v0.35.0

[aqua-bot]

🚀 What's new? 🚀

💿 AMI/EBS scanning 🏆

Trivy now scans AWS AMI images and EBS snapshots. You just need to specify your AMI ID with the ami: prefix.

$ trivy vm --security-checks vuln ami:ami-0123456789abcdefg
2022-11-24T21:06:23.516Z        INFO    Vulnerability scanning is enabled
2022-11-24T21:06:23.653Z        INFO    Snapshot snap-0123456789abcdefg found
2022-11-24T21:08:51.979Z        INFO    Detected OS: amazon
2022-11-24T21:08:51.979Z        INFO    Detecting Amazon Linux vulnerabilities...
2022-11-24T21:08:51.991Z        INFO    Number of language-specific files: 0

ami-0123456789abcdefg (amazon 2 (Karoo))
========================================
Total: 5 (UNKNOWN: 0, LOW: 0, MEDIUM: 3, HIGH: 2, CRITICAL: 0)

Note: Public AMI images are not supported due to the limitation of AWS API. See the AWS document for the detail.

You can also directly scan EBS snapshots.

$ trivy vm --security-checks vuln ebs:snapshot-0123456789abcdefg
2022-11-24T21:06:23.516Z        INFO    Vulnerability scanning is enabled
2022-11-24T21:08:51.979Z        INFO    Detected OS: amazon
2022-11-24T21:08:51.979Z        INFO    Detecting Amazon Linux vulnerabilities...
2022-11-24T21:08:51.991Z        INFO    Number of language-specific files: 0

snapshot-0123456789abcdefg (amazon 2 (Karoo))
========================================
Total: 5 (UNKNOWN: 0, LOW: 0, MEDIUM: 3, HIGH: 2, CRITICAL: 0)

Note: Public EBS snapshots are not supported due to the limitation of AWS API. See the AWS document for the detail.

⚠️ EXPERIMENTAL: AMI/EBS scanning is still experimental. This feature might change without preserving backward compatibility.

🐢 Slow scanning mode 🐜

--slow tries to use less CPU/memory for scanning though it takes more time than normal scanning. It fits small-footprint environments. The flag is unnecessary in most cases.

$ trivy image --slow alpine:3.15

🍡 Scan image digests in containerd 🍾

$ trivy image sha256:4dca0fd5f424a31b03ab807cbae77eb32bf2d089eed1cee154b3afed458de0dc

Thanks to @pmengelbert

🧾 Custom compliance reports ☑️

User can now use Trivy to scan your Kubernetes cluster with custom compliance report define by the user.
spec format should look like this:

---
spec:
  id: "0001" # report unique identifier
  title: nsa # report title 
  description: National Security Agency - Kubernetes Hardening Guidance # description of the report
  relatedResources :
    - https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/ # reference is related to public or internal spec
  version: "1.0" # spec version
  controls:
    - name: Non-root containers # short control naming
      description: 'Check that container is not running as root' # long control description
      id: '1.0' # control identifier 
      checks:   # list of trivy checks which associated to control
        - id: AVD-KSV-0012 # check ID (midconfiguration ot vulnerability) must start with `AVD-` or `CVE-` 
      severity: 'MEDIUM' # control severity
    - name: Immutable container file systems
      description: 'Check that container root file system is immutable'
      id: '1.1'
      checks:
        - id: AVD-KSV-0014
      severity: 'LOW'

In order to create it use the --compliance=@/spec/my_complaince.yaml flag.

Example:

$ trivy k8s cluster --compliance=@/spec/my_complaince.yaml --report summary

For more details here: compliance reports

🐛 Bug fixes 🐞

• 6ab9380 fix(suse): use package name to get advisories (fix(suse): use package name to get advisories #3199)
• 861bc03 fix(vuln): add package name to title (fix(vuln): add package name to title #3183)
• f115895 fix: present control status instead of compliance percentage in compliance report (fix: present control status instead of compliance percentage in compliance report #3181)
• a0033f6 fix: workdir command as empty layer (fix: workdir command as empty layer #3087)
• 8fb9d31 fix: Perform filepath.Clean first and then filepath.ToSlash for skipFile/skipDirs settings (fix: Perform filepath.Clean first and then filepath.ToSlash for skipFile/skipDirs settings #3144)
• 6da148c fix(spdx): rename describes field in spdx (fix(spdx): rename describes field in spdx #3102)
• 3b6d7d8 fix(cli): exclude --compliance flag from non supported sub-commands (fix: exclude --compliance flag from non supported sub-commands #3158)
• e9a2549 fix: remove --security-checks none from image help (fix: remove --security-checks none from image help #3156)
• 3aa1912 fix: compliance flag description (fix: update compliance flag description #3160)

---

This discussion was created from the release v0.35.0.