkg/run.go

- if err = vulnsrc.Update(); err != nil {
+ // this condition is already validated by skipUpdate && onlyUpdate != ""
+ if onlyUpdate != "" {
+ if err = vulnsrc.OnlyUpdate(strings.Split(onlyUpdate, ",")); err != nil {


Suggested change

if err = vulnsrc.OnlyUpdate(strings.Split(onlyUpdate, ",")); err != nil {

if err = vulnsrc.Update(strings.Split(onlyUpdate, ",")); err != nil {

knqyf263 · 2019-05-22T07:06:34Z

pkg/run.go

+ return xerrors.Errorf("error in vulnerability DB update: %w", err)
+ }
+ } else {
+ if err = vulnsrc.UpdateAll(); err != nil {


Suggested change

if err = vulnsrc.UpdateAll(); err != nil {

if err = vulnsrc.Update(vunerability.DBNames); err != nil {

Code-Hex · 2019-05-22T08:48:24Z

In this comment

Would you commonize UpdateAll() and OnlyUpdate()?

I have fixed at knqyf263@48ae91e . Is the above means correct in this?

knqyf263 · 2019-05-22T11:19:04Z

@Code-Hex Thanks! Seems good!
There is one point to notice. Now we are using other databases if there is no vulnerability information in NVD. If you update only the specified database, the severity and title may be empty. Even in that case, it is possible to detect vulnerabilities.
Is that OK?

Code-Hex · 2019-05-22T11:58:59Z

I think no problem. if we feel necessary these, we may use —only-update nvd,alpine .
or we can must enable nvd. What do you think about this?

knqyf263 · 2019-05-22T13:12:11Z

@Code-Hex There is no information in NVD, but there may be information in Red Hat DB. So, even if we must enable NVD, there may be no information.

If no data in NVD, trivy uses Red Hat DB.
If no data in Red Hat DB, trivy uses Debian DB.
If no data in Debian DB...

Therefore, it is best to use all DBs. However, if we display a warning, the --only-update option can be adopted.

I'm sorry for asking many times, but would you display a warning if the --update-only option is specified?
The --update-only option may cause the vulnerability details such as severity and title not to be displayed

Code-Hex · 2019-05-23T04:11:02Z

@knqyf263 I'm OK to display warning 👍
Please tell me how should I display message?

BTW, why depends vulnerability information on each databases?
I'm thinking about database should have all vulnerability information of one distribution. For example, database of alpine (alpine-DB) should have alpine vulnerability information and also Information dependent on other distributions.

knqyf263 · 2019-05-24T00:43:19Z

@Code-Hex Please use log.Logger.Warn().

The vulnerability information of each distribution has two roles in Trivy. The first is vulnerability detection of each distribution. For example, only vulnerability information of Alpine Linux is necessary to detect vulnerabilities in an image of Alpine Linux.

And it is also used when displaying vulnerability details such as a severity and title. The details are different for each distribution.

In the case of CVE-2018-10875:
NVD has the detailed information.
https://nvd.nist.gov/vuln/detail/CVE-2018-10875

However, Alpine Linux has no information.
https://bugs.alpinelinux.org/projects/alpine/search?utf8=✓&scope=subprojects&issues=1&q=CVE-2018-10875

On the other hand, in the case of CVE-2018-5743:
Alpine Linux has the detailed information.
https://bugs.alpinelinux.org/issues/10369

NVD has no information.
https://nvd.nist.gov/vuln/detail/CVE-2018-5743

As mentioned above, it is unknown which distribution has the detailed information. So, Trivy uses all DBs. And when showing vulnerability details, Trivy selects the distribution that has details.

Code-Hex · 2019-05-24T03:12:07Z

@knqyf263 done! please review it.

knqyf263 · 2019-05-24T03:52:43Z

Thanks a lot!!

* Added --only-update flag * Added feature for --only-update flag * Added README of --only-update * Fixed README * Use only Update function * Added warning message

Code-Hex added 4 commits May 21, 2019 19:38

Added --only-update flag

b3e3c10

Added feature for --only-update flag

309d10b

Added README of --only-update

c52365b

Fixed README

e430d56

tomoyamachi requested a review from knqyf263 May 21, 2019 12:00

knqyf263 reviewed May 22, 2019

View reviewed changes

Use only Update function

48ae91e

Mallear mentioned this pull request May 22, 2019

feat: add vulnerability type filter to get only os or packages vulnerabilities #50

Merged

Added warning message

7f25de8

knqyf263 approved these changes May 24, 2019

View reviewed changes

knqyf263 merged commit b62536f into aquasecurity:master May 24, 2019

Code-Hex mentioned this pull request May 24, 2019

Added alpine into dbnames #54

Closed

josedonizetti referenced this pull request in josedonizetti/trivy Jun 24, 2022

Add MFA rule (#43)

9be97f2

knqyf263 referenced this pull request in knqyf263/trivy Feb 9, 2024

feat(wheel): detect license from METADATA file #43

49aca26

knqyf263 referenced this pull request in knqyf263/trivy Feb 9, 2024

feat(wheel): detect license from METADATA file #43

0452f8e

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added --only-update option #43

Added --only-update option #43

Code-Hex commented May 21, 2019

tomoyamachi commented May 21, 2019

knqyf263 commented May 21, 2019

knqyf263 May 22, 2019

knqyf263 May 22, 2019

knqyf263 May 22, 2019

knqyf263 May 22, 2019

Code-Hex commented May 22, 2019 •

edited

Loading

knqyf263 commented May 22, 2019

Code-Hex commented May 22, 2019

knqyf263 commented May 22, 2019 •

edited

Loading

Code-Hex commented May 23, 2019

knqyf263 commented May 24, 2019

Code-Hex commented May 24, 2019

knqyf263 commented May 24, 2019

	func OnlyUpdate(names []string) error {
	func Update(names []string) error {

	if err = vulnsrc.OnlyUpdate(strings.Split(onlyUpdate, ",")); err != nil {
	if err = vulnsrc.Update(strings.Split(onlyUpdate, ",")); err != nil {

	if err = vulnsrc.UpdateAll(); err != nil {
	if err = vulnsrc.Update(vunerability.DBNames); err != nil {

Added --only-update option #43

Added --only-update option #43

Conversation

Code-Hex commented May 21, 2019

What

Why

tomoyamachi commented May 21, 2019

knqyf263 commented May 21, 2019

knqyf263 May 22, 2019

Choose a reason for hiding this comment

knqyf263 May 22, 2019

Choose a reason for hiding this comment

knqyf263 May 22, 2019

Choose a reason for hiding this comment

knqyf263 May 22, 2019

Choose a reason for hiding this comment

Code-Hex commented May 22, 2019 • edited Loading

knqyf263 commented May 22, 2019

Code-Hex commented May 22, 2019

knqyf263 commented May 22, 2019 • edited Loading

Code-Hex commented May 23, 2019

knqyf263 commented May 24, 2019

Code-Hex commented May 24, 2019

knqyf263 commented May 24, 2019

Code-Hex commented May 22, 2019 •

edited

Loading

knqyf263 commented May 22, 2019 •

edited

Loading