feat: parse OS version from result of trivy-scan (#1444)

* chore(deps): bump github.com/aquasecurity/trivy from 0.24.2 to 0.25.4

Bumps [github.com/aquasecurity/trivy](https://github.com/aquasecurity/trivy) from 0.24.2 to 0.25.4.
- [Release notes](https://github.com/aquasecurity/trivy/releases)
- [Changelog](https://github.com/aquasecurity/trivy/blob/main/goreleaser.yml)
- [Commits](https://github.com/aquasecurity/trivy/compare/v0.24.2...v0.25.4)

---
updated-dependencies:
- dependency-name: github.com/aquasecurity/trivy
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* test: add testcase

* feat: parse metadata

* refactor: change detect logic

* refactor: change parsing logic

* refactor: refactor check logic before detect

* fix: impl without reuseScannedCves

* feat: complement :latest tag

* Update contrib/trivy/parser/v2/parser.go

Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: MaineK00n <mainek00n.1229@gmail.com>

detector/detector.go

@@ -208,31 +208,21 @@ func Detect(rs []models.ScanResult, dir string) ([]models.ScanResult, error) {
 // pass 2 configs
 func DetectPkgCves(r *models.ScanResult, ovalCnf config.GovalDictConf, gostCnf config.GostConf, logOpts logging.LogOpts) error {
 	// Pkg Scan
-	if r.Release != "" {
-		if len(r.Packages)+len(r.SrcPackages) > 0 {
-			// OVAL, gost(Debian Security Tracker) does not support Package for Raspbian, so skip it.
-			if r.Family == constant.Raspbian {
-				r = r.RemoveRaspbianPackFromResult()
-			}
-
-			// OVAL
-			if err := detectPkgsCvesWithOval(ovalCnf, r, logOpts); err != nil {
-				return xerrors.Errorf("Failed to detect CVE with OVAL: %w", err)
-			}
-
-			// gost
-			if err := detectPkgsCvesWithGost(gostCnf, r, logOpts); err != nil {
-				return xerrors.Errorf("Failed to detect CVE with gost: %w", err)
-			}
-		} else {
-			logging.Log.Infof("Number of packages is 0. Skip OVAL and gost detection")
+	if isPkgCvesDetactable(r) {
+		// OVAL, gost(Debian Security Tracker) does not support Package for Raspbian, so skip it.
+		if r.Family == constant.Raspbian {
+			r = r.RemoveRaspbianPackFromResult()
+		}
+
+		// OVAL
+		if err := detectPkgsCvesWithOval(ovalCnf, r, logOpts); err != nil {
+			return xerrors.Errorf("Failed to detect CVE with OVAL: %w", err)
+		}
+
+		// gost
+		if err := detectPkgsCvesWithGost(gostCnf, r, logOpts); err != nil {
+			return xerrors.Errorf("Failed to detect CVE with gost: %w", err)
 		}
-	} else if reuseScannedCves(r) {
-		logging.Log.Infof("r.Release is empty. Use CVEs as it as.")
-	} else if r.Family == constant.ServerTypePseudo {
-		logging.Log.Infof("pseudo type. Skip OVAL and gost detection")
-	} else {
-		logging.Log.Infof("r.Release is empty. detect as pseudo type. Skip OVAL and gost detection")
 	}
 
 	for i, v := range r.ScannedCves {
@@ -265,6 +255,31 @@ func DetectPkgCves(r *models.ScanResult, ovalCnf config.GovalDictConf, gostCnf c
 	return nil
 }
 
+// isPkgCvesDetactable checks whether CVEs is detactable with gost and oval from the result
+func isPkgCvesDetactable(r *models.ScanResult) bool {
+	if r.Release == "" {
+		logging.Log.Infof("r.Release is empty. Skip OVAL and gost detection")
+		return false
+	}
+
+	if r.ScannedBy == "trivy" {
+		logging.Log.Infof("r.ScannedBy is trivy. Skip OVAL and gost detection")
+		return false
+	}
+
+	switch r.Family {
+	case constant.FreeBSD, constant.ServerTypePseudo:
+		logging.Log.Infof("%s type. Skip OVAL and gost detection", r.Family)
+		return false
+	default:
+		if len(r.Packages)+len(r.SrcPackages) == 0 {
+			logging.Log.Infof("Number of packages is 0. Skip OVAL and gost detection")
+			return false
+		}
+		return true
+	}
+}
+
 // DetectGitHubCves fetches CVEs from GitHub Security Alerts
 func DetectGitHubCves(r *models.ScanResult, githubConfs map[string]config.GitHubConf) error {
 	if len(githubConfs) == 0 {

detector/util.go

@@ -26,12 +26,7 @@ func reuseScannedCves(r *models.ScanResult) bool {
 	case constant.FreeBSD, constant.Raspbian:
 		return true
 	}
-	return isTrivyResult(r)
-}
-
-func isTrivyResult(r *models.ScanResult) bool {
-	_, ok := r.Optional["trivy-target"]
-	return ok
+	return r.ScannedBy == "trivy"
 }
 
 func needToRefreshCve(r models.ScanResult) bool {