feat: allow disabling CVE independently from search by rchincha · Pull Request #4102 · project-zot/zot

rchincha · 2026-05-26T22:07:29Z

fixes issue #4096

What type of PR is this?

Which issue does this PR fix:

What does this PR do / Why do we need it:

If an issue # is not available please add repro steps and logs showing the issue:

Testing done on this change:

Automation added to e2e:

Will this break upgrades or downgrades?

Does this PR introduce any user-facing change?:

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Copilot

Pull request overview

This PR introduces a way to disable CVE scanning independently of the search/UI extensions, enabling configurations like UI + search + remote storage (S3/GCS) without triggering Trivy DB downloads or remote-storage incompatibility checks.

Changes:

Adds extensions.search.cve.enable to explicitly disable CVE scanning while leaving search/UI enabled.
Updates server defaulting logic to skip CVE/Trivy defaults when CVE is explicitly disabled.
Adjusts GraphQL CVE query resolvers (and tests) to return empty results when CVE is disabled.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
pkg/extensions/search/schema.resolvers.go	Returns empty CVE GraphQL results when CVE is disabled (instead of error).
pkg/extensions/search/resolver_test.go	Updates/extends resolver tests to cover empty-result behavior with nil cveInfo.
pkg/extensions/config/config.go	Adds `CVEConfig.Enable` and updates `IsCveScanningEnabled()` semantics.
pkg/extensions/config/config_test.go	Adds coverage for search enabled + CVE explicitly disabled.
pkg/cli/server/root.go	Skips CVE defaults (interval/Trivy repos) when CVE is explicitly disabled.
pkg/cli/server/extensions_test.go	Adds config verification + serve tests for explicit CVE disablement.
examples/config-ui-no-cve.json	Adds example config enabling UI with CVE disabled.

Files not reviewed (1)

pkg/extensions/search/schema.resolvers.go: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

pkg/extensions/search/schema.resolvers.go: Language not supported

fixes issue project-zot#4096 Useful for airgapped environments and deployments which don't care about CVEs. Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com>

Copilot

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated 4 comments.

Files not reviewed (1)

pkg/extensions/search/schema.resolvers.go: Language not supported

 func (r *queryResolver) CVEListForImage(ctx context.Context, image string, requestedPage *gql_generated.PageInput, searchedCve *string, excludedCve *string, severity *string) (*gql_generated.CVEResultForImage, error) {
 	if r.cveInfo == nil {
-		return &gql_generated.CVEResultForImage{}, zerr.ErrCVESearchDisabled
+		return &gql_generated.CVEResultForImage{
+			CVEList: []*gql_generated.Cve{},
+			Page:    &gql_generated.PageInfo{},
+		}, nil


 func (r *queryResolver) CVEDiffListForImages(ctx context.Context, minuend gql_generated.ImageInput, subtrahend gql_generated.ImageInput, requestedPage *gql_generated.PageInput, searchedCve *string, excludedCve *string) (*gql_generated.CVEDiffResult, error) {
 	if r.cveInfo == nil {
-		return &gql_generated.CVEDiffResult{}, zerr.ErrCVESearchDisabled
+		return &gql_generated.CVEDiffResult{
+			Minuend: &gql_generated.ImageIdentifier{
+				Repo:   minuend.Repo,
+				Tag:    minuend.Tag,
+				Digest: minuend.Digest,
+			},
+			Subtrahend: &gql_generated.ImageIdentifier{
+				Repo:   subtrahend.Repo,
+				Tag:    subtrahend.Tag,
+				Digest: subtrahend.Digest,
+			},
+			CVEList: []*gql_generated.Cve{},
+			Page:    &gql_generated.PageInfo{},
+		}, nil


 // ImageListForCve is the resolver for the ImageListForCVE field.
 func (r *queryResolver) ImageListForCve(ctx context.Context, id string, filter *gql_generated.Filter, requestedPage *gql_generated.PageInput) (*gql_generated.PaginatedImagesResult, error) {
 	if r.cveInfo == nil {
-		return &gql_generated.PaginatedImagesResult{}, zerr.ErrCVESearchDisabled
+		return &gql_generated.PaginatedImagesResult{
+			Page:    &gql_generated.PageInfo{},
+			Results: []*gql_generated.ImageSummary{},
+		}, nil


 // ImageListWithCVEFixed is the resolver for the ImageListWithCVEFixed field.
 func (r *queryResolver) ImageListWithCVEFixed(ctx context.Context, id string, image string, filter *gql_generated.Filter, requestedPage *gql_generated.PageInput) (*gql_generated.PaginatedImagesResult, error) {
 	if r.cveInfo == nil {
-		return &gql_generated.PaginatedImagesResult{}, zerr.ErrCVESearchDisabled
+		return &gql_generated.PaginatedImagesResult{
+			Page:    &gql_generated.PageInfo{},
+			Results: []*gql_generated.ImageSummary{},
+		}, nil


andaaron · 2026-05-31T14:33:53Z

 	return ext
 }

+func buildSearchConfigWithCVEDisabled(enabled bool) *config.ExtensionConfig {


Suggested change

func buildSearchConfigWithCVEDisabled(enabled bool) *config.ExtensionConfig {

func buildSearchConfig(enableSearch, enableCVE bool) *config.ExtensionConfig {

rchincha requested review from andaaron and vrajashkr as code owners May 26, 2026 22:07

rchincha added this to the v2.1.18 milestone May 26, 2026

rchincha force-pushed the feat-disable-cve-keep-ui-search branch from e68e23c to 51e403b Compare May 26, 2026 22:14

rchincha requested a review from Copilot May 26, 2026 22:14

Copilot started reviewing on behalf of rchincha May 26, 2026 22:15 View session

Copilot AI reviewed May 26, 2026

View reviewed changes

rchincha force-pushed the feat-disable-cve-keep-ui-search branch from 51e403b to 87a2ba4 Compare May 26, 2026 22:36

rchincha requested a review from Copilot May 26, 2026 22:36

Copilot started reviewing on behalf of rchincha May 26, 2026 22:37 View session

Copilot AI reviewed May 26, 2026

View reviewed changes

Comment thread pkg/extensions/config/config.go

feat: allow disabling CVE independently from search

8abf21c

fixes issue project-zot#4096 Useful for airgapped environments and deployments which don't care about CVEs. Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com>

rchincha force-pushed the feat-disable-cve-keep-ui-search branch from 87a2ba4 to 8abf21c Compare May 26, 2026 22:49

rchincha requested a review from Copilot May 26, 2026 22:49

Copilot started reviewing on behalf of rchincha May 26, 2026 22:50 View session

Copilot AI reviewed May 26, 2026

View reviewed changes

andaaron reviewed May 31, 2026

View reviewed changes

andaaron mentioned this pull request May 31, 2026

[Feat]: Need a way to disable CVE only but keep UI & Search #4096

Open

rchincha modified the milestones: v2.1.18, v2.1.19 Jun 12, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: allow disabling CVE independently from search#4102

feat: allow disabling CVE independently from search#4102
rchincha wants to merge 1 commit into
project-zot:mainfrom
rchincha:feat-disable-cve-keep-ui-search

rchincha commented May 26, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

andaaron May 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	func buildSearchConfigWithCVEDisabled(enabled bool) *config.ExtensionConfig {
	func buildSearchConfig(enableSearch, enableCVE bool) *config.ExtensionConfig {

Uh oh!

Conversation

rchincha commented May 26, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

andaaron May 31, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants