Nothing Special   »   [go: up one dir, main page]

Page MenuHomePhabricator

Attempt to condense trivy scanning output and avoid false positive exit code
Closed, ResolvedPublic

Description

After merging the initial implementation of our Gitlab pipeline container-scanning solution (T307523, MR), I noticed a couple of issues within our testing repository:

  1. The trivy output can be quite verbose when it finds vulnerabilities (example). Is there a way to make this less verbose? If not, I guess that's ok, as we can still get to the complete output (example), but that's a bit less ideal.
  2. The trivy job seems to be (potentially) returning successful exit codes even when it finds vulnerabilities (example pipeline, example job). I would imagine that if trivy finds any vulnerabilities, we'd want to return a positive exit code? Similar to how all of the other application security includes work?

Event Timeline

mmartorana changed the task status from Open to In Progress.Jun 14 2024, 3:51 PM
mmartorana triaged this task as Medium priority.

Issue number 2 has now successfully been addressed.

As for issue number 1, I couldn't find an effective solution. One option could be to display only high and critical vulnerabilities. However, I prefer keeping the full table in its raw format. What are your thoughts?

As for issue number 1, I couldn't find an effective solution. One option could be to display only high and critical vulnerabilities. However, I prefer keeping the full table in its raw format. What are your thoughts?

If there's no simple approach for this issue, it's probably not worth the effort. The raw output does provide the complete scan results, so I suppose it will be incumbent upon us to train users of this security include.

sbassett moved this task from Backlog to Done on the GitLab-Application-Security-Pipeline board.
sbassett moved this task from Incoming to Our Part Is Done on the Security-Team board.