diff --git a/pkg/trivy/main.go b/pkg/trivy/main.go index e7e5c55..eca9a7b 100644 --- a/pkg/trivy/main.go +++ b/pkg/trivy/main.go @@ -11,10 +11,14 @@ import ( image2 "github.com/aquasecurity/trivy/pkg/fanal/artifact/image" "github.com/aquasecurity/trivy/pkg/fanal/image" ftypes "github.com/aquasecurity/trivy/pkg/fanal/types" + "github.com/aquasecurity/trivy/pkg/result" "github.com/aquasecurity/trivy/pkg/rpc/client" "github.com/aquasecurity/trivy/pkg/scanner" "github.com/aquasecurity/trivy/pkg/types" v1 "github.com/google/go-containerregistry/pkg/v1" + "github.com/samber/lo" + + dbTypes "github.com/aquasecurity/trivy-db/pkg/types" _ "modernc.org/sqlite" // sqlite driver for RPM DB and Java DB ) @@ -73,13 +77,11 @@ func (opts ScanOption) Scan(reference string) (types.Report, error) { analyzer.TypeSbtLock, }, DisabledHandlers: nil, - // SkipFiles: nil, - // SkipDirs: nil, - FilePatterns: nil, - NoProgress: false, - Insecure: opts.Insecure, - SBOMSources: nil, - RekorURL: "https://rekor.sigstore.dev", + FilePatterns: nil, + NoProgress: false, + Insecure: opts.Insecure, + SBOMSources: nil, + RekorURL: "https://rekor.sigstore.dev", ImageOption: ftypes.ImageOptions{ RegistryOptions: ftypes.RegistryOptions{ Insecure: opts.Insecure, @@ -112,35 +114,23 @@ func (opts ScanOption) Scan(reference string) (types.Report, error) { } if opts.IgnoreUnfixed { - ignoreUnfixed(&report) + ignoreStatuses := lo.FilterMap(dbTypes.Statuses, func(s string, _ int) (dbTypes.Status, bool) { + fixed := dbTypes.StatusFixed + if s == fixed.String() { + return 0, false + } + return dbTypes.NewStatus(s), true + }) + + result.Filter(context.TODO(), report, result.FilterOptions{ + Severities: []dbTypes.Severity{ + dbTypes.SeverityCritical, + dbTypes.SeverityHigh, + }, + IgnoreStatuses: ignoreStatuses, + }) } return report, nil } - -func ignoreUnfixed(report *types.Report) { - - // Homebrewed ignore unfixed - for _, r := range report.Results { - switch r.Class { - case "ok-pkgs": - vulns := []types.DetectedVulnerability{} - for _, v := range r.Vulnerabilities { - if v.FixedVersion != "" { - // fixed - vulns = append(vulns, v) - } - } - - count := len(r.Vulnerabilities) - len(vulns) - if count == 0 { - slog.Debug("removed unfixed vulnerabilities from result", slog.Int("count", count), slog.String("image", report.Metadata.ImageID)) - } else { - slog.Info("removed unfixed vulnerabilities from result", slog.Int("count", count), slog.String("image", report.Metadata.ImageID)) - } - - r.Vulnerabilities = vulns - } - } -} diff --git a/pkg/trivy/util.go b/pkg/trivy/util.go index c95f3a2..3f19ec6 100644 --- a/pkg/trivy/util.go +++ b/pkg/trivy/util.go @@ -7,7 +7,7 @@ import ( func ContainsOsPkgs(rs types.Results) bool { for _, r := range rs { switch r.Class { - case "os-pkgs": + case types.ClassOSPkg: if !r.IsEmpty() { return true }