forked from aquasecurity/trivy
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(rust): add dependency graph from Rust binaries (aquasecurity#2771)
- Loading branch information
Showing
4 changed files
with
15 additions
and
10 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -15,7 +15,10 @@ Modern software development relies on the use of third-party libraries. | |
| Third-party dependencies also depend on others so a list of dependencies can be represented as a dependency graph. | ||
| In some cases, vulnerable dependencies are not linked directly, and it requires analyses of the tree. | ||
| To make this task simpler Trivy can show a dependency origin tree with the `--dependency-tree` flag. | ||
| This flag is only available with the `fs` or `repo` commands and the `--format table` flag. | ||
| This flag is only available with the `--format table` flag. | ||
|
|
||
| !!! note | ||
| Only Node.js (package-lock.json) and Rust Binaries built with [cargo-auditable][cargo-auditable] are supported at the moment. | ||
|
|
||
| This tree is the reverse of the npm list command. | ||
| However, if you want to resolve a vulnerability in a particular indirect dependency, the reversed tree is useful to know where that dependency comes from and identify which package you actually need to update. | ||
|
|
@@ -60,9 +63,6 @@ Also, **[email protected]** with some vulnerabilities is included through chain | |
|
|
||
| Then, you can try to update **[email protected]** and **[email protected]** to resolve vulnerabilities in **[email protected]** and **[email protected]**. | ||
|
|
||
| !!! note | ||
| Only Node.js (package-lock.json) is supported at the moment. | ||
|
|
||
| ## JSON | ||
|
|
||
| ``` | ||
|
|
@@ -273,7 +273,7 @@ The following example shows use of default HTML template when Trivy is installed | |
| $ trivy image --format template --template "@/usr/local/share/trivy/templates/html.tpl" -o report.html golang:1.12-alpine | ||
| ``` | ||
|
|
||
|
|
||
| [cargo-auditable]: https://github.com/rust-secure-code/cargo-auditable/ | ||
| [new-json]: https://github.com/aquasecurity/trivy/discussions/1050 | ||
| [action]: https://github.com/aquasecurity/trivy-action | ||
| [asff]: https://github.com/aquasecurity/trivy/blob/main/docs/docs/integrations/aws-security-hub.md | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -27,8 +27,13 @@ func Test_rustBinaryLibraryAnalyzer_Analyze(t *testing.T) { | |
| Type: types.RustBinary, | ||
| FilePath: "testdata/executable_rust", | ||
| Libraries: []types.Package{ | ||
| {Name: "crate_with_features", Version: "0.1.0"}, | ||
| {Name: "library_crate", Version: "0.1.0", Indirect: true}, | ||
| { | ||
| ID: "[email protected]", | ||
| Name: "crate_with_features", | ||
| Version: "0.1.0", | ||
| DependsOn: []string{"[email protected]"}, | ||
| }, | ||
| {ID: "[email protected]", Name: "library_crate", Version: "0.1.0", Indirect: true}, | ||
| }, | ||
| }, | ||
| }, | ||
|
|
||