-
Notifications
You must be signed in to change notification settings - Fork 2.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(report): add support for SPDX #2059
Merged
Merged
Changes from 14 commits
Commits
Show all changes
21 commits
Select commit
Hold shift + click to select a range
8067742
added spdx format support
ShiraCohen33 57a5276
combined spdx and spdx-json to the same case
ShiraCohen33 cede86d
delete vendor folder
ShiraCohen33 4f18de4
added spdx doc
ShiraCohen33 45c97f6
added usage information
ShiraCohen33 fec9bb4
fix conflict
ShiraCohen33 4111f0b
fix error from documentation test
ShiraCohen33 1de6540
added error handling
ShiraCohen33 ed510f0
fix linter
ShiraCohen33 f75604a
changed to SPDX-2.2 version
ShiraCohen33 04b89f1
changed package spdx identifier to hash function
ShiraCohen33 67e94ef
deleted result files
ShiraCohen33 2a292a6
checked return value fo getPackgeID function
ShiraCohen33 8aa0677
refactor: group imports
knqyf263 e2cc6de
fix spdx.md file
ShiraCohen33 2f1c81f
Merge branch 'support-spdx' of https://github.com/ShiraCohen33/trivy …
ShiraCohen33 d334a41
delete replace
ShiraCohen33 7227eb1
fix go.mod
ShiraCohen33 c49450b
refactor: use exp/slices
knqyf263 52c9edb
docs: add SPDX
knqyf263 d2e230c
test(report): fix
knqyf263 File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,297 @@ | ||
| # SPDX | ||
|
|
||
| Trivy generates reports in the [SPDX][spdx] format. | ||
|
|
||
| You can use the regular subcommands (like `image`, `fs` and `rootfs`) and specify `spdx` with the `--format` option. | ||
|
|
||
| ``` | ||
| $ trivy image --format spdx --output result.spdx alpine:3.15 | ||
| ``` | ||
|
|
||
| <details> | ||
| <summary>Result</summary> | ||
|
|
||
| ``` | ||
| $ cat result.spdx | jq . | ||
| SPDXVersion: SPDX-2.2 | ||
| DataLicense: CC0-1.0 | ||
| SPDXID: SPDXRef-DOCUMENT | ||
| DocumentName: alpine:3.15 | ||
| DocumentNamespace: http://aquasecurity.github.io/trivy/container_image/alpine:3.15-bebf6b19-a94c-4e2c-af44-065f63923f48 | ||
| Creator: Organization: aquasecurity | ||
| Creator: Tool: trivy | ||
| Created: 2022-04-28T07:32:57.142806Z | ||
|
|
||
| ##### Package: zlib | ||
|
|
||
| PackageName: zlib | ||
| SPDXID: SPDXRef-12bc938ac028a5e1 | ||
| PackageVersion: 1.2.12-r0 | ||
| FilesAnalyzed: false | ||
| PackageLicenseConcluded: Zlib | ||
| PackageLicenseDeclared: Zlib | ||
|
|
||
| ##### Package: apk-tools | ||
|
|
||
| PackageName: apk-tools | ||
| SPDXID: SPDXRef-26c274652190d87f | ||
| PackageVersion: 2.12.7-r3 | ||
| FilesAnalyzed: false | ||
| PackageLicenseConcluded: GPL-2.0-only | ||
| PackageLicenseDeclared: GPL-2.0-only | ||
|
|
||
| ##### Package: libretls | ||
|
|
||
| PackageName: libretls | ||
| SPDXID: SPDXRef-2b021966d19a8211 | ||
| PackageVersion: 3.3.4-r3 | ||
| FilesAnalyzed: false | ||
| PackageLicenseConcluded: ISC AND (BSD-3-Clause OR MIT) | ||
| PackageLicenseDeclared: ISC AND (BSD-3-Clause OR MIT) | ||
|
|
||
| ##### Package: busybox | ||
|
|
||
| PackageName: busybox | ||
| SPDXID: SPDXRef-317ce3476703f20d | ||
| PackageVersion: 1.34.1-r5 | ||
| FilesAnalyzed: false | ||
| PackageLicenseConcluded: GPL-2.0-only | ||
| PackageLicenseDeclared: GPL-2.0-only | ||
|
|
||
| ##### Package: libcrypto1.1 | ||
|
|
||
| PackageName: libcrypto1.1 | ||
| SPDXID: SPDXRef-34f407fb4dbd67f4 | ||
| PackageVersion: 1.1.1n-r0 | ||
| FilesAnalyzed: false | ||
| PackageLicenseConcluded: OpenSSL | ||
| PackageLicenseDeclared: OpenSSL | ||
|
|
||
| ##### Package: libc-utils | ||
|
|
||
| PackageName: libc-utils | ||
| SPDXID: SPDXRef-4bbc1cb449d54083 | ||
| PackageVersion: 0.7.2-r3 | ||
| FilesAnalyzed: false | ||
| PackageLicenseConcluded: BSD-2-Clause AND BSD-3-Clause | ||
| PackageLicenseDeclared: BSD-2-Clause AND BSD-3-Clause | ||
|
|
||
| ##### Package: alpine-keys | ||
|
|
||
| PackageName: alpine-keys | ||
| SPDXID: SPDXRef-a3bdd174be1456b6 | ||
| PackageVersion: 2.4-r1 | ||
| FilesAnalyzed: false | ||
| PackageLicenseConcluded: MIT | ||
| PackageLicenseDeclared: MIT | ||
|
|
||
| ##### Package: ca-certificates-bundle | ||
|
|
||
| PackageName: ca-certificates-bundle | ||
| SPDXID: SPDXRef-ac6472ba26fb991c | ||
| PackageVersion: 20211220-r0 | ||
| FilesAnalyzed: false | ||
| PackageLicenseConcluded: MPL-2.0 AND MIT | ||
| PackageLicenseDeclared: MPL-2.0 AND MIT | ||
|
|
||
| ##### Package: libssl1.1 | ||
|
|
||
| PackageName: libssl1.1 | ||
| SPDXID: SPDXRef-b2d1b1d70fe90f7d | ||
| PackageVersion: 1.1.1n-r0 | ||
| FilesAnalyzed: false | ||
| PackageLicenseConcluded: OpenSSL | ||
| PackageLicenseDeclared: OpenSSL | ||
|
|
||
| ##### Package: scanelf | ||
|
|
||
| PackageName: scanelf | ||
| SPDXID: SPDXRef-c617077ba6649520 | ||
| PackageVersion: 1.3.3-r0 | ||
| FilesAnalyzed: false | ||
| PackageLicenseConcluded: GPL-2.0-only | ||
| PackageLicenseDeclared: GPL-2.0-only | ||
|
|
||
| ##### Package: musl | ||
|
|
||
| PackageName: musl | ||
| SPDXID: SPDXRef-ca80b810029cde0e | ||
| PackageVersion: 1.2.2-r7 | ||
| FilesAnalyzed: false | ||
| PackageLicenseConcluded: MIT | ||
| PackageLicenseDeclared: MIT | ||
|
|
||
| ##### Package: alpine-baselayout | ||
|
|
||
| PackageName: alpine-baselayout | ||
| SPDXID: SPDXRef-d782e64751ba9faa | ||
| PackageVersion: 3.2.0-r18 | ||
| FilesAnalyzed: false | ||
| PackageLicenseConcluded: GPL-2.0-only | ||
| PackageLicenseDeclared: GPL-2.0-only | ||
|
|
||
| ##### Package: musl-utils | ||
|
|
||
| PackageName: musl-utils | ||
| SPDXID: SPDXRef-e5e8a237f6162e22 | ||
| PackageVersion: 1.2.2-r7 | ||
| FilesAnalyzed: false | ||
| PackageLicenseConcluded: MIT BSD GPL2+ | ||
| PackageLicenseDeclared: MIT BSD GPL2+ | ||
|
|
||
| ##### Package: ssl_client | ||
|
|
||
| PackageName: ssl_client | ||
| SPDXID: SPDXRef-fdf0ce84f6337be4 | ||
| PackageVersion: 1.34.1-r5 | ||
| FilesAnalyzed: false | ||
| PackageLicenseConcluded: GPL-2.0-only | ||
| PackageLicenseDeclared: GPL-2.0-only | ||
| ``` | ||
|
|
||
| </details> | ||
|
|
||
| SPDX-JSON format is also supported by using `spdx-json` with the `--format` option. | ||
|
|
||
| ``` | ||
| $ trivy image --format spdx-json --output result.spdx.json alpine:3.15 | ||
| ``` | ||
|
|
||
| <details> | ||
| <summary>Result</summary> | ||
|
|
||
| ``` | ||
| $ cat result.spdx.json | jq . | ||
| { | ||
| "SPDXID": "SPDXRef-DOCUMENT", | ||
| "creationInfo": { | ||
| "created": "2022-04-28T08:16:55.328255Z", | ||
| "creators": [ | ||
| "Tool: trivy", | ||
| "Organization: aquasecurity" | ||
| ] | ||
| }, | ||
| "dataLicense": "CC0-1.0", | ||
| "documentNamespace": "http://aquasecurity.github.io/trivy/container_image/alpine:3.15-d9549e3a-a4c5-4ee3-8bde-8c78d451fbe7", | ||
| "name": "alpine:3.15", | ||
| "packages": [ | ||
| { | ||
| "SPDXID": "SPDXRef-12bc938ac028a5e1", | ||
| "filesAnalyzed": false, | ||
| "licenseConcluded": "Zlib", | ||
| "licenseDeclared": "Zlib", | ||
| "name": "zlib", | ||
| "versionInfo": "1.2.12-r0" | ||
| }, | ||
| { | ||
| "SPDXID": "SPDXRef-26c274652190d87f", | ||
| "filesAnalyzed": false, | ||
| "licenseConcluded": "GPL-2.0-only", | ||
| "licenseDeclared": "GPL-2.0-only", | ||
| "name": "apk-tools", | ||
| "versionInfo": "2.12.7-r3" | ||
| }, | ||
| { | ||
| "SPDXID": "SPDXRef-2b021966d19a8211", | ||
| "filesAnalyzed": false, | ||
| "licenseConcluded": "ISC AND (BSD-3-Clause OR MIT)", | ||
| "licenseDeclared": "ISC AND (BSD-3-Clause OR MIT)", | ||
| "name": "libretls", | ||
| "versionInfo": "3.3.4-r3" | ||
| }, | ||
| { | ||
| "SPDXID": "SPDXRef-317ce3476703f20d", | ||
| "filesAnalyzed": false, | ||
| "licenseConcluded": "GPL-2.0-only", | ||
| "licenseDeclared": "GPL-2.0-only", | ||
| "name": "busybox", | ||
| "versionInfo": "1.34.1-r5" | ||
| }, | ||
| { | ||
| "SPDXID": "SPDXRef-34f407fb4dbd67f4", | ||
| "filesAnalyzed": false, | ||
| "licenseConcluded": "OpenSSL", | ||
| "licenseDeclared": "OpenSSL", | ||
| "name": "libcrypto1.1", | ||
| "versionInfo": "1.1.1n-r0" | ||
| }, | ||
| { | ||
| "SPDXID": "SPDXRef-4bbc1cb449d54083", | ||
| "filesAnalyzed": false, | ||
| "licenseConcluded": "BSD-2-Clause AND BSD-3-Clause", | ||
| "licenseDeclared": "BSD-2-Clause AND BSD-3-Clause", | ||
| "name": "libc-utils", | ||
| "versionInfo": "0.7.2-r3" | ||
| }, | ||
| { | ||
| "SPDXID": "SPDXRef-a3bdd174be1456b6", | ||
| "filesAnalyzed": false, | ||
| "licenseConcluded": "MIT", | ||
| "licenseDeclared": "MIT", | ||
| "name": "alpine-keys", | ||
| "versionInfo": "2.4-r1" | ||
| }, | ||
| { | ||
| "SPDXID": "SPDXRef-ac6472ba26fb991c", | ||
| "filesAnalyzed": false, | ||
| "licenseConcluded": "MPL-2.0 AND MIT", | ||
| "licenseDeclared": "MPL-2.0 AND MIT", | ||
| "name": "ca-certificates-bundle", | ||
| "versionInfo": "20211220-r0" | ||
| }, | ||
| { | ||
| "SPDXID": "SPDXRef-b2d1b1d70fe90f7d", | ||
| "filesAnalyzed": false, | ||
| "licenseConcluded": "OpenSSL", | ||
| "licenseDeclared": "OpenSSL", | ||
| "name": "libssl1.1", | ||
| "versionInfo": "1.1.1n-r0" | ||
| }, | ||
| { | ||
| "SPDXID": "SPDXRef-c617077ba6649520", | ||
| "filesAnalyzed": false, | ||
| "licenseConcluded": "GPL-2.0-only", | ||
| "licenseDeclared": "GPL-2.0-only", | ||
| "name": "scanelf", | ||
| "versionInfo": "1.3.3-r0" | ||
| }, | ||
| { | ||
| "SPDXID": "SPDXRef-ca80b810029cde0e", | ||
| "filesAnalyzed": false, | ||
| "licenseConcluded": "MIT", | ||
| "licenseDeclared": "MIT", | ||
| "name": "musl", | ||
| "versionInfo": "1.2.2-r7" | ||
| }, | ||
| { | ||
| "SPDXID": "SPDXRef-d782e64751ba9faa", | ||
| "filesAnalyzed": false, | ||
| "licenseConcluded": "GPL-2.0-only", | ||
| "licenseDeclared": "GPL-2.0-only", | ||
| "name": "alpine-baselayout", | ||
| "versionInfo": "3.2.0-r18" | ||
| }, | ||
| { | ||
| "SPDXID": "SPDXRef-e5e8a237f6162e22", | ||
| "filesAnalyzed": false, | ||
| "licenseConcluded": "MIT BSD GPL2+", | ||
| "licenseDeclared": "MIT BSD GPL2+", | ||
| "name": "musl-utils", | ||
| "versionInfo": "1.2.2-r7" | ||
| }, | ||
| { | ||
| "SPDXID": "SPDXRef-fdf0ce84f6337be4", | ||
| "filesAnalyzed": false, | ||
| "licenseConcluded": "GPL-2.0-only", | ||
| "licenseDeclared": "GPL-2.0-only", | ||
| "name": "ssl_client", | ||
| "versionInfo": "1.34.1-r5" | ||
| } | ||
| ], | ||
| "spdxVersion": "SPDX-2.2" | ||
| } | ||
| ``` | ||
|
|
||
| </details> | ||
|
|
||
| [spdx]: https://spdx.dev/wp-content/uploads/sites/41/2020/08/SPDX-specification-2-2.pdf | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is this JSON?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
No, it's a mistake