Skip to content

Commit 63ef760

Browse files
knqyf263otms61
knqyf263
and
otms61
authored
feat(image): discover SBOM in OCI referrers (#3768)
Co-authored-by: saso <[email protected]>
1 parent 3fa703c commit 63ef760

File tree

19 files changed

+559
-130
lines changed

19 files changed

+559
-130
lines changed

‎docs/docs/target/container_image.md

Lines changed: 32 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -375,10 +375,41 @@ $ skopeo copy docker-daemon:alpine:3.11 oci:/path/to/alpine
375375
$ trivy image --input /path/to/alpine
376376
```
377377

378-
## SBOM generation
378+
## SBOM
379+
Trivy supports the generation of Software Bill of Materials (SBOM) for container images and the search for SBOMs during vulnerability scanning.
380+
381+
### Generation
379382
Trivy can generate SBOM for container images.
380383
See [here](../sbom/index.md) for the detail.
381384

385+
### Discovery
386+
Trivy can search for Software Bill of Materials (SBOMs) that reference container images.
387+
If an SBOM is found, the vulnerability scan is performed using the SBOM instead of the container image.
388+
By using the SBOM, you can perform a vulnerability scan more quickly, as it allows you to skip pulling the container image and analyzing its layers.
389+
390+
To enable this functionality, you need to specify the `--sbom-sources` flag.
391+
The following two sources are supported:
392+
393+
- OCI Registry (`oci`)
394+
- Rekor (`rekor`)
395+
396+
Example:
397+
398+
```bash
399+
$ trivy image --sbom-sources oci ghcr.io/knqyf263/oci-referrers
400+
2023-03-05T17:36:55.278+0200 INFO Vulnerability scanning is enabled
401+
2023-03-05T17:36:58.103+0200 INFO Detected SBOM format: cyclonedx-json
402+
2023-03-05T17:36:58.129+0200 INFO Found SBOM (cyclonedx) in the OCI referrers
403+
...
404+
405+
ghcr.io/knqyf263/oci-referrers (alpine 3.16.2)
406+
==============================================
407+
Total: 17 (UNKNOWN: 0, LOW: 0, MEDIUM: 5, HIGH: 9, CRITICAL: 3)
408+
```
409+
410+
The OCI Registry utilizes the [Referrers API](https://github.com/opencontainers/distribution-spec/blob/main/spec.md#listing-referrers).
411+
For more information about Rekor, please refer to [its documentation](../attestation/rekor.md).
412+
382413
## Compliance
383414

384415
!!! warning "EXPERIMENTAL"

‎go.mod

Lines changed: 29 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@ go 1.19
44

55
require (
66
github.com/Azure/azure-sdk-for-go v68.0.0+incompatible
7-
github.com/Azure/go-autorest/autorest v0.11.24
8-
github.com/Azure/go-autorest/autorest/adal v0.9.18
7+
github.com/Azure/go-autorest/autorest v0.11.28
8+
github.com/Azure/go-autorest/autorest/adal v0.9.21
99
github.com/Azure/go-autorest/autorest/azure/auth v0.5.12
1010
github.com/CycloneDX/cyclonedx-go v0.7.0
1111
github.com/GoogleCloudPlatform/docker-credential-gcr v2.0.5+incompatible
@@ -44,8 +44,8 @@ require (
4444
github.com/go-openapi/strfmt v0.21.3
4545
github.com/go-redis/redis/v8 v8.11.5
4646
github.com/golang-jwt/jwt v3.2.2+incompatible
47-
github.com/golang/protobuf v1.5.2
48-
github.com/google/go-containerregistry v0.13.0
47+
github.com/golang/protobuf v1.5.3
48+
github.com/google/go-containerregistry v0.14.0
4949
github.com/google/licenseclassifier/v2 v2.0.0
5050
github.com/google/uuid v1.3.0
5151
github.com/google/wire v0.5.0
@@ -68,9 +68,9 @@ require (
6868
github.com/masahiro331/go-xfs-filesystem v0.0.0-20221225060805-c02764233454
6969
github.com/mitchellh/hashstructure/v2 v2.0.2
7070
github.com/moby/buildkit v0.11.4
71-
github.com/open-policy-agent/opa v0.44.1-0.20220927105354-00e835a7cc15
71+
github.com/open-policy-agent/opa v0.45.0
7272
github.com/opencontainers/go-digest v1.0.0
73-
github.com/opencontainers/image-spec v1.1.0-rc2
73+
github.com/opencontainers/image-spec v1.1.0-rc2.0.20221020182949-4df8887994e8
7474
github.com/owenrumney/go-sarif/v2 v2.1.2
7575
github.com/package-url/packageurl-go v0.1.1-0.20220428063043-89078438f170
7676
github.com/samber/lo v1.37.0
@@ -97,7 +97,7 @@ require (
9797
golang.org/x/term v0.6.0
9898
golang.org/x/text v0.8.0
9999
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2
100-
google.golang.org/protobuf v1.28.1
100+
google.golang.org/protobuf v1.29.0
101101
gopkg.in/yaml.v3 v3.0.1
102102
gotest.tools v2.2.0+incompatible
103103
k8s.io/api v0.26.2
@@ -106,14 +106,14 @@ require (
106106
)
107107

108108
require (
109-
cloud.google.com/go v0.105.0 // indirect
110-
cloud.google.com/go/compute v1.14.0 // indirect
109+
cloud.google.com/go v0.107.0 // indirect
110+
cloud.google.com/go/compute v1.18.0 // indirect
111111
cloud.google.com/go/compute/metadata v0.2.3 // indirect
112112
cloud.google.com/go/iam v0.8.0 // indirect
113113
cloud.google.com/go/storage v1.27.0 // indirect
114114
github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
115115
github.com/Azure/go-autorest v14.2.0+incompatible // indirect
116-
github.com/Azure/go-autorest/autorest/azure/cli v0.4.5 // indirect
116+
github.com/Azure/go-autorest/autorest/azure/cli v0.4.6 // indirect
117117
github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
118118
github.com/Azure/go-autorest/logger v0.2.1 // indirect
119119
github.com/Azure/go-autorest/tracing v0.6.0 // indirect
@@ -153,7 +153,7 @@ require (
153153
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.15.20 // indirect
154154
github.com/aws/aws-sdk-go-v2/service/codebuild v1.19.17 // indirect
155155
github.com/aws/aws-sdk-go-v2/service/docdb v1.19.11 // indirect
156-
github.com/aws/aws-sdk-go-v2/service/dynamodb v1.17.6 // indirect
156+
github.com/aws/aws-sdk-go-v2/service/dynamodb v1.17.7 // indirect
157157
github.com/aws/aws-sdk-go-v2/service/ebs v1.15.19 // indirect
158158
github.com/aws/aws-sdk-go-v2/service/ecr v1.17.18 // indirect
159159
github.com/aws/aws-sdk-go-v2/service/ecs v1.18.26 // indirect
@@ -188,28 +188,29 @@ require (
188188
github.com/beorn7/perks v1.0.1 // indirect
189189
github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
190190
github.com/bmatcuk/doublestar v1.3.4 // indirect
191-
github.com/briandowns/spinner v1.12.0 // indirect
191+
github.com/briandowns/spinner v1.19.0 // indirect
192192
github.com/cenkalti/backoff/v4 v4.2.0 // indirect
193193
github.com/cespare/xxhash/v2 v2.1.2 // indirect
194194
github.com/chai2010/gettext-go v1.0.2 // indirect
195195
github.com/cloudflare/circl v1.1.0 // indirect
196196
github.com/containerd/cgroups v1.0.4 // indirect
197197
github.com/containerd/continuity v0.3.0 // indirect
198198
github.com/containerd/fifo v1.0.0 // indirect
199-
github.com/containerd/stargz-snapshotter/estargz v0.13.0 // indirect
199+
github.com/containerd/stargz-snapshotter/estargz v0.14.3 // indirect
200200
github.com/containerd/ttrpc v1.1.0 // indirect
201201
github.com/containerd/typeurl v1.0.2 // indirect
202202
github.com/cyphar/filepath-securejoin v0.2.3 // indirect
203203
github.com/davecgh/go-spew v1.1.1 // indirect
204204
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
205205
github.com/dimchansky/utfbom v1.1.1 // indirect
206206
github.com/dlclark/regexp2 v1.4.0 // indirect
207-
github.com/docker/cli v23.0.0-rc.1+incompatible // indirect
207+
github.com/docker/cli v23.0.1+incompatible // indirect
208208
github.com/docker/distribution v2.8.1+incompatible // indirect
209209
github.com/docker/docker-credential-helpers v0.7.0 // indirect
210210
github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
211211
github.com/docker/go-metrics v0.0.1 // indirect
212212
github.com/docker/go-units v0.5.0 // indirect
213+
github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect
213214
github.com/dustin/go-humanize v1.0.1 // indirect
214215
github.com/emicklei/go-restful/v3 v3.9.0 // indirect
215216
github.com/emirpasic/gods v1.18.1 // indirect
@@ -231,14 +232,15 @@ require (
231232
github.com/go-openapi/spec v0.20.7 // indirect
232233
github.com/go-openapi/swag v0.22.3 // indirect
233234
github.com/go-openapi/validate v0.22.0 // indirect
235+
github.com/go-test/deep v1.0.8 // indirect
234236
github.com/gobwas/glob v0.2.3 // indirect
235237
github.com/goccy/go-yaml v1.8.1 // indirect
236-
github.com/gofrs/uuid v4.0.0+incompatible // indirect
238+
github.com/gofrs/uuid v4.3.1+incompatible // indirect
237239
github.com/gogo/googleapis v1.4.1 // indirect
238240
github.com/gogo/protobuf v1.3.2 // indirect
239241
github.com/golang-jwt/jwt/v4 v4.4.2 // indirect
240242
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
241-
github.com/google/btree v1.0.1 // indirect
243+
github.com/google/btree v1.1.2 // indirect
242244
github.com/google/gnostic v0.5.7-v3refs // indirect
243245
github.com/google/go-cmp v0.5.9 // indirect
244246
github.com/google/gofuzz v1.2.0 // indirect
@@ -257,15 +259,15 @@ require (
257259
github.com/hashicorp/hcl/v2 v2.14.1 // indirect
258260
github.com/huandu/xstrings v1.3.3 // indirect
259261
github.com/imdario/mergo v0.3.13 // indirect
260-
github.com/inconshreveable/mousetrap v1.0.1 // indirect
262+
github.com/inconshreveable/mousetrap v1.1.0 // indirect
261263
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
262264
github.com/jmespath/go-jmespath v0.4.0 // indirect
263265
github.com/jmoiron/sqlx v1.3.5 // indirect
264266
github.com/josharian/intern v1.0.0 // indirect
265267
github.com/json-iterator/go v1.1.12 // indirect
266268
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
267269
github.com/kevinburke/ssh_config v1.2.0 // indirect
268-
github.com/klauspost/compress v1.15.12 // indirect
270+
github.com/klauspost/compress v1.16.0 // indirect
269271
github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 // indirect
270272
github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect
271273
github.com/liamg/iamgo v0.0.9 // indirect
@@ -280,6 +282,7 @@ require (
280282
github.com/mattn/go-runewidth v0.0.13 // indirect
281283
github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
282284
github.com/microsoft/go-rustaudit v0.0.0-20220808201409-204dfee52032 // indirect
285+
github.com/miekg/dns v1.1.50 // indirect
283286
github.com/mitchellh/copystructure v1.2.0 // indirect
284287
github.com/mitchellh/go-homedir v1.1.0 // indirect
285288
github.com/mitchellh/go-testing-interface v1.14.1 // indirect
@@ -300,7 +303,7 @@ require (
300303
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
301304
github.com/oklog/ulid v1.3.1 // indirect
302305
github.com/olekukonko/tablewriter v0.0.5 // indirect
303-
github.com/opencontainers/runc v1.1.3 // indirect
306+
github.com/opencontainers/runc v1.1.4 // indirect
304307
github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417 // indirect
305308
github.com/opencontainers/selinux v1.10.2 // indirect
306309
github.com/opentracing/opentracing-go v1.2.0 // indirect
@@ -314,12 +317,12 @@ require (
314317
github.com/prometheus/client_model v0.3.0 // indirect
315318
github.com/prometheus/common v0.37.0 // indirect
316319
github.com/prometheus/procfs v0.8.0 // indirect
317-
github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0 // indirect
320+
github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
318321
github.com/remyoudompheng/bigfft v0.0.0-20230126093431-47fa9a501578 // indirect
319322
github.com/rivo/uniseg v0.2.0 // indirect
320323
github.com/rubenv/sql-migrate v1.2.0 // indirect
321324
github.com/russross/blackfriday/v2 v2.1.0 // indirect
322-
github.com/sergi/go-diff v1.1.0 // indirect
325+
github.com/sergi/go-diff v1.2.0 // indirect
323326
github.com/shibumi/go-pathspec v1.3.0 // indirect
324327
github.com/shopspring/decimal v1.2.0 // indirect
325328
github.com/sirupsen/logrus v1.9.0 // indirect
@@ -347,19 +350,20 @@ require (
347350
go.uber.org/atomic v1.10.0 // indirect
348351
go.uber.org/multierr v1.8.0 // indirect
349352
golang.org/x/net v0.8.0 // indirect
350-
golang.org/x/oauth2 v0.1.0 // indirect
353+
golang.org/x/oauth2 v0.6.0 // indirect
351354
golang.org/x/sys v0.6.0 // indirect
352355
golang.org/x/time v0.3.0 // indirect
353-
golang.org/x/tools v0.6.0 // indirect
354-
google.golang.org/api v0.107.0 // indirect
356+
golang.org/x/tools v0.7.0 // indirect
357+
google.golang.org/api v0.108.0 // indirect
355358
google.golang.org/appengine v1.6.7 // indirect
356-
google.golang.org/genproto v0.0.0-20221227171554-f9683d7f8bef // indirect
359+
google.golang.org/genproto v0.0.0-20230124163310-31e0e69b6fc2 // indirect
357360
google.golang.org/grpc v1.52.0 // indirect
358361
gopkg.in/cheggaaa/pb.v1 v1.0.28 // indirect
359362
gopkg.in/inf.v0 v0.9.1 // indirect
360363
gopkg.in/ini.v1 v1.67.0 // indirect
361364
gopkg.in/warnings.v0 v0.1.2 // indirect
362365
gopkg.in/yaml.v2 v2.4.0 // indirect
366+
gotest.tools/v3 v3.1.0 // indirect
363367
helm.sh/helm/v3 v3.11.1 // indirect
364368
k8s.io/apiextensions-apiserver v0.26.0 // indirect
365369
k8s.io/apimachinery v0.26.2 // indirect

0 commit comments

Comments
 (0)