feat: parse OS version from result of trivy-scan (#1444)

* chore(deps): bump github.com/aquasecurity/trivy from 0.24.2 to 0.25.4

Bumps [github.com/aquasecurity/trivy](https://github.com/aquasecurity/trivy) from 0.24.2 to 0.25.4.
- [Release notes](https://github.com/aquasecurity/trivy/releases)
- [Changelog](https://github.com/aquasecurity/trivy/blob/main/goreleaser.yml)
- [Commits](https://github.com/aquasecurity/trivy/compare/v0.24.2...v0.25.4)

---
updated-dependencies:
- dependency-name: github.com/aquasecurity/trivy
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* test: add testcase

* feat: parse metadata

* refactor: change detect logic

* refactor: change parsing logic

* refactor: refactor check logic before detect

* fix: impl without reuseScannedCves

* feat: complement :latest tag

* Update contrib/trivy/parser/v2/parser.go

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

contrib/trivy/parser/v2/parser.go

@@ -2,6 +2,7 @@ package v2
 
 import (
 	"encoding/json"
+	"regexp"
 	"time"
 
 	"github.com/aquasecurity/trivy/pkg/types"
@@ -34,35 +35,28 @@ func (p ParserV2) Parse(vulnJSON []byte) (result *models.ScanResult, err error)
 	return scanResult, nil
 }
 
-func setScanResultMeta(scanResult *models.ScanResult, report *types.Report) error {
-	const trivyTarget = "trivy-target"
-	for _, r := range report.Results {
-		if pkg.IsTrivySupportedOS(r.Type) {
-			scanResult.Family = r.Type
-			scanResult.ServerName = r.Target
-			scanResult.Optional = map[string]interface{}{
-				trivyTarget: r.Target,
-			}
-		} else if pkg.IsTrivySupportedLib(r.Type) {
-			if scanResult.Family == "" {
-				scanResult.Family = constant.ServerTypePseudo
-			}
-			if scanResult.ServerName == "" {
-				scanResult.ServerName = "library scan by trivy"
-			}
-			if _, ok := scanResult.Optional[trivyTarget]; !ok {
-				scanResult.Optional = map[string]interface{}{
-					trivyTarget: r.Target,
-				}
-			}
-		}
-		scanResult.ScannedAt = time.Now()
-		scanResult.ScannedBy = "trivy"
-		scanResult.ScannedVia = "trivy"
-	}
+var dockerTagPattern = regexp.MustCompile(`:.+$`)
 
-	if _, ok := scanResult.Optional[trivyTarget]; !ok {
+func setScanResultMeta(scanResult *models.ScanResult, report *types.Report) error {
+	if len(report.Results) == 0 {
 		return xerrors.Errorf("scanned images or libraries are not supported by Trivy. see https://aquasecurity.github.io/trivy/dev/vulnerability/detection/os/, https://aquasecurity.github.io/trivy/dev/vulnerability/detection/language/")
 	}
+
+	scanResult.ServerName = report.ArtifactName
+	if report.ArtifactType == "container_image" && !dockerTagPattern.MatchString(scanResult.ServerName) {
+		scanResult.ServerName += ":latest" // Complement if the tag is omitted
+	}
+
+	if report.Metadata.OS != nil {
+		scanResult.Family = report.Metadata.OS.Family
+		scanResult.Release = report.Metadata.OS.Name
+	} else {
+		scanResult.Family = constant.ServerTypePseudo
+	}
+
+	scanResult.ScannedAt = time.Now()
+	scanResult.ScannedBy = "trivy"
+	scanResult.ScannedVia = "trivy"
+
 	return nil
 }

contrib/trivy/parser/v2/parser_test.go

@@ -203,8 +203,9 @@ var redisTrivy = []byte(`
 `)
 var redisSR = &models.ScanResult{
 	JSONVersion: 4,
-	ServerName:  "redis (debian 10.10)",
+	ServerName:  "redis:latest",
 	Family:      "debian",
+	Release:     "10.10",
 	ScannedBy:   "trivy",
 	ScannedVia:  "trivy",
 	ScannedCves: models.VulnInfos{
@@ -262,9 +263,7 @@ var redisSR = &models.ScanResult{
 			BinaryNames: []string{"bsdutils", "pkgA"},
 		},
 	},
-	Optional: map[string]interface{}{
-		"trivy-target": "redis (debian 10.10)",
-	},
+	Optional: nil,
 }
 
 var strutsTrivy = []byte(`
@@ -373,7 +372,7 @@ var strutsTrivy = []byte(`
 
 var strutsSR = &models.ScanResult{
 	JSONVersion: 4,
-	ServerName:  "library scan by trivy",
+	ServerName:  "/data/struts-1.2.7/lib",
 	Family:      "pseudo",
 	ScannedBy:   "trivy",
 	ScannedVia:  "trivy",
@@ -459,9 +458,7 @@ var strutsSR = &models.ScanResult{
 	},
 	Packages:    models.Packages{},
 	SrcPackages: models.SrcPackages{},
-	Optional: map[string]interface{}{
-		"trivy-target": "Java",
-	},
+	Optional:    nil,
 }
 
 var osAndLibTrivy = []byte(`
@@ -633,8 +630,9 @@ var osAndLibTrivy = []byte(`
 
 var osAndLibSR = &models.ScanResult{
 	JSONVersion: 4,
-	ServerName:  "quay.io/fluentd_elasticsearch/fluentd:v2.9.0 (debian 10.2)",
+	ServerName:  "quay.io/fluentd_elasticsearch/fluentd:v2.9.0",
 	Family:      "debian",
+	Release:     "10.2",
 	ScannedBy:   "trivy",
 	ScannedVia:  "trivy",
 	ScannedCves: models.VulnInfos{
@@ -720,9 +718,7 @@ var osAndLibSR = &models.ScanResult{
 			BinaryNames: []string{"libgnutls30"},
 		},
 	},
-	Optional: map[string]interface{}{
-		"trivy-target": "quay.io/fluentd_elasticsearch/fluentd:v2.9.0 (debian 10.2)",
-	},
+	Optional: nil,
 }
 
 func TestParseError(t *testing.T) {