chore: add VEX document and generator for Trivy #7128

knqyf263 · 2024-07-09T07:55:37Z

Overview

This PR introduces an OpenVEX generator for Trivy. This tool generates OpenVEX with govulnchedk to reduce false positives in vulnerability scanning by explicitly declaring "not_affected" statements for vulnerabilities that do not impact Trivy.

Key Features

Generates OpenVEX documents for Trivy versions v0.40.0 and later and combine them
Focuses solely on "not_affected" statements to address false positives, not "fixed" and "affected"
Optimizes VEX representation by omitting version information for vulnerabilities that are "not_affected" across all versions

I chose v0.40.0, not for any particular reason, but because it is old enough that I thought many users would be using a newer version than that.

Implementation Details

The script clones or updates the Trivy repository
It retrieves and processes tags (versions) starting from v0.40.0
For each tag, it runs govulncheck to generate VEX documents
The generated VEX documents are then combined and optimized

Addressing govulncheck Limitations

The current version of govulncheck (v1.1.2) has some limitations:

To overcome these issues, our script:

Fills in the correct product information by our script
Uses the JSON format (govulncheck -format json) in conjunction with OpenVEX to gather additional data, such as subcomponents
Determines the actual "not_affected" status by combining information from both formats

This will improve as more features are added to govulncheck.

Optimization Strategy

While it's possible for a vulnerability to be "affected" in one version and "not_affected" in another, let's say Trivy v0.50.0 uses a vulnerable function, Solver.Solve in moby/buildkit, but stop using the function in v0.51.0, I assume this is relatively rare. Therefore, for vulnerabilities that are "not_affected" and "fixed" across all versions from v0.40.0 onwards, we declare them as "not_affected" for all Trivy versions by omitting the version in the product PURL. The product ID would be pkg:golang/github.com/aquasecurity/trivy rather than ``pkg:golang/github.com/aquasecurity/[email protected]`.

Please refer to the committed OpenVEX file in this PR for concrete examples of the generated output.

Next Steps

Automate the process with GitHub Actions
Consider expanding coverage to versions prior to v0.40.0 if deemed necessary

Checklist

I've read the guidelines for contributing to this repository.
I've followed the conventions in the PR title.
I've added tests that prove my fix is effective or that my feature works.
I've updated the documentation with the relevant information (if needed).
I've added usage information (if the PR introduces new options)
I've included a "before" and "after" example to the description (if the PR is a user interface change).

Signed-off-by: knqyf263 <[email protected]>

misc/vex/vex.go

nikpivkin · 2024-07-09T10:30:59Z

Why is the file vex.go in misc and not in magefiles?

knqyf263 · 2024-07-09T11:19:50Z

Why is the file vex.go in misc and not in magefiles?

Yeah, it's better to put it in magefiles. I didn't mean to commit this file at the beginning, and I found some issues in govuncheck. After all, the script is not small anymore and I committed it. I didn't carefully think about the script. I'll move it.

Signed-off-by: knqyf263 <[email protected]>

knqyf263 · 2024-07-09T11:30:06Z

Why is the file vex.go in misc and not in magefiles?

Moved
527b033

nikpivkin · 2024-07-09T14:25:55Z

magefiles/vex.go

+			Author:    "Aqua Security",
+			Timestamp: lo.ToPtr(time.Now()),
+			Version:   doc.Version + 1,
+			Tooling:   "https://github.com/aquasecurity/trivy/tree/main/misc/vex/vex.go",


This should be updated

Suggested change

Tooling: "https://github.com/aquasecurity/trivy/tree/main/misc/vex/vex.go",

Tooling: "https://github.com/aquasecurity/trivy/tree/main/magefiles/vex.go",

Thanks. I also updated the field in the VEX file. @id should be re-calculated technically, but I believe it doesn't matter.
edfc903

Co-authored-by: Nikita Pivkin <[email protected]>

Signed-off-by: knqyf263 <[email protected]>

DmitriyLewen · 2024-07-10T04:58:25Z

magefiles/magefile.go

+func VEX(_ context.Context, dir string) error {
+	return sh.RunWith(ENV, "go", "run", "-tags=mage_vex", "./magefiles/vex.go", "--dir", dir)
+}


what about output flag?

We probably don't need the output flag because the VEX file should be written under .vex/. I added it for local debugging, though.

All arguments are mandatory and must be specified in the order they appear in the function.

All arguments are mandatory in Mage.
https://magefile.org/targets/

It means we have to specify .vex/vex.json every time.

magefiles/vex.go

DmitriyLewen

LGTM

Signed-off-by: knqyf263 <[email protected]>

Signed-off-by: knqyf263 <[email protected]> Co-authored-by: Nikita Pivkin <[email protected]>

knqyf263 added 7 commits July 9, 2024 11:03

chore: add a script to generate OpenVEX for Trivy

6488885

Signed-off-by: knqyf263 <[email protected]>

feat: import x/vuln

cde49b7

Signed-off-by: knqyf263 <[email protected]>

feat: aggregate product versions

99ce6cb

Signed-off-by: knqyf263 <[email protected]>

refactor: add comments

bafde61

Signed-off-by: knqyf263 <[email protected]>

feat: set minimum version

3a3c62c

Signed-off-by: knqyf263 <[email protected]>

chore: add a OpenVEX document

fee9b98

Signed-off-by: knqyf263 <[email protected]>

feat: sort statements

478a7c9

Signed-off-by: knqyf263 <[email protected]>

knqyf263 requested a review from DmitriyLewen July 9, 2024 07:55

knqyf263 self-assigned this Jul 9, 2024

knqyf263 changed the title ~~chore: add VEX generator and a document for Trivy~~ chore: add VEX document and generator for Trivy Jul 9, 2024

knqyf263 marked this pull request as ready for review July 9, 2024 08:01

fix: lint errors

a451b96

Signed-off-by: knqyf263 <[email protected]>

DmitriyLewen reviewed Jul 9, 2024

View reviewed changes

misc/vex/vex.go Outdated Show resolved Hide resolved

misc/vex/vex.go Outdated Show resolved Hide resolved

misc/vex/vex.go Outdated Show resolved Hide resolved

knqyf263 added 3 commits July 9, 2024 15:27

chore: move to magefiles

527b033

Signed-off-by: knqyf263 <[email protected]>

fix: delete unneeded file save

c8b6fe2

Signed-off-by: knqyf263 <[email protected]>

fix: increase timeout

46e0efa

Signed-off-by: knqyf263 <[email protected]>

nikpivkin reviewed Jul 9, 2024

View reviewed changes

Update magefiles/vex.go

07c5f24

Co-authored-by: Nikita Pivkin <[email protected]>

knqyf263 mentioned this pull request Jul 9, 2024

x/vuln: improve OpenVEX status output for fixed vulnerabilities golang/go#68338

Closed

chore: update vex

edfc903

Signed-off-by: knqyf263 <[email protected]>

nikpivkin approved these changes Jul 10, 2024

View reviewed changes

DmitriyLewen reviewed Jul 10, 2024

View reviewed changes

DmitriyLewen approved these changes Jul 10, 2024

View reviewed changes

fix: use name only

c4d55ea

Signed-off-by: knqyf263 <[email protected]>

knqyf263 enabled auto-merge July 10, 2024 06:01

knqyf263 added this pull request to the merge queue Jul 10, 2024

Merged via the queue into aquasecurity:main with commit d2f4da8 Jul 10, 2024
12 checks passed

knqyf263 deleted the chore/gen_vex branch July 10, 2024 06:42

knqyf263 mentioned this pull request Jul 10, 2024

chore: add VEX for Trivy images #7140

Merged

6 tasks

skahn007gl pushed a commit to skahn007gl/trivy that referenced this pull request Jul 23, 2024

chore: add VEX document and generator for Trivy (aquasecurity#7128)

b6dd679

Signed-off-by: knqyf263 <[email protected]> Co-authored-by: Nikita Pivkin <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: add VEX document and generator for Trivy #7128

chore: add VEX document and generator for Trivy #7128

knqyf263 commented Jul 9, 2024

nikpivkin commented Jul 9, 2024

knqyf263 commented Jul 9, 2024 •

edited

Loading

knqyf263 commented Jul 9, 2024

nikpivkin Jul 9, 2024 •

edited

Loading

knqyf263 Jul 9, 2024

DmitriyLewen Jul 10, 2024

knqyf263 Jul 10, 2024

knqyf263 Jul 10, 2024

DmitriyLewen left a comment

	Tooling: "https://github.com/aquasecurity/trivy/tree/main/misc/vex/vex.go",
	Tooling: "https://github.com/aquasecurity/trivy/tree/main/magefiles/vex.go",

chore: add VEX document and generator for Trivy #7128

chore: add VEX document and generator for Trivy #7128

Conversation

knqyf263 commented Jul 9, 2024

Overview

Key Features

Implementation Details

Addressing govulncheck Limitations

Optimization Strategy

Next Steps

Checklist

nikpivkin commented Jul 9, 2024

knqyf263 commented Jul 9, 2024 • edited Loading

knqyf263 commented Jul 9, 2024

nikpivkin Jul 9, 2024 • edited Loading

Choose a reason for hiding this comment

knqyf263 Jul 9, 2024

Choose a reason for hiding this comment

DmitriyLewen Jul 10, 2024

Choose a reason for hiding this comment

knqyf263 Jul 10, 2024

Choose a reason for hiding this comment

knqyf263 Jul 10, 2024

Choose a reason for hiding this comment

DmitriyLewen left a comment

Choose a reason for hiding this comment

knqyf263 commented Jul 9, 2024 •

edited

Loading

nikpivkin Jul 9, 2024 •

edited

Loading