feat(db): Add dbRepository flag to get advisory database from OCI registry

docs/vulnerability/examples/db.md

@@ -36,3 +36,10 @@ This is useful to initialize workers in Continuous Integration systems.
 ```
 $ trivy image --download-db-only
 ```
+
+## DB Repository
+`Trivy` could also download the vulnerability database from an external OCI registry by using `--db-repository` option.
+
+```
+$ trivy image --db-repository registry.gitlab.com/gitlab-org/security-products/dependencies/trivy-db
+```

pkg/commands/app.go

@@ -325,6 +325,13 @@ var (
 		EnvVars: []string{"TRIVY_CUSTOM_HEADERS"},
 	}
 
+	dbRepositoryFlag = cli.StringFlag{
+		Name:    "db-repository",
+		Usage:   "OCI repository to retrieve trivy-db from",
+		Value:   "ghcr.io/aquasecurity/trivy-db",
+		EnvVars: []string{"TRIVY_DB_REPOSITORY"},
+	}
+
 	// Global flags
 	globalFlags = []cli.Flag{
 		&quietFlag,
@@ -447,6 +454,7 @@ func NewImageCommand() *cli.Command {
 			&redisBackendKey,
 			&offlineScan,
 			&insecureFlag,
+			&dbRepositoryFlag,
 			stringSliceFlag(skipFiles),
 			stringSliceFlag(skipDirs),
 		},
@@ -483,6 +491,7 @@ func NewFilesystemCommand() *cli.Command {
 			&ignorePolicy,
 			&listAllPackages,
 			&offlineScan,
+			&dbRepositoryFlag,
 			stringSliceFlag(skipFiles),
 			stringSliceFlag(skipDirs),
 

pkg/commands/artifact/run.go

@@ -151,7 +151,7 @@ func initCache(c Option) (cache.Cache, error) {
 func initDB(c Option) error {
 	// download the database file
 	noProgress := c.Quiet || c.NoProgress
-	if err := operation.DownloadDB(c.AppVersion, c.CacheDir, noProgress, c.SkipDBUpdate); err != nil {
+	if err := operation.DownloadDB(c.AppVersion, c.CacheDir, c.DBRepository, noProgress, c.SkipDBUpdate); err != nil {
 		return err
 	}
 

pkg/commands/operation/operation.go

@@ -95,8 +95,8 @@ func (c Cache) ClearArtifacts() error {
 }
 
 // DownloadDB downloads the DB
-func DownloadDB(appVersion, cacheDir string, quiet, skipUpdate bool) error {
-	client := db.NewClient(cacheDir, quiet)
+func DownloadDB(appVersion, cacheDir, dbRepository string, quiet, skipUpdate bool) error {
+	client := db.NewClient(cacheDir, quiet, db.WithDBRepository(dbRepository))
 	ctx := context.Background()
 	needsUpdate, err := client.NeedsUpdate(appVersion, skipUpdate)
 	if err != nil {
@@ -106,6 +106,7 @@ func DownloadDB(appVersion, cacheDir string, quiet, skipUpdate bool) error {
 	if needsUpdate {
 		log.Logger.Info("Need to update DB")
 		log.Logger.Info("Downloading DB...")
+		log.Logger.Infof("Repository: %s", dbRepository)
 		if err = client.Download(ctx, cacheDir); err != nil {
 			return xerrors.Errorf("failed to download vulnerability DB: %w", err)
 		}

pkg/commands/option/db.go

@@ -14,6 +14,7 @@ type DBOption struct {
 	SkipDBUpdate   bool
 	Light          bool
 	NoProgress     bool
+	DBRepository   string
 }
 
 // NewDBOption is the factory method to return the DBOption
@@ -24,6 +25,7 @@ func NewDBOption(c *cli.Context) DBOption {
 		SkipDBUpdate:   c.Bool("skip-db-update"),
 		Light:          c.Bool("light"),
 		NoProgress:     c.Bool("no-progress"),
+		DBRepository:   c.String("db-repository"),
 	}
 }
 

pkg/commands/server/run.go

@@ -40,7 +40,7 @@ func run(c Config) (err error) {
 	}
 
 	// download the database file
-	if err = operation.DownloadDB(c.AppVersion, c.CacheDir, true, c.SkipDBUpdate); err != nil {
+	if err = operation.DownloadDB(c.AppVersion, c.CacheDir, c.DBRepository, true, c.SkipDBUpdate); err != nil {
 		return err
 	}
 

pkg/db/db.go

@@ -15,10 +15,7 @@ import (
 	"github.com/aquasecurity/trivy/pkg/log"
 )
 
-const (
-	dbRepository = "ghcr.io/aquasecurity/trivy-db"
-	dbMediaType  = "application/vnd.aquasec.trivy.db.layer.v1.tar+gzip"
-)
+const dbMediaType = "application/vnd.aquasec.trivy.db.layer.v1.tar+gzip"
 
 // Operation defines the DB operations
 type Operation interface {
@@ -27,8 +24,9 @@ type Operation interface {
 }
 
 type options struct {
-	artifact *oci.Artifact
-	clock    clock.Clock
+	artifact     *oci.Artifact
+	clock        clock.Clock
+	dbRepository string
 }
 
 // Option is a functional option
@@ -41,6 +39,15 @@ func WithOCIArtifact(art *oci.Artifact) Option {
 	}
 }
 
+
+// WithDBRepository takes a dbRepository
+func WithDBRepository(dbRepository string) Option {
+	return func(opts *options) {
+		opts.dbRepository = dbRepository
+	}
+}
+
+
 // WithClock takes a clock
 func WithClock(clock clock.Clock) Option {
 	return func(opts *options) {
@@ -138,7 +145,7 @@ func (c *Client) Download(ctx context.Context, dst string) error {
 		log.Logger.Debug("no metadata file")
 	}
 
-	if err := c.populateOCIArtifact(); err != nil {
+	if err := c.populateOCIArtifact(c.dbRepository); err != nil {
 		return xerrors.Errorf("OCI artifact error: %w", err)
 	}
 
@@ -171,7 +178,7 @@ func (c *Client) updateDownloadedAt(dst string) error {
 	return nil
 }
 
-func (c *Client) populateOCIArtifact() error {
+func (c *Client) populateOCIArtifact(dbRepository string) error {
 	if c.artifact == nil {
 		repo := fmt.Sprintf("%s:%d", dbRepository, db.SchemaVersion)
 		art, err := oci.NewArtifact(repo, dbMediaType, c.quiet)

pkg/db/db_test.go

@@ -197,6 +197,7 @@ func TestClient_Download(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			cacheDir := t.TempDir()
+			dbRepository := "ghcr.io/aquasecurity/trivy-db"
 
 			// Mock image
 			img := new(fakei.FakeImage)
@@ -206,7 +207,7 @@ func TestClient_Download(t *testing.T) {
 			art, err := oci.NewArtifact("db", mediaType, true, oci.WithImage(img))
 			require.NoError(t, err)
 
-			client := db.NewClient(cacheDir, true, db.WithOCIArtifact(art), db.WithClock(timeDownloadedAt))
+			client := db.NewClient(cacheDir, true, db.WithOCIArtifact(art), db.WithClock(timeDownloadedAt), db.WithDBRepository(dbRepository))
 			err = client.Download(context.Background(), cacheDir)
 			if tt.wantErr != "" {
 				require.Error(t, err)

pkg/rpc/server/listen.go

@@ -23,6 +23,7 @@ import (
 )
 
 const updateInterval = 1 * time.Hour
+const dbRepository = "ghcr.io/aquasecurity/trivy-db"
 
 // Server represents Trivy server
 type Server struct {
@@ -50,7 +51,7 @@ func (s Server) ListenAndServe(serverCache cache.Cache) error {
 	dbUpdateWg := &sync.WaitGroup{}
 
 	go func() {
-		worker := newDBWorker(dbc.NewClient(s.cacheDir, true))
+		worker := newDBWorker(dbc.NewClient(s.cacheDir, true, dbc.WithDBRepository(dbRepository)))
 		ctx := context.Background()
 		for {
 			time.Sleep(updateInterval)