diff --git a/GNUmakefile b/GNUmakefile index 065fe8a6..83e021a4 100644 --- a/GNUmakefile +++ b/GNUmakefile @@ -90,7 +90,7 @@ NOW=$(shell date '+%Y-%m-%dT%H-%M-%S%z') NOW_JSON_DIR := '${BASE_DIR}/$(NOW)' ONE_SEC_AFTER=$(shell date -d '+1 second' '+%Y-%m-%dT%H-%M-%S%z') ONE_SEC_AFTER_JSON_DIR := '${BASE_DIR}/$(ONE_SEC_AFTER)' -LIBS := 'bundler' 'dart' 'elixir' 'pip' 'pipenv' 'poetry' 'composer' 'npm' 'yarn' 'pnpm' 'cargo' 'gomod' 'gosum' 'gobinary' 'jar' 'jar-wrong-name-log4j-core' 'war' 'pom' 'gradle' 'nuget-lock' 'nuget-config' 'dotnet-deps' 'dotnet-package-props' 'conan' 'swift-cocoapods' 'swift-swift' 'rust-binary' +LIBS := 'bundler' 'dart' 'elixir' 'pip' 'pipenv' 'poetry' 'composer' 'npm-v1' 'npm-v2' 'npm-v3' 'yarn' 'pnpm' 'cargo' 'gomod' 'gosum' 'gobinary' 'jar' 'jar-wrong-name-log4j-core' 'war' 'pom' 'gradle' 'nuget-lock' 'nuget-config' 'dotnet-deps' 'dotnet-package-props' 'conan' 'swift-cocoapods' 'swift-swift' 'rust-binary' diff: # git clone git@github.com:vulsio/vulsctl.git diff --git a/detector/javadb/javadb.go b/detector/javadb/javadb.go index 5cf12c4d..d4481dd0 100644 --- a/detector/javadb/javadb.go +++ b/detector/javadb/javadb.go @@ -7,7 +7,6 @@ package javadb import ( "context" "errors" - "fmt" "os" "path/filepath" "time" @@ -40,12 +39,11 @@ func UpdateJavaDB(trivyOpts config.TrivyOpts, noProgress bool) error { if (meta.Version != db.SchemaVersion || meta.NextUpdate.Before(time.Now().UTC())) && !trivyOpts.TrivySkipJavaDBUpdate { // Download DB - repo := fmt.Sprintf("%s:%d", trivyOpts.TrivyJavaDBRepository, db.SchemaVersion) - logging.Log.Infof("Trivy Java DB Repository: %s", repo) + logging.Log.Infof("Trivy Java DB Repository: %s", trivyOpts.TrivyJavaDBRepository) logging.Log.Info("Downloading Trivy Java DB...") var a *oci.Artifact - if a, err = oci.NewArtifact(repo, noProgress, types.RegistryOptions{}); err != nil { + if a, err = oci.NewArtifact(trivyOpts.TrivyJavaDBRepository, noProgress, types.RegistryOptions{}); err != nil { return xerrors.Errorf("Failed to new oci artifact. err: %w", err) } if err = a.Download(context.Background(), dbDir, oci.DownloadOption{MediaType: "application/vnd.aquasec.trivy.javadb.layer.v1.tar+gzip"}); err != nil { diff --git a/integration b/integration index b91ccaad..c9493b94 160000 --- a/integration +++ b/integration @@ -1 +1 @@ -Subproject commit b91ccaadfb9145d58acfbbae7e489dad958fdff2 +Subproject commit c9493b9402575834a5e52911f0aa4c141b650754 diff --git a/scanner/library.go b/scanner/library.go index 451e8618..b52d50a6 100644 --- a/scanner/library.go +++ b/scanner/library.go @@ -4,12 +4,19 @@ import ( ftypes "github.com/aquasecurity/trivy/pkg/fanal/types" "github.com/aquasecurity/trivy/pkg/purl" "github.com/aquasecurity/trivy/pkg/types" + "github.com/samber/lo" "github.com/future-architect/vuls/logging" "github.com/future-architect/vuls/models" ) func convertLibWithScanner(apps []ftypes.Application) ([]models.LibraryScanner, error) { + for i := range apps { + apps[i].Libraries = lo.Filter(apps[i].Libraries, func(lib ftypes.Package, index int) bool { + return !lib.Dev + }) + } + scanners := make([]models.LibraryScanner, 0, len(apps)) for _, app := range apps { libs := make([]models.Library, 0, len(app.Libraries))