trivyignore CVE that's not relevant

ssmirr · ssmirr · commit 7de4ef4fd912 · 2024-05-13T13:45:27.000-04:00
Signed-off-by: Samim Mirhosseini &lt;ssmirr@users.noreply.github.com&gt;
diff --git a/.trivyignore b/.trivyignore
@@ -0,0 +1,3 @@
+# not relevant to the way grpc is used in fabconnect
+# see https://github.com/hyperledger/firefly-fabconnect/pull/123#discussion_r1543748524
+GHSA-m425-mq94-257g
diff --git a/Dockerfile b/Dockerfile
@@ -9,11 +9,11 @@ RUN make
 
 FROM alpine:3.19 AS SBOM
 WORKDIR /
-ADD . /SBOM
+COPY . /SBOM
 RUN apk add --no-cache curl
 RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.48.3
 RUN trivy fs --format spdx-json --output /sbom.spdx.json /SBOM
-RUN trivy sbom /sbom.spdx.json --severity UNKNOWN,HIGH,CRITICAL --exit-code 1
+RUN trivy sbom /sbom.spdx.json --severity UNKNOWN,HIGH,CRITICAL --exit-code 1 --ignorefile /SBOM/.trivyignore
 
 FROM alpine:3.19
 WORKDIR /fabconnect

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+# not relevant to the way grpc is used in fabconnect`
	`2`	`+# see https://github.com/hyperledger/firefly-fabconnect/pull/123#discussion_r1543748524`
	`3`	`+GHSA-m425-mq94-257g`