Skip to content

feat: Add config option to enable vex-support for trivy #34

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
reasonerjt merged 2 commits into from
Dec 22, 2025
Merged

feat: Add config option to enable vex-support for trivy #34

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6e9eb68
feat: Add config option to enable vex-support for trivy
Aug 28, 2025
271f1da
feat: Add skip-vex-repo-update option, add VEX settings to Helm value…
Dec 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,6 +102,7 @@ Configuration of the adapter is done via environment variables at startup.
| `SCANNER_TRIVY_GITHUB_TOKEN` | N/A | The GitHub access token to download [Trivy DB] (see [GitHub rate limiting][gh-rate-limit]) |
| `SCANNER_TRIVY_INSECURE` | `false` | The flag to skip verifying registry certificate |
| `SCANNER_TRIVY_TIMEOUT` | `5m0s` | The duration to wait for scan completion |
| `SCANNER_TRIVY_VEX_SOURCE` | N/A | Enable VEX, possible values are `oci` and `repo` [EXPERIMENTAL]
| `SCANNER_STORE_REDIS_NAMESPACE` | `harbor.scanner.trivy:store` | The namespace for keys in the Redis store |
| `SCANNER_STORE_REDIS_SCAN_JOB_TTL` | `1h` | The time to live for persisting scan jobs and associated scan reports |
| `SCANNER_JOB_QUEUE_REDIS_NAMESPACE` | `harbor.scanner.trivy:job-queue` | The namespace for keys in the scan jobs queue backed by Redis |
Expand Down
2 changes: 2 additions & 0 deletions helm/harbor-scanner-trivy/templates/statefulset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,6 +121,8 @@ spec:
value: "/certs/tls.crt"
- name: "SCANNER_API_SERVER_TLS_KEY"
value: "/certs/tls.key"
- name: "SCANNER_TRIVY_VEX_SOURCE"
value: {{ .Values.scanner.trivy.VEXSource | default "" | quote }}
{{- end }}
ports:
- name: api-server
Expand Down
1 change: 1 addition & 0 deletions pkg/etc/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@ type Trivy struct {
OfflineScan bool `env:"SCANNER_TRIVY_OFFLINE_SCAN" envDefault:"false"`
GitHubToken string `env:"SCANNER_TRIVY_GITHUB_TOKEN"`
Insecure bool `env:"SCANNER_TRIVY_INSECURE" envDefault:"false"`
VEXSource string `env:"SCANNER_TRIVY_VEX_SOURCE"`
Timeout time.Duration `env:"SCANNER_TRIVY_TIMEOUT" envDefault:"5m0s"`
}

Expand Down
2 changes: 2 additions & 0 deletions pkg/etc/config_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,6 +160,7 @@ func TestGetConfig(t *testing.T) {
"SCANNER_TRIVY_OFFLINE_SCAN": "true",
"SCANNER_TRIVY_GITHUB_TOKEN": "<GITHUB_TOKEN>",
"SCANNER_TRIVY_TIMEOUT": "15m30s",
"SCANNER_TRIVY_VEX_SOURCE": "oci",
Copy link

@reasonerjt reasonerjt Dec 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: I checked the doc https://trivy.dev/docs/latest/supply-chain/vex/oci/#discover-vex-attestation-in-oci-registry

It seems the user should never set "--vex oci", instead, it should be "--vex oci $image".
Could you update the testcase to avoid confusion?

Copy link
Author

@hteichmann-strato hteichmann-strato Dec 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The named argument --vex oci and the seperate positional argument $image are independent and don't need to be adjacent :) so it should be all good.


"SCANNER_STORE_REDIS_NAMESPACE": "store.ns",
"SCANNER_STORE_REDIS_SCAN_JOB_TTL": "2h45m15s",
Expand Down Expand Up @@ -201,6 +202,7 @@ func TestGetConfig(t *testing.T) {
Insecure: true,
GitHubToken: "<GITHUB_TOKEN>",
Timeout: parseDuration(t, "15m30s"),
VEXSource: "oci",
},
RedisPool: RedisPool{
URL: "redis://harbor-harbor-redis:6379",
Expand Down
1 change: 1 addition & 0 deletions pkg/http/api/v1/handler.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -316,6 +316,7 @@ func (h *requestHandler) GetMetadata(res http.ResponseWriter, _ *http.Request) {
"env.SCANNER_TRIVY_SECURITY_CHECKS": h.config.Trivy.Scanners,
"env.SCANNER_TRIVY_SEVERITY": h.config.Trivy.Severity,
"env.SCANNER_TRIVY_TIMEOUT": h.config.Trivy.Timeout.String(),
"env.SCANNER_TRIVY_VEX_SOURCE": h.config.Trivy.VEXSource,
}

vi, err := h.wrapper.GetVersion()
Expand Down
11 changes: 8 additions & 3 deletions pkg/http/api/v1/handler_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -719,6 +719,7 @@ func TestRequestHandler_GetMetadata(t *testing.T) {
Scanners: "vuln",
Severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
Timeout: 5 * time.Minute,
VEXSource: "oci",
},
},
expectedHTTPCode: http.StatusOK,
Expand Down Expand Up @@ -773,7 +774,8 @@ func TestRequestHandler_GetMetadata(t *testing.T) {
"env.SCANNER_TRIVY_VULN_TYPE": "os,library",
"env.SCANNER_TRIVY_SECURITY_CHECKS": "vuln",
"env.SCANNER_TRIVY_SEVERITY": "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
"env.SCANNER_TRIVY_TIMEOUT": "5m0s"
"env.SCANNER_TRIVY_TIMEOUT": "5m0s",
"env.SCANNER_TRIVY_VEX_SOURCE": "oci"
}
}`,
},
Expand All @@ -798,6 +800,7 @@ func TestRequestHandler_GetMetadata(t *testing.T) {
Scanners: "vuln",
Severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
Timeout: 5 * time.Minute,
VEXSource: "repo",
},
},
expectedHTTPCode: http.StatusOK,
Expand Down Expand Up @@ -850,7 +853,8 @@ func TestRequestHandler_GetMetadata(t *testing.T) {
"env.SCANNER_TRIVY_VULN_TYPE": "os,library",
"env.SCANNER_TRIVY_SECURITY_CHECKS": "vuln",
"env.SCANNER_TRIVY_SEVERITY": "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
"env.SCANNER_TRIVY_TIMEOUT": "5m0s"
"env.SCANNER_TRIVY_TIMEOUT": "5m0s",
"env.SCANNER_TRIVY_VEX_SOURCE": "repo"
}
}`,
},
Expand Down Expand Up @@ -921,7 +925,8 @@ func TestRequestHandler_GetMetadata(t *testing.T) {
"env.SCANNER_TRIVY_VULN_TYPE": "os,library",
"env.SCANNER_TRIVY_SECURITY_CHECKS": "vuln",
"env.SCANNER_TRIVY_SEVERITY": "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL",
"env.SCANNER_TRIVY_TIMEOUT": "5m0s"
"env.SCANNER_TRIVY_TIMEOUT": "5m0s",
"env.SCANNER_TRIVY_VEX_SOURCE": ""
}
}`,
},
Expand Down
5 changes: 5 additions & 0 deletions pkg/trivy/wrapper.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -219,6 +219,11 @@ func (w *wrapper) prepareScanCmd(target ScanTarget, outputFile string, opt ScanO
args = append(args, "--insecure")
}

if w.config.VEXSource != "" {
args = append(args, "--vex", w.config.VEXSource)
}


targetName, err := target.Name()
if err != nil {
return nil, xerrors.Errorf("get target name: %w", err)
Expand Down
Loading