Skip to content

Commit 56dbe1f

Browse files
knqyf263knqyf263
authoredMay 28, 2024··
fix: include packages unless it is not needed (#6765)
Signed-off-by: knqyf263 <[email protected]>
·
v0.61.1v0.52.0
1 parent 5ccfd17 commit 56dbe1f

32 files changed

+1880
-612
lines changed
 

‎docs/docs/references/configuration/cli/trivy_aws.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ trivy aws [flags]
8989
--ignorefile string specify .trivyignore file (default ".trivyignore")
9090
--include-deprecated-checks include deprecated checks
9191
--include-non-failures include successes and exceptions, available with '--scanners misconfig'
92-
--list-all-pkgs enabling the option will output all packages regardless of vulnerability
92+
--list-all-pkgs output all packages in the JSON report regardless of vulnerability
9393
--max-cache-age duration The maximum age of the cloud cache. Cached data will be required from the cloud provider if it is older than this. (default 24h0m0s)
9494
--misconfig-scanners strings comma-separated list of misconfig scanners to use for misconfiguration scanning (default [azure-arm,cloudformation,dockerfile,helm,kubernetes,terraform,terraformplan-json,terraformplan-snapshot])
9595
-o, --output string output file name

‎docs/docs/references/configuration/cli/trivy_convert.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ trivy convert [flags] RESULT_JSON
2626
-h, --help help for convert
2727
--ignore-policy string specify the Rego file path to evaluate each vulnerability
2828
--ignorefile string specify .trivyignore file (default ".trivyignore")
29-
--list-all-pkgs enabling the option will output all packages regardless of vulnerability
29+
--list-all-pkgs output all packages in the JSON report regardless of vulnerability
3030
-o, --output string output file name
3131
--output-plugin-arg string [EXPERIMENTAL] output plugin arguments
3232
--report string specify a report format for the output (all,summary) (default "all")

‎docs/docs/references/configuration/cli/trivy_filesystem.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ trivy filesystem [flags] PATH
5555
--java-db-repository string OCI repository to retrieve trivy-java-db from (default "ghcr.io/aquasecurity/trivy-java-db:1")
5656
--license-confidence-level float specify license classifier's confidence level (default 0.9)
5757
--license-full eagerly look for licenses in source code headers and license files
58-
--list-all-pkgs enabling the option will output all packages regardless of vulnerability
58+
--list-all-pkgs output all packages in the JSON report regardless of vulnerability
5959
--misconfig-scanners strings comma-separated list of misconfig scanners to use for misconfiguration scanning (default [azure-arm,cloudformation,dockerfile,helm,kubernetes,terraform,terraformplan-json,terraformplan-snapshot])
6060
--module-dir string specify directory to the wasm modules that will be loaded (default "$HOME/.trivy/modules")
6161
--no-progress suppress progress bar

‎docs/docs/references/configuration/cli/trivy_image.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ trivy image [flags] IMAGE_NAME
7373
--java-db-repository string OCI repository to retrieve trivy-java-db from (default "ghcr.io/aquasecurity/trivy-java-db:1")
7474
--license-confidence-level float specify license classifier's confidence level (default 0.9)
7575
--license-full eagerly look for licenses in source code headers and license files
76-
--list-all-pkgs enabling the option will output all packages regardless of vulnerability
76+
--list-all-pkgs output all packages in the JSON report regardless of vulnerability
7777
--misconfig-scanners strings comma-separated list of misconfig scanners to use for misconfiguration scanning (default [azure-arm,cloudformation,dockerfile,helm,kubernetes,terraform,terraformplan-json,terraformplan-snapshot])
7878
--module-dir string specify directory to the wasm modules that will be loaded (default "$HOME/.trivy/modules")
7979
--no-progress suppress progress bar

‎docs/docs/references/configuration/cli/trivy_kubernetes.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ trivy kubernetes [flags] [CONTEXT]
6969
--java-db-repository string OCI repository to retrieve trivy-java-db from (default "ghcr.io/aquasecurity/trivy-java-db:1")
7070
--k8s-version string specify k8s version to validate outdated api by it (example: 1.21.0)
7171
--kubeconfig string specify the kubeconfig file path to use
72-
--list-all-pkgs enabling the option will output all packages regardless of vulnerability
72+
--list-all-pkgs output all packages in the JSON report regardless of vulnerability
7373
--misconfig-scanners strings comma-separated list of misconfig scanners to use for misconfiguration scanning (default [azure-arm,cloudformation,dockerfile,helm,kubernetes,terraform,terraformplan-json,terraformplan-snapshot])
7474
--no-progress suppress progress bar
7575
--node-collector-imageref string indicate the image reference for the node-collector scan job (default "ghcr.io/aquasecurity/node-collector:0.2.1")

‎docs/docs/references/configuration/cli/trivy_repository.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ trivy repository [flags] (REPO_PATH | REPO_URL)
5555
--java-db-repository string OCI repository to retrieve trivy-java-db from (default "ghcr.io/aquasecurity/trivy-java-db:1")
5656
--license-confidence-level float specify license classifier's confidence level (default 0.9)
5757
--license-full eagerly look for licenses in source code headers and license files
58-
--list-all-pkgs enabling the option will output all packages regardless of vulnerability
58+
--list-all-pkgs output all packages in the JSON report regardless of vulnerability
5959
--misconfig-scanners strings comma-separated list of misconfig scanners to use for misconfiguration scanning (default [azure-arm,cloudformation,dockerfile,helm,kubernetes,terraform,terraformplan-json,terraformplan-snapshot])
6060
--module-dir string specify directory to the wasm modules that will be loaded (default "$HOME/.trivy/modules")
6161
--no-progress suppress progress bar

‎docs/docs/references/configuration/cli/trivy_rootfs.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ trivy rootfs [flags] ROOTDIR
5757
--java-db-repository string OCI repository to retrieve trivy-java-db from (default "ghcr.io/aquasecurity/trivy-java-db:1")
5858
--license-confidence-level float specify license classifier's confidence level (default 0.9)
5959
--license-full eagerly look for licenses in source code headers and license files
60-
--list-all-pkgs enabling the option will output all packages regardless of vulnerability
60+
--list-all-pkgs output all packages in the JSON report regardless of vulnerability
6161
--misconfig-scanners strings comma-separated list of misconfig scanners to use for misconfiguration scanning (default [azure-arm,cloudformation,dockerfile,helm,kubernetes,terraform,terraformplan-json,terraformplan-snapshot])
6262
--module-dir string specify directory to the wasm modules that will be loaded (default "$HOME/.trivy/modules")
6363
--no-progress suppress progress bar

‎docs/docs/references/configuration/cli/trivy_sbom.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ trivy sbom [flags] SBOM_PATH
3939
--ignored-licenses strings specify a list of license to ignore
4040
--ignorefile string specify .trivyignore file (default ".trivyignore")
4141
--java-db-repository string OCI repository to retrieve trivy-java-db from (default "ghcr.io/aquasecurity/trivy-java-db:1")
42-
--list-all-pkgs enabling the option will output all packages regardless of vulnerability
42+
--list-all-pkgs output all packages in the JSON report regardless of vulnerability
4343
--no-progress suppress progress bar
4444
--offline-scan do not issue API requests to identify dependencies
4545
-o, --output string output file name

‎docs/docs/references/configuration/cli/trivy_vm.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ trivy vm [flags] VM_IMAGE
4949
--ignorefile string specify .trivyignore file (default ".trivyignore")
5050
--include-non-failures include successes and exceptions, available with '--scanners misconfig'
5151
--java-db-repository string OCI repository to retrieve trivy-java-db from (default "ghcr.io/aquasecurity/trivy-java-db:1")
52-
--list-all-pkgs enabling the option will output all packages regardless of vulnerability
52+
--list-all-pkgs output all packages in the JSON report regardless of vulnerability
5353
--misconfig-scanners strings comma-separated list of misconfig scanners to use for misconfiguration scanning (default [azure-arm,cloudformation,dockerfile,helm,kubernetes,terraform,terraformplan-json,terraformplan-snapshot])
5454
--module-dir string specify directory to the wasm modules that will be loaded (default "$HOME/.trivy/modules")
5555
--no-progress suppress progress bar

‎integration/client_server_test.go

+8-5
Original file line numberDiff line numberDiff line change
@@ -39,10 +39,10 @@ type csArgs struct {
3939

4040
func TestClientServer(t *testing.T) {
4141
tests := []struct {
42-
name string
43-
args csArgs
44-
golden string
45-
wantErr string
42+
name string
43+
args csArgs
44+
golden string
45+
override func(t *testing.T, want, got *types.Report)
4646
}{
4747
{
4848
name: "alpine 3.9",
@@ -270,6 +270,9 @@ func TestClientServer(t *testing.T) {
270270
Target: "https://github.com/knqyf263/trivy-ci-test",
271271
},
272272
golden: "testdata/test-repo.json.golden",
273+
override: func(t *testing.T, want, got *types.Report) {
274+
want.ArtifactName = "https://github.com/knqyf263/trivy-ci-test"
275+
},
273276
},
274277
}
275278

@@ -284,7 +287,7 @@ func TestClientServer(t *testing.T) {
284287
}
285288

286289
runTest(t, osArgs, tt.golden, "", types.FormatJSON, runOptions{
287-
override: overrideUID,
290+
override: overrideFuncs(overrideUID, tt.override),
288291
})
289292
})
290293
}

‎integration/repo_test.go

+8
Original file line numberDiff line numberDiff line change
@@ -234,6 +234,14 @@ func TestRepository(t *testing.T) {
234234
},
235235
golden: "testdata/composer.lock.json.golden",
236236
},
237+
{
238+
name: "multiple lockfiles",
239+
args: args{
240+
scanner: types.VulnerabilityScanner,
241+
input: "testdata/fixtures/repo/trivy-ci-test",
242+
},
243+
golden: "testdata/test-repo.json.golden",
244+
},
237245
{
238246
name: "dockerfile",
239247
args: args{

‎integration/testdata/fixtures/repo/trivy-ci-test/Cargo.lock

+666
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎integration/testdata/fixtures/repo/trivy-ci-test/Pipfile.lock

+872
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎integration/testdata/test-repo.json.golden

+6-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"SchemaVersion": 2,
33
"CreatedAt": "2021-08-25T12:20:30.000000005Z",
4-
"ArtifactName": "https://github.com/knqyf263/trivy-ci-test",
4+
"ArtifactName": "testdata/fixtures/repo/trivy-ci-test",
55
"ArtifactType": "repository",
66
"Metadata": {
77
"ImageConfig": {
@@ -109,6 +109,11 @@
109109
"LastModifiedDate": "2021-08-16T16:37:00Z"
110110
}
111111
]
112+
},
113+
{
114+
"Target": "Pipfile.lock",
115+
"Class": "lang-pkgs",
116+
"Type": "pipenv"
112117
}
113118
]
114119
}

‎pkg/commands/app_test.go

+4
Original file line numberDiff line numberDiff line change
@@ -197,6 +197,7 @@ func TestFlags(t *testing.T) {
197197
scanners: types.Scanners{
198198
types.VulnerabilityScanner,
199199
types.SecretScanner,
200+
types.SBOMScanner,
200201
},
201202
},
202203
},
@@ -216,6 +217,7 @@ func TestFlags(t *testing.T) {
216217
scanners: types.Scanners{
217218
types.VulnerabilityScanner,
218219
types.SecretScanner,
220+
types.SBOMScanner,
219221
},
220222
},
221223
},
@@ -237,6 +239,7 @@ func TestFlags(t *testing.T) {
237239
scanners: types.Scanners{
238240
types.VulnerabilityScanner,
239241
types.SecretScanner,
242+
types.SBOMScanner,
240243
},
241244
},
242245
},
@@ -257,6 +260,7 @@ func TestFlags(t *testing.T) {
257260
scanners: types.Scanners{
258261
types.VulnerabilityScanner,
259262
types.SecretScanner,
263+
types.SBOMScanner,
260264
},
261265
},
262266
},

‎pkg/commands/artifact/run.go

-1
Original file line numberDiff line numberDiff line change
@@ -538,7 +538,6 @@ func initScannerConfig(opts flag.Options, cacheClient cache.Cache) (ScannerConfi
538538
Scanners: opts.Scanners,
539539
ImageConfigScanners: opts.ImageConfigScanners, // this is valid only for 'image' subcommand
540540
ScanRemovedPackages: opts.ScanRemovedPkgs, // this is valid only for 'image' subcommand
541-
ListAllPackages: opts.ListAllPkgs,
542541
LicenseCategories: opts.LicenseCategories,
543542
FilePatterns: opts.FilePatterns,
544543
IncludeDevDeps: opts.IncludeDevDeps,

‎pkg/flag/options.go

+27-10
Original file line numberDiff line numberDiff line change
@@ -354,16 +354,7 @@ type Options struct {
354354

355355
// Align takes consistency of options
356356
func (o *Options) Align() error {
357-
if o.Format == types.FormatSPDX || o.Format == types.FormatSPDXJSON {
358-
log.Info(`"--format spdx" and "--format spdx-json" disable security scanning`)
359-
o.Scanners = nil
360-
}
361-
362-
// Vulnerability scanning is disabled by default for CycloneDX.
363-
if o.Format == types.FormatCycloneDX && !viper.IsSet(ScannersFlag.ConfigName) {
364-
log.Info(`"--format cyclonedx" disables security scanning. Specify "--scanners vuln" explicitly if you want to include vulnerabilities in the CycloneDX report.`)
365-
o.Scanners = nil
366-
}
357+
o.enableSBOM()
367358

368359
if o.Compliance.Spec.ID != "" {
369360
if viper.IsSet(ScannersFlag.ConfigName) {
@@ -394,6 +385,32 @@ func (o *Options) Align() error {
394385
return nil
395386
}
396387

388+
func (o *Options) enableSBOM() {
389+
// Always need packages when the vulnerability scanner is enabled
390+
if o.Scanners.Enabled(types.VulnerabilityScanner) {
391+
o.Scanners.Enable(types.SBOMScanner)
392+
}
393+
394+
// Enable the SBOM scanner when a list of packages is necessary.
395+
if o.ListAllPkgs || slices.Contains(types.SupportedSBOMFormats, o.Format) {
396+
o.Scanners.Enable(types.SBOMScanner)
397+
}
398+
399+
if o.Format == types.FormatSPDX || o.Format == types.FormatSPDXJSON {
400+
log.Info(`"--format spdx" and "--format spdx-json" disable security scanning`)
401+
o.Scanners = types.Scanners{types.SBOMScanner}
402+
}
403+
404+
if o.Format == types.FormatCycloneDX {
405+
// Vulnerability scanning is disabled by default for CycloneDX.
406+
if !viper.IsSet(ScannersFlag.ConfigName) {
407+
log.Info(`"--format cyclonedx" disables security scanning. Specify "--scanners vuln" explicitly if you want to include vulnerabilities in the CycloneDX report.`)
408+
o.Scanners = nil
409+
}
410+
o.Scanners.Enable(types.SBOMScanner)
411+
}
412+
}
413+
397414
// RegistryOpts returns options for OCI registries
398415
func (o *Options) RegistryOpts() ftypes.RegistryOptions {
399416
return ftypes.RegistryOptions{

‎pkg/flag/report_flags.go

+5-27
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ var (
5454
ListAllPkgsFlag = Flag[bool]{
5555
Name: "list-all-pkgs",
5656
ConfigName: "list-all-pkgs",
57-
Usage: "enabling the option will output all packages regardless of vulnerability",
57+
Usage: "output all packages in the JSON report regardless of vulnerability",
5858
}
5959
IgnoreFileFlag = Flag[string]{
6060
Name: "ignorefile",
@@ -208,10 +208,10 @@ func (f *ReportFlagGroup) ToOptions() (ReportOptions, error) {
208208
}
209209
}
210210

211-
// "--list-all-pkgs" option is unavailable with "--format table".
212-
// If user specifies "--list-all-pkgs" with "--format table", we should warn it.
213-
if listAllPkgs && format == types.FormatTable {
214-
log.Warn(`"--list-all-pkgs" cannot be used with "--format table". Try "--format json" or other formats.`)
211+
// "--list-all-pkgs" option is unavailable with other than "--format json".
212+
// If user specifies "--list-all-pkgs" with "--format table" or other formats, we should warn it.
213+
if listAllPkgs && format != types.FormatJSON {
214+
log.Warn(`"--list-all-pkgs" is only valid for the JSON format, for other formats a list of packages is automatically included.`)
215215
}
216216

217217
// "--dependency-tree" option is available only with "--format table".
@@ -224,11 +224,6 @@ func (f *ReportFlagGroup) ToOptions() (ReportOptions, error) {
224224
}
225225
}
226226

227-
// Enable '--list-all-pkgs' if needed
228-
if f.forceListAllPkgs(format, listAllPkgs, dependencyTree) {
229-
listAllPkgs = true
230-
}
231-
232227
cs, err := loadComplianceTypes(f.Compliance.Value())
233228
if err != nil {
234229
return ReportOptions{}, xerrors.Errorf("unable to load compliance spec: %w", err)
@@ -273,23 +268,6 @@ func loadComplianceTypes(compliance string) (spec.ComplianceSpec, error) {
273268
return cs, nil
274269
}
275270

276-
func (f *ReportFlagGroup) forceListAllPkgs(format types.Format, listAllPkgs, dependencyTree bool) bool {
277-
if slices.Contains(types.SupportedSBOMFormats, format) && !listAllPkgs {
278-
log.Debugf("%q automatically enables '--list-all-pkgs'.", types.SupportedSBOMFormats)
279-
return true
280-
}
281-
// We need this flag to insert dependency locations into Sarif('Package' struct contains 'Locations')
282-
if format == types.FormatSarif && !listAllPkgs {
283-
log.Debug("Sarif format automatically enables '--list-all-pkgs' to get locations")
284-
return true
285-
}
286-
if dependencyTree && !listAllPkgs {
287-
log.Debug("'--dependency-tree' enables '--list-all-pkgs'.")
288-
return true
289-
}
290-
return false
291-
}
292-
293271
func toSeverity(severity []string) []dbTypes.Severity {
294272
if len(severity) == 0 {
295273
return nil

‎pkg/flag/report_flags_test.go

+6-28
Original file line numberDiff line numberDiff line change
@@ -46,34 +46,12 @@ func TestReportFlagGroup_ToOptions(t *testing.T) {
4646
{
4747
name: "happy path with an cyclonedx",
4848
fields: fields{
49-
severities: "CRITICAL",
50-
format: "cyclonedx",
51-
listAllPkgs: true,
52-
},
53-
want: flag.ReportOptions{
54-
Severities: []dbTypes.Severity{dbTypes.SeverityCritical},
55-
Format: types.FormatCycloneDX,
56-
ListAllPkgs: true,
57-
},
58-
},
59-
{
60-
name: "happy path with an cyclonedx option list-all-pkgs is false",
61-
fields: fields{
62-
severities: "CRITICAL",
63-
format: "cyclonedx",
64-
listAllPkgs: false,
65-
debug: true,
66-
},
67-
wantLogs: []string{
68-
`["cyclonedx" "spdx" "spdx-json" "github"] automatically enables '--list-all-pkgs'.`,
69-
`Parsed severities severities=[CRITICAL]`,
49+
severities: "CRITICAL",
50+
format: "cyclonedx",
7051
},
7152
want: flag.ReportOptions{
72-
Severities: []dbTypes.Severity{
73-
dbTypes.SeverityCritical,
74-
},
75-
Format: types.FormatCycloneDX,
76-
ListAllPkgs: true,
53+
Severities: []dbTypes.Severity{dbTypes.SeverityCritical},
54+
Format: types.FormatCycloneDX,
7755
},
7856
},
7957
{
@@ -128,7 +106,7 @@ func TestReportFlagGroup_ToOptions(t *testing.T) {
128106
listAllPkgs: true,
129107
},
130108
wantLogs: []string{
131-
`"--list-all-pkgs" cannot be used with "--format table". Try "--format json" or other formats.`,
109+
`"--list-all-pkgs" is only valid for the JSON format, for other formats a list of packages is automatically included.`,
132110
},
133111
want: flag.ReportOptions{
134112
Format: "table",
@@ -224,7 +202,7 @@ func TestReportFlagGroup_ToOptions(t *testing.T) {
224202

225203
got, err := f.ToOptions()
226204
require.NoError(t, err)
227-
assert.Equalf(t, tt.want, got, "ToOptions()")
205+
assert.EqualExportedValuesf(t, tt.want, got, "ToOptions()")
228206

229207
// Assert log messages
230208
assert.Equal(t, tt.wantLogs, out.Messages(), tt.name)

‎pkg/report/json.go

+14-2
Original file line numberDiff line numberDiff line change
@@ -6,18 +6,30 @@ import (
66
"fmt"
77
"io"
88

9+
"github.com/samber/lo"
910
"golang.org/x/xerrors"
1011

1112
"github.com/aquasecurity/trivy/pkg/types"
1213
)
1314

1415
// JSONWriter implements result Writer
1516
type JSONWriter struct {
16-
Output io.Writer
17+
Output io.Writer
18+
ListAllPkgs bool
1719
}
1820

1921
// Write writes the results in JSON format
20-
func (jw JSONWriter) Write(ctx context.Context, report types.Report) error {
22+
func (jw JSONWriter) Write(_ context.Context, report types.Report) error {
23+
if !jw.ListAllPkgs {
24+
// Delete packages
25+
for i := range report.Results {
26+
report.Results[i].Packages = nil
27+
}
28+
}
29+
report.Results = lo.Filter(report.Results, func(r types.Result, _ int) bool {
30+
return r.Target != "" || !r.IsEmpty()
31+
})
32+
2133
output, err := json.MarshalIndent(report, "", " ")
2234
if err != nil {
2335
return xerrors.Errorf("failed to marshal json: %w", err)

‎pkg/report/writer.go

+4-2
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,10 @@ func Write(ctx context.Context, report types.Report, option flag.Options) (err e
5555
IgnoredLicenses: option.IgnoredLicenses,
5656
}
5757
case types.FormatJSON:
58-
writer = &JSONWriter{Output: output}
58+
writer = &JSONWriter{
59+
Output: output,
60+
ListAllPkgs: option.ListAllPkgs,
61+
}
5962
case types.FormatGitHub:
6063
writer = &github.Writer{
6164
Output: output,
@@ -76,7 +79,6 @@ func Write(ctx context.Context, report types.Report, option flag.Options) (err e
7679
}
7780
break
7881
}
79-
var err error
8082
if writer, err = NewTemplateWriter(output, option.Template, option.AppVersion); err != nil {
8183
return xerrors.Errorf("failed to initialize template writer: %w", err)
8284
}

‎pkg/rpc/client/client.go

-1
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,6 @@ func (s Scanner) Scan(ctx context.Context, target, artifactKey string, blobKeys
8484
Options: &rpc.ScanOptions{
8585
VulnType: opts.VulnType,
8686
Scanners: xstrings.ToStringSlice(opts.Scanners),
87-
ListAllPackages: opts.ListAllPackages,
8887
LicenseCategories: licenseCategories,
8988
IncludeDevDeps: opts.IncludeDevDeps,
9089
},

‎pkg/rpc/server/server.go

+3-4
Original file line numberDiff line numberDiff line change
@@ -47,10 +47,9 @@ func (s *ScanServer) Scan(ctx context.Context, in *rpcScanner.ScanRequest) (*rpc
4747
return types.Scanner(s)
4848
})
4949
options := types.ScanOptions{
50-
VulnType: in.Options.VulnType,
51-
Scanners: scanners,
52-
ListAllPackages: in.Options.ListAllPackages,
53-
IncludeDevDeps: in.Options.IncludeDevDeps,
50+
VulnType: in.Options.VulnType,
51+
Scanners: scanners,
52+
IncludeDevDeps: in.Options.IncludeDevDeps,
5453
}
5554
results, os, err := s.localScanner.Scan(ctx, in.Target, in.ArtifactId, in.BlobIds, options)
5655
if err != nil {

‎pkg/scanner/langpkg/scan.go

+2-4
Original file line numberDiff line numberDiff line change
@@ -54,10 +54,8 @@ func (s *scanner) Scan(ctx context.Context, target types.ScanTarget, opts types.
5454
Type: app.Type,
5555
}
5656

57-
if opts.ListAllPackages {
58-
sort.Sort(app.Packages)
59-
result.Packages = app.Packages
60-
}
57+
sort.Sort(app.Packages)
58+
result.Packages = app.Packages
6159

6260
if opts.Scanners.Enabled(types.VulnerabilityScanner) {
6361
var err error

‎pkg/scanner/local/scan.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -153,7 +153,7 @@ func (s Scanner) ScanTarget(ctx context.Context, target types.ScanTarget, option
153153

154154
func (s Scanner) scanVulnerabilities(ctx context.Context, target types.ScanTarget, options types.ScanOptions) (
155155
types.Results, bool, error) {
156-
if !options.ListAllPackages && !options.Scanners.Enabled(types.VulnerabilityScanner) {
156+
if !options.Scanners.AnyEnabled(types.SBOMScanner, types.VulnerabilityScanner) {
157157
return nil, false, nil
158158
}
159159

‎pkg/scanner/local/scan_test.go

+124-392
Large diffs are not rendered by default.

‎pkg/scanner/ospkg/scan.go

+2-4
Original file line numberDiff line numberDiff line change
@@ -42,10 +42,8 @@ func (s *scanner) Scan(ctx context.Context, target types.ScanTarget, opts types.
4242
Type: target.OS.Family,
4343
}
4444

45-
if opts.ListAllPackages {
46-
sort.Sort(target.Packages)
47-
result.Packages = target.Packages
48-
}
45+
sort.Sort(target.Packages)
46+
result.Packages = target.Packages
4947

5048
if !opts.Scanners.Enabled(types.VulnerabilityScanner) {
5149
// Return packages only

‎pkg/types/scan.go

-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@ type ScanOptions struct {
2626
Scanners Scanners
2727
ImageConfigScanners Scanners // Scanners for container image configuration
2828
ScanRemovedPackages bool
29-
ListAllPackages bool
3029
LicenseCategories map[types.LicenseCategory][]string
3130
FilePatterns []string
3231
IncludeDevDeps bool

‎pkg/types/target.go

+12-3
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,9 @@ const (
2929
// NoneScanner is the scanner of none
3030
NoneScanner = Scanner("none")
3131

32+
// SBOMScanner is the virtual scanner of SBOM, which cannot be enabled by the user
33+
SBOMScanner = Scanner("sbom")
34+
3235
// VulnerabilityScanner is the scanner of vulnerabilities
3336
VulnerabilityScanner = Scanner("vuln")
3437

@@ -70,12 +73,18 @@ var (
7073
}
7174
)
7275

73-
func (scanners Scanners) Enabled(s Scanner) bool {
74-
return slices.Contains(scanners, s)
76+
func (scanners *Scanners) Enable(s Scanner) {
77+
if !scanners.Enabled(s) {
78+
*scanners = append(*scanners, s)
79+
}
80+
}
81+
82+
func (scanners *Scanners) Enabled(s Scanner) bool {
83+
return slices.Contains(*scanners, s)
7584
}
7685

7786
// AnyEnabled returns true if any of the passed scanners is included.
78-
func (scanners Scanners) AnyEnabled(ss ...Scanner) bool {
87+
func (scanners *Scanners) AnyEnabled(ss ...Scanner) bool {
7988
for _, s := range ss {
8089
if scanners.Enabled(s) {
8190
return true

‎rpc/scanner/service.pb.go

+63-73
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎rpc/scanner/service.proto

+2-1
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,10 @@ message Licenses {
2525
message ScanOptions {
2626
repeated string vuln_type = 1;
2727
repeated string scanners = 2;
28-
bool list_all_packages = 3;
2928
map<string, Licenses> license_categories = 4;
3029
bool include_dev_deps = 5;
30+
31+
reserved 3; // deleted 'list_all_packages'
3132
}
3233

3334
message ScanResponse {

‎rpc/scanner/service.twirp.go

+42-43
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)
Please sign in to comment.