Skip to content

Commit 7cbdb0a

Browse files
DmitriyLewenDmitriyLewen
authoredJul 9, 2024··
feat(cli): rename --vuln-type flag to --pkg-types flag (#7104)
·
v0.62.0v0.54.0
1 parent 5a9f1a6 commit 7cbdb0a

27 files changed

+161
-200
lines changed
 

‎docs/docs/references/configuration/cli/trivy_filesystem.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ trivy filesystem [flags] PATH
6363
--output-plugin-arg string [EXPERIMENTAL] output plugin arguments
6464
--parallel int number of goroutines enabled for parallel scanning, set 0 to auto-detect parallelism (default 5)
6565
--password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons.
66+
--pkg-types strings comma-separated list of package types (os,library) (default [os,library])
6667
--redis-ca string redis ca file location, if using redis as cache backend
6768
--redis-cert string redis certificate file location, if using redis as cache backend
6869
--redis-key string redis key file location, if using redis as cache backend
@@ -89,7 +90,6 @@ trivy filesystem [flags] PATH
8990
--trace enable more verbose trace output for custom queries
9091
--username strings username. Comma-separated usernames allowed.
9192
--vex string [EXPERIMENTAL] file path to VEX
92-
--vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])
9393
```
9494

9595
### Options inherited from parent commands

‎docs/docs/references/configuration/cli/trivy_image.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,7 @@ trivy image [flags] IMAGE_NAME
8181
--output-plugin-arg string [EXPERIMENTAL] output plugin arguments
8282
--parallel int number of goroutines enabled for parallel scanning, set 0 to auto-detect parallelism (default 5)
8383
--password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons.
84+
--pkg-types strings comma-separated list of package types (os,library) (default [os,library])
8485
--platform string set platform in the form os/arch if image is multi-platform capable
8586
--podman-host string unix podman socket path to use for podman scanning
8687
--redis-ca string redis ca file location, if using redis as cache backend
@@ -109,7 +110,6 @@ trivy image [flags] IMAGE_NAME
109110
--trace enable more verbose trace output for custom queries
110111
--username strings username. Comma-separated usernames allowed.
111112
--vex string [EXPERIMENTAL] file path to VEX
112-
--vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])
113113
```
114114

115115
### Options inherited from parent commands

‎docs/docs/references/configuration/cli/trivy_kubernetes.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,7 @@ trivy kubernetes [flags] [CONTEXT]
7878
--output-plugin-arg string [EXPERIMENTAL] output plugin arguments
7979
--parallel int number of goroutines enabled for parallel scanning, set 0 to auto-detect parallelism (default 5)
8080
--password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons.
81+
--pkg-types strings comma-separated list of package types (os,library) (default [os,library])
8182
--qps float specify the maximum QPS to the master from this client (default 5)
8283
--redis-ca string redis ca file location, if using redis as cache backend
8384
--redis-cert string redis certificate file location, if using redis as cache backend
@@ -103,7 +104,6 @@ trivy kubernetes [flags] [CONTEXT]
103104
--trace enable more verbose trace output for custom queries
104105
--username strings username. Comma-separated usernames allowed.
105106
--vex string [EXPERIMENTAL] file path to VEX
106-
--vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])
107107
```
108108

109109
### Options inherited from parent commands

‎docs/docs/references/configuration/cli/trivy_repository.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ trivy repository [flags] (REPO_PATH | REPO_URL)
6363
--output-plugin-arg string [EXPERIMENTAL] output plugin arguments
6464
--parallel int number of goroutines enabled for parallel scanning, set 0 to auto-detect parallelism (default 5)
6565
--password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons.
66+
--pkg-types strings comma-separated list of package types (os,library) (default [os,library])
6667
--redis-ca string redis ca file location, if using redis as cache backend
6768
--redis-cert string redis certificate file location, if using redis as cache backend
6869
--redis-key string redis key file location, if using redis as cache backend
@@ -89,7 +90,6 @@ trivy repository [flags] (REPO_PATH | REPO_URL)
8990
--trace enable more verbose trace output for custom queries
9091
--username strings username. Comma-separated usernames allowed.
9192
--vex string [EXPERIMENTAL] file path to VEX
92-
--vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])
9393
```
9494

9595
### Options inherited from parent commands

‎docs/docs/references/configuration/cli/trivy_rootfs.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ trivy rootfs [flags] ROOTDIR
6565
--output-plugin-arg string [EXPERIMENTAL] output plugin arguments
6666
--parallel int number of goroutines enabled for parallel scanning, set 0 to auto-detect parallelism (default 5)
6767
--password strings password. Comma-separated passwords allowed. TRIVY_PASSWORD should be used for security reasons.
68+
--pkg-types strings comma-separated list of package types (os,library) (default [os,library])
6869
--redis-ca string redis ca file location, if using redis as cache backend
6970
--redis-cert string redis certificate file location, if using redis as cache backend
7071
--redis-key string redis key file location, if using redis as cache backend
@@ -90,7 +91,6 @@ trivy rootfs [flags] ROOTDIR
9091
--trace enable more verbose trace output for custom queries
9192
--username strings username. Comma-separated usernames allowed.
9293
--vex string [EXPERIMENTAL] file path to VEX
93-
--vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])
9494
```
9595

9696
### Options inherited from parent commands

‎docs/docs/references/configuration/cli/trivy_sbom.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ trivy sbom [flags] SBOM_PATH
4343
--offline-scan do not issue API requests to identify dependencies
4444
-o, --output string output file name
4545
--output-plugin-arg string [EXPERIMENTAL] output plugin arguments
46+
--pkg-types strings comma-separated list of package types (os,library) (default [os,library])
4647
--redis-ca string redis ca file location, if using redis as cache backend
4748
--redis-cert string redis certificate file location, if using redis as cache backend
4849
--redis-key string redis key file location, if using redis as cache backend
@@ -61,7 +62,6 @@ trivy sbom [flags] SBOM_PATH
6162
--token string for authentication in client/server mode
6263
--token-header string specify a header name for token in client/server mode (default "Trivy-Token")
6364
--vex string [EXPERIMENTAL] file path to VEX
64-
--vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])
6565
```
6666

6767
### Options inherited from parent commands

‎docs/docs/references/configuration/cli/trivy_vm.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ trivy vm [flags] VM_IMAGE
5656
-o, --output string output file name
5757
--output-plugin-arg string [EXPERIMENTAL] output plugin arguments
5858
--parallel int number of goroutines enabled for parallel scanning, set 0 to auto-detect parallelism (default 5)
59+
--pkg-types strings comma-separated list of package types (os,library) (default [os,library])
5960
--redis-ca string redis ca file location, if using redis as cache backend
6061
--redis-cert string redis certificate file location, if using redis as cache backend
6162
--redis-key string redis key file location, if using redis as cache backend
@@ -76,7 +77,6 @@ trivy vm [flags] VM_IMAGE
7677
--token string for authentication in client/server mode
7778
--token-header string specify a header name for token in client/server mode (default "Trivy-Token")
7879
--vex string [EXPERIMENTAL] file path to VEX
79-
--vuln-type strings comma-separated list of vulnerability types (os,library) (default [os,library])
8080
```
8181

8282
### Options inherited from parent commands

‎docs/docs/references/configuration/config-file.md

+7-6
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,13 @@ severity:
8181
- MEDIUM
8282
- HIGH
8383
- CRITICAL
84+
85+
# Same as '--pkg-types'
86+
# Default is 'os,library'
87+
pkg-types:
88+
- os
89+
- library
90+
8491

8592
scan:
8693
# Same as '--compliance'
@@ -261,12 +268,6 @@ Available with vulnerability scanning
261268
262269
```yaml
263270
vulnerability:
264-
# Same as '--vuln-type'
265-
# Default is 'os,library'
266-
type:
267-
- os
268-
- library
269-
270271
# Same as '--ignore-unfixed'
271272
# Default is false
272273
ignore-unfixed: false

‎docs/docs/scanner/vulnerability.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -204,7 +204,7 @@ Other common options are documented [here](../configuration/index.md).
204204

205205
### Enabling a subset of package types
206206
It's possible to only enable certain package types if you prefer.
207-
You can do so by passing the `--vuln-type` option.
207+
You can do so by passing the `--pkg-types` option.
208208
This flag takes a comma-separated list of package types.
209209

210210
Available values:
@@ -215,7 +215,7 @@ Available values:
215215
- Scan language-specific packages (e.g. packages installed by `pip`, `npm`, or `gem`).
216216

217217
```bash
218-
$ trivy image --vuln-type os ruby:2.4.0
218+
$ trivy image --pkg-types os ruby:2.4.0
219219
```
220220

221221

‎pkg/commands/app.go

+3
Original file line numberDiff line numberDiff line change
@@ -512,6 +512,8 @@ func NewConvertCommand(globalFlags *flag.GlobalFlagGroup) *cobra.Command {
512512
ScanFlagGroup: &flag.ScanFlagGroup{},
513513
ReportFlagGroup: flag.NewReportFlagGroup(),
514514
}
515+
convertFlags.ReportFlagGroup.PkgTypes = nil // disable '--pkg-types'
516+
515517
cmd := &cobra.Command{
516518
Use: "convert [flags] RESULT_JSON",
517519
Aliases: []string{"conv"},
@@ -679,6 +681,7 @@ func NewConfigCommand(globalFlags *flag.GlobalFlagGroup) *cobra.Command {
679681
configFlags.ReportFlagGroup.ListAllPkgs = nil // disable '--list-all-pkgs'
680682
configFlags.ReportFlagGroup.ExitOnEOL = nil // disable '--exit-on-eol'
681683
configFlags.ReportFlagGroup.ShowSuppressed = nil // disable '--show-suppressed'
684+
configFlags.ReportFlagGroup.PkgTypes = nil // disable '--pkg-types'
682685
configFlags.ReportFlagGroup.ReportFormat.Usage = "specify a compliance report format for the output" // @TODO: support --report summary for non compliance reports
683686
configFlags.CacheFlagGroup.CacheBackend.Default = string(cache.TypeMemory)
684687

‎pkg/commands/artifact/run.go

+4-4
Original file line numberDiff line numberDiff line change
@@ -201,7 +201,7 @@ func (r *runner) scanFS(ctx context.Context, opts flag.Options) (types.Report, e
201201

202202
func (r *runner) ScanRepository(ctx context.Context, opts flag.Options) (types.Report, error) {
203203
// Do not scan OS packages
204-
opts.VulnType = []string{types.VulnTypeLibrary}
204+
opts.PkgTypes = []string{types.PkgTypeLibrary}
205205

206206
// Disable the OS analyzers, individual package analyzers and SBOM analyzer
207207
opts.DisabledAnalyzers = append(analyzer.TypeIndividualPkgs, analyzer.TypeOSes...)
@@ -405,7 +405,7 @@ func disabledAnalyzers(opts flag.Options) []analyzer.Type {
405405
}
406406

407407
// Do not analyze programming language packages when not running in 'library'
408-
if !slices.Contains(opts.VulnType, types.VulnTypeLibrary) {
408+
if !slices.Contains(opts.PkgTypes, types.PkgTypeLibrary) {
409409
analyzers = append(analyzers, analyzer.TypeLanguages...)
410410
}
411411

@@ -473,7 +473,7 @@ func (r *runner) initScannerConfig(opts flag.Options) (ScannerConfig, types.Scan
473473
}
474474

475475
scanOptions := types.ScanOptions{
476-
VulnType: opts.VulnType,
476+
PkgTypes: opts.PkgTypes,
477477
Scanners: opts.Scanners,
478478
ImageConfigScanners: opts.ImageConfigScanners, // this is valid only for 'image' subcommand
479479
ScanRemovedPackages: opts.ScanRemovedPkgs, // this is valid only for 'image' subcommand
@@ -488,7 +488,7 @@ func (r *runner) initScannerConfig(opts flag.Options) (ScannerConfig, types.Scan
488488

489489
if opts.Scanners.Enabled(types.VulnerabilityScanner) {
490490
log.Info("Vulnerability scanning is enabled")
491-
log.Debug("Vulnerability type", log.Any("type", scanOptions.VulnType))
491+
log.Debug("Package types", log.Any("types", scanOptions.PkgTypes))
492492
}
493493

494494
// ScannerOption is filled only when config scanning is enabled.

‎pkg/flag/report_flags.go

+19
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,20 @@ var (
106106
ConfigName: "scan.show-suppressed",
107107
Usage: "[EXPERIMENTAL] show suppressed vulnerabilities",
108108
}
109+
PkgTypesFlag = Flag[[]string]{
110+
Name: "pkg-types",
111+
ConfigName: "pkg-types",
112+
Default: types.PkgTypes,
113+
Values: types.PkgTypes,
114+
Usage: "comma-separated list of package types",
115+
Aliases: []Alias{
116+
{
117+
Name: "vuln-type",
118+
ConfigName: "vulnerability.type",
119+
Deprecated: true, // --vuln-type was renamed to --pkg-types
120+
},
121+
},
122+
}
109123
)
110124

111125
// ReportFlagGroup composes common printer flag structs
@@ -125,6 +139,7 @@ type ReportFlagGroup struct {
125139
Severity *Flag[[]string]
126140
Compliance *Flag[string]
127141
ShowSuppressed *Flag[bool]
142+
PkgTypes *Flag[[]string]
128143
}
129144

130145
type ReportOptions struct {
@@ -142,6 +157,7 @@ type ReportOptions struct {
142157
Severities []dbTypes.Severity
143158
Compliance spec.ComplianceSpec
144159
ShowSuppressed bool
160+
PkgTypes []string
145161
}
146162

147163
func NewReportFlagGroup() *ReportFlagGroup {
@@ -160,6 +176,7 @@ func NewReportFlagGroup() *ReportFlagGroup {
160176
Severity: SeverityFlag.Clone(),
161177
Compliance: ComplianceFlag.Clone(),
162178
ShowSuppressed: ShowSuppressedFlag.Clone(),
179+
PkgTypes: PkgTypesFlag.Clone(),
163180
}
164181
}
165182

@@ -183,6 +200,7 @@ func (f *ReportFlagGroup) Flags() []Flagger {
183200
f.Severity,
184201
f.Compliance,
185202
f.ShowSuppressed,
203+
f.PkgTypes,
186204
}
187205
}
188206

@@ -252,6 +270,7 @@ func (f *ReportFlagGroup) ToOptions() (ReportOptions, error) {
252270
Severities: toSeverity(f.Severity.Value()),
253271
Compliance: cs,
254272
ShowSuppressed: f.ShowSuppressed.Value(),
273+
PkgTypes: f.PkgTypes.Value(),
255274
}, nil
256275
}
257276

‎pkg/flag/report_flags_test.go

+25
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ func TestReportFlagGroup_ToOptions(t *testing.T) {
3131
severities string
3232
compliance string
3333
debug bool
34+
pkgTypes string
3435
}
3536
tests := []struct {
3637
name string
@@ -159,6 +160,28 @@ func TestReportFlagGroup_ToOptions(t *testing.T) {
159160
Severities: []dbTypes.Severity{dbTypes.SeverityLow},
160161
},
161162
},
163+
{
164+
name: "happy path for OS packages",
165+
fields: fields{
166+
pkgTypes: "os",
167+
},
168+
want: flag.ReportOptions{
169+
PkgTypes: []string{
170+
types.PkgTypeOS,
171+
},
172+
},
173+
},
174+
{
175+
name: "happy path for library packages",
176+
fields: fields{
177+
pkgTypes: "library",
178+
},
179+
want: flag.ReportOptions{
180+
PkgTypes: []string{
181+
types.PkgTypeLibrary,
182+
},
183+
},
184+
},
162185
}
163186
for _, tt := range tests {
164187
t.Run(tt.name, func(t *testing.T) {
@@ -183,6 +206,7 @@ func TestReportFlagGroup_ToOptions(t *testing.T) {
183206
setValue(flag.OutputPluginArgFlag.ConfigName, tt.fields.outputPluginArgs)
184207
setValue(flag.SeverityFlag.ConfigName, tt.fields.severities)
185208
setValue(flag.ComplianceFlag.ConfigName, tt.fields.compliance)
209+
setValue(flag.PkgTypesFlag.ConfigName, tt.fields.pkgTypes)
186210

187211
// Assert options
188212
f := &flag.ReportFlagGroup{
@@ -198,6 +222,7 @@ func TestReportFlagGroup_ToOptions(t *testing.T) {
198222
OutputPluginArg: flag.OutputPluginArgFlag.Clone(),
199223
Severity: flag.SeverityFlag.Clone(),
200224
Compliance: flag.ComplianceFlag.Clone(),
225+
PkgTypes: flag.PkgTypesFlag.Clone(),
201226
}
202227

203228
got, err := f.ToOptions()

‎pkg/flag/vulnerability_flags.go

-19
Original file line numberDiff line numberDiff line change
@@ -5,23 +5,9 @@ import (
55

66
dbTypes "github.com/aquasecurity/trivy-db/pkg/types"
77
"github.com/aquasecurity/trivy/pkg/log"
8-
"github.com/aquasecurity/trivy/pkg/types"
98
)
109

1110
var (
12-
VulnTypeFlag = Flag[[]string]{
13-
Name: "vuln-type",
14-
ConfigName: "vulnerability.type",
15-
Default: []string{
16-
types.VulnTypeOS,
17-
types.VulnTypeLibrary,
18-
},
19-
Values: []string{
20-
types.VulnTypeOS,
21-
types.VulnTypeLibrary,
22-
},
23-
Usage: "comma-separated list of vulnerability types",
24-
}
2511
IgnoreUnfixedFlag = Flag[bool]{
2612
Name: "ignore-unfixed",
2713
ConfigName: "vulnerability.ignore-unfixed",
@@ -42,21 +28,18 @@ var (
4228
)
4329

4430
type VulnerabilityFlagGroup struct {
45-
VulnType *Flag[[]string]
4631
IgnoreUnfixed *Flag[bool]
4732
IgnoreStatus *Flag[[]string]
4833
VEXPath *Flag[string]
4934
}
5035

5136
type VulnerabilityOptions struct {
52-
VulnType []string
5337
IgnoreStatuses []dbTypes.Status
5438
VEXPath string
5539
}
5640

5741
func NewVulnerabilityFlagGroup() *VulnerabilityFlagGroup {
5842
return &VulnerabilityFlagGroup{
59-
VulnType: VulnTypeFlag.Clone(),
6043
IgnoreUnfixed: IgnoreUnfixedFlag.Clone(),
6144
IgnoreStatus: IgnoreStatusFlag.Clone(),
6245
VEXPath: VEXFlag.Clone(),
@@ -69,7 +52,6 @@ func (f *VulnerabilityFlagGroup) Name() string {
6952

7053
func (f *VulnerabilityFlagGroup) Flags() []Flagger {
7154
return []Flagger{
72-
f.VulnType,
7355
f.IgnoreUnfixed,
7456
f.IgnoreStatus,
7557
f.VEXPath,
@@ -105,7 +87,6 @@ func (f *VulnerabilityFlagGroup) ToOptions() (VulnerabilityOptions, error) {
10587
log.Debug("Ignore statuses", log.Any("statuses", ignoreStatuses))
10688

10789
return VulnerabilityOptions{
108-
VulnType: f.VulnType.Value(),
10990
IgnoreStatuses: ignoreStatuses,
11091
VEXPath: f.VEXPath.Value(),
11192
}, nil

0 commit comments

Comments
 (0)
Please sign in to comment.