feat(vuln): include pkg identifier on detected vulnerabilities (aquas…

…ecurity#5439) Signed-off-by: juan131 <[email protected]> Signed-off-by: knqyf263 <[email protected]> Co-authored-by: DmitriyLewen <[email protected]> Co-authored-by: DmitriyLewen <[email protected]> Co-authored-by: Nikita Pivkin <[email protected]> Co-authored-by: knqyf263 <[email protected]>
Ericsson · Dec 27, 2023 · 1f0d629 · 1f0d629
1 parent 4cdff0e
commit 1f0d629
Show file tree

Hide file tree

Showing 126 changed files with 4,728 additions and 1,963 deletions.
diff --git a/integration/client_server_test.go b/integration/client_server_test.go
@@ -539,7 +539,7 @@ func TestClientServerWithRedis(t *testing.T) {
 		// Run Trivy client
 		err := execute(osArgs)
 		require.Error(t, err)
-		assert.Contains(t, err.Error(), "connect: connection refused")
+		assert.Contains(t, err.Error(), "unable to store cache")
 	})
 }
 

diff --git a/integration/sbom_test.go b/integration/sbom_test.go
@@ -41,9 +41,15 @@ func TestSBOM(t *testing.T) {
 					{
 						Target: "testdata/fixtures/sbom/centos-7-cyclonedx.json (centos 7.6.1810)",
 						Vulnerabilities: []types.DetectedVulnerability{
-							{PkgRef: "pkg:rpm/centos/[email protected]?arch=x86_64&distro=centos-7.6.1810"},
-							{PkgRef: "pkg:rpm/centos/[email protected]?arch=x86_64&epoch=1&distro=centos-7.6.1810"},
-							{PkgRef: "pkg:rpm/centos/[email protected]?arch=x86_64&epoch=1&distro=centos-7.6.1810"},
+							{
+								PkgRef: "pkg:rpm/centos/[email protected]?arch=x86_64&distro=centos-7.6.1810",
+							},
+							{
+								PkgRef: "pkg:rpm/centos/[email protected]?arch=x86_64&epoch=1&distro=centos-7.6.1810",
+							},
+							{
+								PkgRef: "pkg:rpm/centos/[email protected]?arch=x86_64&epoch=1&distro=centos-7.6.1810",
+							},
 						},
 					},
 				},
@@ -82,9 +88,15 @@ func TestSBOM(t *testing.T) {
 					{
 						Target: "testdata/fixtures/sbom/centos-7-cyclonedx.intoto.jsonl (centos 7.6.1810)",
 						Vulnerabilities: []types.DetectedVulnerability{
-							{PkgRef: "pkg:rpm/centos/[email protected]?arch=x86_64&distro=centos-7.6.1810"},
-							{PkgRef: "pkg:rpm/centos/[email protected]?arch=x86_64&epoch=1&distro=centos-7.6.1810"},
-							{PkgRef: "pkg:rpm/centos/[email protected]?arch=x86_64&epoch=1&distro=centos-7.6.1810"},
+							{
+								PkgRef: "pkg:rpm/centos/[email protected]?arch=x86_64&distro=centos-7.6.1810",
+							},
+							{
+								PkgRef: "pkg:rpm/centos/[email protected]?arch=x86_64&epoch=1&distro=centos-7.6.1810",
+							},
+							{
+								PkgRef: "pkg:rpm/centos/[email protected]?arch=x86_64&epoch=1&distro=centos-7.6.1810",
+							},
 						},
 					},
 				},
@@ -105,9 +117,15 @@ func TestSBOM(t *testing.T) {
 					{
 						Target: "testdata/fixtures/sbom/centos-7-spdx.txt (centos 7.6.1810)",
 						Vulnerabilities: []types.DetectedVulnerability{
-							{PkgRef: "pkg:rpm/centos/[email protected]?arch=x86_64&distro=centos-7.6.1810"},
-							{PkgRef: "pkg:rpm/centos/[email protected]?arch=x86_64&epoch=1&distro=centos-7.6.1810"},
-							{PkgRef: "pkg:rpm/centos/[email protected]?arch=x86_64&epoch=1&distro=centos-7.6.1810"},
+							{
+								PkgRef: "pkg:rpm/centos/[email protected]?arch=x86_64&distro=centos-7.6.1810",
+							},
+							{
+								PkgRef: "pkg:rpm/centos/[email protected]?arch=x86_64&epoch=1&distro=centos-7.6.1810",
+							},
+							{
+								PkgRef: "pkg:rpm/centos/[email protected]?arch=x86_64&epoch=1&distro=centos-7.6.1810",
+							},
 						},
 					},
 				},
@@ -128,9 +146,15 @@ func TestSBOM(t *testing.T) {
 					{
 						Target: "testdata/fixtures/sbom/centos-7-spdx.json (centos 7.6.1810)",
 						Vulnerabilities: []types.DetectedVulnerability{
-							{PkgRef: "pkg:rpm/centos/[email protected]?arch=x86_64&distro=centos-7.6.1810"},
-							{PkgRef: "pkg:rpm/centos/[email protected]?arch=x86_64&epoch=1&distro=centos-7.6.1810"},
-							{PkgRef: "pkg:rpm/centos/[email protected]?arch=x86_64&epoch=1&distro=centos-7.6.1810"},
+							{
+								PkgRef: "pkg:rpm/centos/[email protected]?arch=x86_64&distro=centos-7.6.1810",
+							},
+							{
+								PkgRef: "pkg:rpm/centos/[email protected]?arch=x86_64&epoch=1&distro=centos-7.6.1810",
+							},
+							{
+								PkgRef: "pkg:rpm/centos/[email protected]?arch=x86_64&epoch=1&distro=centos-7.6.1810",
+							},
 						},
 					},
 				},
@@ -200,6 +224,12 @@ func compareSBOMReports(t *testing.T, wantFile, gotFile string, overrideWant typ
 		want.Results[i].Target = result.Target
 		for j, vuln := range result.Vulnerabilities {
 			want.Results[i].Vulnerabilities[j].PkgRef = vuln.PkgRef
+			if vuln.PkgIdentifier.Empty() {
+				continue
+			}
+			want.Results[i].Vulnerabilities[j].PkgIdentifier = ftypes.PkgIdentifier{
+				PURL: vuln.PkgIdentifier.PURL,
+			}
 		}
 	}
 

diff --git a/integration/testdata/almalinux-8.json.golden b/integration/testdata/almalinux-8.json.golden
@@ -56,6 +56,9 @@
           "VulnerabilityID": "CVE-2021-3712",
           "PkgID": "[email protected]_64",
           "PkgName": "openssl-libs",
+          "PkgIdentifier": {
+            "PURL": "pkg:rpm/alma/[email protected]?arch=x86_64\u0026distro=alma-8.5\u0026epoch=1"
+          },
           "InstalledVersion": "1:1.1.1k-4.el8",
           "FixedVersion": "1:1.1.1k-5.el8_5",
           "Status": "fixed",

diff --git a/integration/testdata/alpine-310-registry.json.golden b/integration/testdata/alpine-310-registry.json.golden
@@ -64,6 +64,9 @@
           "VulnerabilityID": "CVE-2019-1549",
           "PkgID": "[email protected]",
           "PkgName": "libcrypto1.1",
+          "PkgIdentifier": {
+            "PURL": "pkg:apk/alpine/[email protected]?arch=x86_64\u0026distro=3.10.2"
+          },
           "InstalledVersion": "1.1.1c-r0",
           "FixedVersion": "1.1.1d-r0",
           "Status": "fixed",
@@ -133,6 +136,9 @@
           "VulnerabilityID": "CVE-2019-1551",
           "PkgID": "[email protected]",
           "PkgName": "libcrypto1.1",
+          "PkgIdentifier": {
+            "PURL": "pkg:apk/alpine/[email protected]?arch=x86_64\u0026distro=3.10.2"
+          },
           "InstalledVersion": "1.1.1c-r0",
           "FixedVersion": "1.1.1d-r2",
           "Status": "fixed",
@@ -212,6 +218,9 @@
           "VulnerabilityID": "CVE-2019-1549",
           "PkgID": "[email protected]",
           "PkgName": "libssl1.1",
+          "PkgIdentifier": {
+            "PURL": "pkg:apk/alpine/[email protected]?arch=x86_64\u0026distro=3.10.2"
+          },
           "InstalledVersion": "1.1.1c-r0",
           "FixedVersion": "1.1.1d-r0",
           "Status": "fixed",
@@ -281,6 +290,9 @@
           "VulnerabilityID": "CVE-2019-1551",
           "PkgID": "[email protected]",
           "PkgName": "libssl1.1",
+          "PkgIdentifier": {
+            "PURL": "pkg:apk/alpine/[email protected]?arch=x86_64\u0026distro=3.10.2"
+          },
           "InstalledVersion": "1.1.1c-r0",
           "FixedVersion": "1.1.1d-r2",
           "Status": "fixed",

diff --git a/integration/testdata/alpine-310.json.golden b/integration/testdata/alpine-310.json.golden
@@ -58,6 +58,9 @@
           "VulnerabilityID": "CVE-2019-1549",
           "PkgID": "[email protected]",
           "PkgName": "libcrypto1.1",
+          "PkgIdentifier": {
+            "PURL": "pkg:apk/alpine/[email protected]?arch=x86_64\u0026distro=3.10.2"
+          },
           "InstalledVersion": "1.1.1c-r0",
           "FixedVersion": "1.1.1d-r0",
           "Status": "fixed",
@@ -127,6 +130,9 @@
           "VulnerabilityID": "CVE-2019-1551",
           "PkgID": "[email protected]",
           "PkgName": "libcrypto1.1",
+          "PkgIdentifier": {
+            "PURL": "pkg:apk/alpine/[email protected]?arch=x86_64\u0026distro=3.10.2"
+          },
           "InstalledVersion": "1.1.1c-r0",
           "FixedVersion": "1.1.1d-r2",
           "Status": "fixed",
@@ -206,6 +212,9 @@
           "VulnerabilityID": "CVE-2019-1549",
           "PkgID": "[email protected]",
           "PkgName": "libssl1.1",
+          "PkgIdentifier": {
+            "PURL": "pkg:apk/alpine/[email protected]?arch=x86_64\u0026distro=3.10.2"
+          },
           "InstalledVersion": "1.1.1c-r0",
           "FixedVersion": "1.1.1d-r0",
           "Status": "fixed",
@@ -275,6 +284,9 @@
           "VulnerabilityID": "CVE-2019-1551",
           "PkgID": "[email protected]",
           "PkgName": "libssl1.1",
+          "PkgIdentifier": {
+            "PURL": "pkg:apk/alpine/[email protected]?arch=x86_64\u0026distro=3.10.2"
+          },
           "InstalledVersion": "1.1.1c-r0",
           "FixedVersion": "1.1.1d-r2",
           "Status": "fixed",

diff --git a/integration/testdata/alpine-39-high-critical.json.golden b/integration/testdata/alpine-39-high-critical.json.golden
@@ -58,6 +58,9 @@
           "VulnerabilityID": "CVE-2019-14697",
           "PkgID": "[email protected]",
           "PkgName": "musl",
+          "PkgIdentifier": {
+            "PURL": "pkg:apk/alpine/[email protected]?arch=x86_64\u0026distro=3.9.4"
+          },
           "InstalledVersion": "1.1.20-r4",
           "FixedVersion": "1.1.20-r5",
           "Status": "fixed",
@@ -100,6 +103,9 @@
           "VulnerabilityID": "CVE-2019-14697",
           "PkgID": "[email protected]",
           "PkgName": "musl-utils",
+          "PkgIdentifier": {
+            "PURL": "pkg:apk/alpine/[email protected]?arch=x86_64\u0026distro=3.9.4"
+          },
           "InstalledVersion": "1.1.20-r4",
           "FixedVersion": "1.1.20-r5",
           "Status": "fixed",

diff --git a/integration/testdata/alpine-39-ignore-cveids.json.golden b/integration/testdata/alpine-39-ignore-cveids.json.golden
@@ -58,6 +58,9 @@
           "VulnerabilityID": "CVE-2019-1551",
           "PkgID": "[email protected]",
           "PkgName": "libcrypto1.1",
+          "PkgIdentifier": {
+            "PURL": "pkg:apk/alpine/[email protected]?arch=x86_64\u0026distro=3.9.4"
+          },
           "InstalledVersion": "1.1.1b-r1",
           "FixedVersion": "1.1.1d-r2",
           "Status": "fixed",
@@ -137,6 +140,9 @@
           "VulnerabilityID": "CVE-2019-1551",
           "PkgID": "[email protected]",
           "PkgName": "libssl1.1",
+          "PkgIdentifier": {
+            "PURL": "pkg:apk/alpine/[email protected]?arch=x86_64\u0026distro=3.9.4"
+          },
           "InstalledVersion": "1.1.1b-r1",
           "FixedVersion": "1.1.1d-r2",
           "Status": "fixed",

diff --git a/integration/testdata/alpine-39.json.golden b/integration/testdata/alpine-39.json.golden
@@ -58,6 +58,9 @@
           "VulnerabilityID": "CVE-2019-1549",
           "PkgID": "[email protected]",
           "PkgName": "libcrypto1.1",
+          "PkgIdentifier": {
+            "PURL": "pkg:apk/alpine/[email protected]?arch=x86_64\u0026distro=3.9.4"
+          },
           "InstalledVersion": "1.1.1b-r1",
           "FixedVersion": "1.1.1d-r0",
           "Status": "fixed",
@@ -127,6 +130,9 @@
           "VulnerabilityID": "CVE-2019-1551",
           "PkgID": "[email protected]",
           "PkgName": "libcrypto1.1",
+          "PkgIdentifier": {
+            "PURL": "pkg:apk/alpine/[email protected]?arch=x86_64\u0026distro=3.9.4"
+          },
           "InstalledVersion": "1.1.1b-r1",
           "FixedVersion": "1.1.1d-r2",
           "Status": "fixed",
@@ -206,6 +212,9 @@
           "VulnerabilityID": "CVE-2019-1549",
           "PkgID": "[email protected]",
           "PkgName": "libssl1.1",
+          "PkgIdentifier": {
+            "PURL": "pkg:apk/alpine/[email protected]?arch=x86_64\u0026distro=3.9.4"
+          },
           "InstalledVersion": "1.1.1b-r1",
           "FixedVersion": "1.1.1d-r0",
           "Status": "fixed",
@@ -275,6 +284,9 @@
           "VulnerabilityID": "CVE-2019-1551",
           "PkgID": "[email protected]",
           "PkgName": "libssl1.1",
+          "PkgIdentifier": {
+            "PURL": "pkg:apk/alpine/[email protected]?arch=x86_64\u0026distro=3.9.4"
+          },
           "InstalledVersion": "1.1.1b-r1",
           "FixedVersion": "1.1.1d-r2",
           "Status": "fixed",
@@ -354,6 +366,9 @@
           "VulnerabilityID": "CVE-2019-14697",
           "PkgID": "[email protected]",
           "PkgName": "musl",
+          "PkgIdentifier": {
+            "PURL": "pkg:apk/alpine/[email protected]?arch=x86_64\u0026distro=3.9.4"
+          },
           "InstalledVersion": "1.1.20-r4",
           "FixedVersion": "1.1.20-r5",
           "Status": "fixed",
@@ -396,6 +411,9 @@
           "VulnerabilityID": "CVE-2019-14697",
           "PkgID": "[email protected]",
           "PkgName": "musl-utils",
+          "PkgIdentifier": {
+            "PURL": "pkg:apk/alpine/[email protected]?arch=x86_64\u0026distro=3.9.4"
+          },
           "InstalledVersion": "1.1.20-r4",
           "FixedVersion": "1.1.20-r5",
           "Status": "fixed",

diff --git a/integration/testdata/alpine-distroless.json.golden b/integration/testdata/alpine-distroless.json.golden
@@ -53,6 +53,9 @@
           "VulnerabilityID": "CVE-2022-24765",
           "PkgID": "[email protected]",
           "PkgName": "git",
+          "PkgIdentifier": {
+            "PURL": "pkg:apk/alpine/[email protected]?arch=x86_64\u0026distro=3.16"
+          },
           "InstalledVersion": "2.35.1-r2",
           "FixedVersion": "2.35.2-r0",
           "Status": "fixed",

diff --git a/integration/testdata/amazon-1.json.golden b/integration/testdata/amazon-1.json.golden
@@ -57,6 +57,9 @@
           "VulnerabilityID": "CVE-2019-5481",
           "PkgID": "[email protected]_64",
           "PkgName": "curl",
+          "PkgIdentifier": {
+            "PURL": "pkg:rpm/amazon/[email protected]?arch=x86_64\u0026distro=amazon-AMI+release+2018.03"
+          },
           "InstalledVersion": "7.61.1-11.91.amzn1",
           "FixedVersion": "7.61.1-12.93.amzn1",
           "Status": "fixed",

diff --git a/integration/testdata/amazon-2.json.golden b/integration/testdata/amazon-2.json.golden
@@ -57,6 +57,9 @@
           "VulnerabilityID": "CVE-2019-5481",
           "PkgID": "[email protected]_64",
           "PkgName": "curl",
+          "PkgIdentifier": {
+            "PURL": "pkg:rpm/amazon/[email protected]?arch=x86_64\u0026distro=amazon-2+%28Karoo%29"
+          },
           "InstalledVersion": "7.61.1-9.amzn2.0.1",
           "FixedVersion": "7.61.1-12.amzn2.0.1",
           "Status": "fixed",
@@ -125,6 +128,9 @@
           "VulnerabilityID": "CVE-2019-5436",
           "PkgID": "[email protected]_64",
           "PkgName": "curl",
+          "PkgIdentifier": {
+            "PURL": "pkg:rpm/amazon/[email protected]?arch=x86_64\u0026distro=amazon-2+%28Karoo%29"
+          },
           "InstalledVersion": "7.61.1-9.amzn2.0.1",
           "FixedVersion": "7.61.1-11.amzn2.0.2",
           "Status": "fixed",

diff --git a/integration/testdata/amazonlinux2-gp2-x86-vm.json.golden b/integration/testdata/amazonlinux2-gp2-x86-vm.json.golden
@@ -29,6 +29,9 @@
           "VulnerabilityID": "CVE-2022-38177",
           "PkgID": "[email protected]_64",
           "PkgName": "bind-export-libs",
+          "PkgIdentifier": {
+            "PURL": "pkg:rpm/amazon/[email protected]?arch=x86_64\u0026distro=amazon-2+%28Karoo%29\u0026epoch=32"
+          },
           "InstalledVersion": "32:9.11.4-26.P2.amzn2.5.2",
           "FixedVersion": "99:9.11.4-26.P2.amzn2.13",
           "Status": "fixed",

diff --git a/integration/testdata/busybox-with-lockfile.json.golden b/integration/testdata/busybox-with-lockfile.json.golden
@@ -57,6 +57,9 @@
           "VulnerabilityID": "CVE-2019-15542",
           "PkgID": "[email protected]",
           "PkgName": "ammonia",
+          "PkgIdentifier": {
+            "PURL": "pkg:cargo/[email protected]"
+          },
           "InstalledVersion": "1.9.0",
           "FixedVersion": "\u003e= 2.1.0",
           "Status": "fixed",
@@ -99,6 +102,9 @@
           "VulnerabilityID": "CVE-2021-38193",
           "PkgID": "[email protected]",
           "PkgName": "ammonia",
+          "PkgIdentifier": {
+            "PURL": "pkg:cargo/[email protected]"
+          },
           "InstalledVersion": "1.9.0",
           "FixedVersion": "\u003e= 3.1.0, \u003e= 2.1.3, \u003c 3.0.0",
           "Status": "fixed",

diff --git a/integration/testdata/centos-6.json.golden b/integration/testdata/centos-6.json.golden
@@ -79,6 +79,9 @@
           "VulnerabilityID": "CVE-2020-29573",
           "PkgID": "[email protected]_64",
           "PkgName": "glibc",
+          "PkgIdentifier": {
+            "PURL": "pkg:rpm/centos/[email protected]?arch=x86_64\u0026distro=centos-6.10"
+          },
           "InstalledVersion": "2.12-1.212.el6",
           "Status": "end_of_life",
           "Layer": {
@@ -132,6 +135,9 @@
           ],
           "PkgID": "[email protected]_64",
           "PkgName": "openssl",
+          "PkgIdentifier": {
+            "PURL": "pkg:rpm/centos/[email protected]?arch=x86_64\u0026distro=centos-6.10"
+          },
           "InstalledVersion": "1.0.1e-57.el6",
           "FixedVersion": "1.0.1e-58.el6_10",
           "Status": "fixed",

diff --git a/integration/testdata/centos-7-ignore-unfixed.json.golden b/integration/testdata/centos-7-ignore-unfixed.json.golden
@@ -72,6 +72,9 @@
           ],
           "PkgID": "[email protected]_64",
           "PkgName": "openssl-libs",
+          "PkgIdentifier": {
+            "PURL": "pkg:rpm/centos/[email protected]?arch=x86_64\u0026distro=centos-7.6.1810\u0026epoch=1"
+          },
           "InstalledVersion": "1:1.0.2k-16.el7",
           "FixedVersion": "1:1.0.2k-19.el7",
           "Status": "fixed",
@@ -162,6 +165,9 @@
           ],
           "PkgID": "[email protected]_64",
           "PkgName": "openssl-libs",
+          "PkgIdentifier": {
+            "PURL": "pkg:rpm/centos/[email protected]?arch=x86_64\u0026distro=centos-7.6.1810\u0026epoch=1"
+          },
           "InstalledVersion": "1:1.0.2k-16.el7",
           "FixedVersion": "1:1.0.2k-19.el7",
           "Status": "fixed",