feat: allow disabling CVE independently from search

examples/config-ui-no-cve.json

@@ -0,0 +1,24 @@
+{
+  "distSpecVersion": "1.1.1",
+  "storage": {
+    "rootDirectory": "/tmp/zot"
+  },
+  "http": {
+    "address": "0.0.0.0",
+    "port": "8080"
+  },
+  "log": {
+    "level": "debug"
+  },
+  "extensions": {
+    "search": {
+      "enable": true,
+      "cve": {
+        "enable": false
+      }
+    },
+    "ui": {
+      "enable": true
+    }
+  }
+}

pkg/cli/server/extensions_test.go

@@ -100,6 +100,41 @@ func TestVerifyExtensionsConfig(t *testing.T) {
 		So(cli.NewServerRootCmd().Execute(), ShouldNotBeNil)
 	})
 
+	Convey("Test verify CVE can be explicitly disabled for remote storage", t, func(c C) {
+		content := fmt.Sprintf(`{
+			"storage":{
+				"rootDirectory":"%s",
+				"dedupe":true,
+				"remoteCache":false,
+				"storageDriver":{
+					"name":"s3",
+					"rootdirectory":"/zot",
+					"region":"us-east-2",
+					"bucket":"zot-storage",
+					"secure":true,
+					"skipverify":false
+				}
+			},
+			"http":{
+				"address":"127.0.0.1",
+				"port":"8080"
+			},
+			"extensions":{
+				"search": {
+					"enable": true,
+					"cve": {
+						"enable": false
+					}
+				}
+			}
+		}`, t.TempDir())
+
+		tmpfile := MakeTempFileWithContent(t, "zot-test.json", content)
+		os.Args = []string{"cli_test", "verify", tmpfile}
+
+		So(cli.NewServerRootCmd().Execute(), ShouldBeNil)
+	})
+
 	Convey("Test verify w/ sync and w/o filesystem storage", t, func(c C) {
 		content := fmt.Sprintf(`{"storage":{"rootDirectory":"%s", "storageDriver": {"name": "s3"}},
 							"http":{"address":"127.0.0.1","port":"8080","realm":"zot",
@@ -1099,6 +1134,41 @@ func TestServeSearchEnabledNoCVE(t *testing.T) {
 		So(found, ShouldBeTrue)
 		So(err, ShouldBeNil)
 	})
+
+	Convey("search explicitly enabled, and CVE explicitly disabled", t, func(c C) {
+		content := `{
+				"storage": {
+					"rootDirectory": "%s"
+				},
+				"http": {
+					"address": "127.0.0.1",
+					"port": "%s"
+				},
+				"log": {
+					"level": "debug",
+					"output": "%s"
+				},
+				"extensions": {
+					"search": {
+						"enable": true,
+						"cve": {
+							"enable": false
+						}
+					}
+				}
+			}`
+
+		logPath, _, err := runCLIWithConfig(t, content)
+		So(err, ShouldBeNil)
+
+		found, err := ReadLogFileAndSearchString(logPath, `"CVE":{"Enable":false`, readLogFileTimeout)
+		So(found, ShouldBeTrue)
+		So(err, ShouldBeNil)
+
+		found, err = ReadLogFileAndSearchString(logPath, "updating cve-db", readLogFileTimeout)
+		So(found, ShouldBeFalse)
+		So(err, ShouldBeNil)
+	})
 }
 
 func TestServeSearchDisabled(t *testing.T) {

pkg/cli/server/root.go

@@ -873,42 +873,48 @@ func applyDefaultValues(config *config.Config, viperInstance *viper.Viper, logge
 				config.Extensions.Search.Enable = &defaultVal
 			}
 
+			if config.Extensions.Search.CVE != nil && config.Extensions.Search.CVE.Enable == nil {
+				config.Extensions.Search.CVE.Enable = &defaultVal
+			}
+
 			if *config.Extensions.Search.Enable && config.Extensions.Search.CVE != nil {
-				defaultUpdateInterval, _ := time.ParseDuration("2h")
+				if config.Extensions.Search.CVE.Enable == nil || *config.Extensions.Search.CVE.Enable {
+					defaultUpdateInterval, _ := time.ParseDuration("2h")
 
-				if config.Extensions.Search.CVE.UpdateInterval < defaultUpdateInterval {
-					config.Extensions.Search.CVE.UpdateInterval = defaultUpdateInterval
+					if config.Extensions.Search.CVE.UpdateInterval < defaultUpdateInterval {
+						config.Extensions.Search.CVE.UpdateInterval = defaultUpdateInterval
 
-					logger.Warn().Msg("cve update interval set to too-short interval < 2h, " +
-						"changing update duration to 2 hours and continuing.")
-				}
+						logger.Warn().Msg("cve update interval set to too-short interval < 2h, " +
+							"changing update duration to 2 hours and continuing.")
+					}
 
-				if config.Extensions.Search.CVE.Trivy == nil {
-					config.Extensions.Search.CVE.Trivy = &extconf.TrivyConfig{}
-				}
+					if config.Extensions.Search.CVE.Trivy == nil {
+						config.Extensions.Search.CVE.Trivy = &extconf.TrivyConfig{}
+					}
 
-				if config.Extensions.Search.CVE.Trivy.DBRepository == "" {
-					defaultDBDownloadURL := "ghcr.io/aquasecurity/trivy-db"
-					logger.Info().Str("url", defaultDBDownloadURL).Str("component", "config").
-						Msg("using default trivy-db download URL.")
+					if config.Extensions.Search.CVE.Trivy.DBRepository == "" {
+						defaultDBDownloadURL := "ghcr.io/aquasecurity/trivy-db"
+						logger.Info().Str("url", defaultDBDownloadURL).Str("component", "config").
+							Msg("using default trivy-db download URL.")
 
-					config.Extensions.Search.CVE.Trivy.DBRepository = defaultDBDownloadURL
-				}
+						config.Extensions.Search.CVE.Trivy.DBRepository = defaultDBDownloadURL
+					}
 
-				if config.Extensions.Search.CVE.Trivy.JavaDBRepository == "" {
-					defaultJavaDBDownloadURL := "ghcr.io/aquasecurity/trivy-java-db"
-					logger.Info().Str("url", defaultJavaDBDownloadURL).Str("component", "config").
-						Msg("using default trivy-java-db download URL.")
+					if config.Extensions.Search.CVE.Trivy.JavaDBRepository == "" {
+						defaultJavaDBDownloadURL := "ghcr.io/aquasecurity/trivy-java-db"
+						logger.Info().Str("url", defaultJavaDBDownloadURL).Str("component", "config").
+							Msg("using default trivy-java-db download URL.")
 
-					config.Extensions.Search.CVE.Trivy.JavaDBRepository = defaultJavaDBDownloadURL
-				}
+						config.Extensions.Search.CVE.Trivy.JavaDBRepository = defaultJavaDBDownloadURL
+					}
 
-				if len(config.Extensions.Search.CVE.Trivy.VulnSeveritySources) == 0 {
-					defaultVulnSeveritySources := []string{"auto"}
-					logger.Info().Strs("vulnSeveritySources", defaultVulnSeveritySources).Str("component", "config").
-						Msg("using default trivy vulnerability severity sources.")
+					if len(config.Extensions.Search.CVE.Trivy.VulnSeveritySources) == 0 {
+						defaultVulnSeveritySources := []string{"auto"}
+						logger.Info().Strs("vulnSeveritySources", defaultVulnSeveritySources).Str("component", "config").
+							Msg("using default trivy vulnerability severity sources.")
 
-					config.Extensions.Search.CVE.Trivy.VulnSeveritySources = defaultVulnSeveritySources
+						config.Extensions.Search.CVE.Trivy.VulnSeveritySources = defaultVulnSeveritySources
+					}
 				}
 			}
 		}

pkg/extensions/config/config.go

@@ -53,6 +53,9 @@ type SearchConfig struct {
 }
 
 type CVEConfig struct {
+	// Enable controls whether CVE scanning is active for search.
+	// If omitted, this field defaults to enabled when the CVE config block is present and search is enabled.
+	Enable         *bool         `mapstructure:"enable,omitempty"`
 	UpdateInterval time.Duration // should be 2 hours or more, if not specified default be kept as 2 hours
 	Trivy          *TrivyConfig
 }
@@ -109,8 +112,15 @@ func (e *ExtensionConfig) IsCveScanningEnabled() bool {
 		return false
 	}
 
-	return e.Search != nil && e.Search.Enable != nil && *e.Search.Enable &&
-		e.Search.CVE != nil && e.Search.CVE.Trivy != nil
+	if e.Search == nil || e.Search.Enable == nil || !*e.Search.Enable || e.Search.CVE == nil {
+		return false
+	}
+
+	if e.Search.CVE.Enable != nil && !*e.Search.CVE.Enable {
+		return false
+	}
+
+	return e.Search.CVE.Trivy != nil
 }
 
 // IsEventRecorderEnabled checks if event recording is enabled in this extensions config.

pkg/extensions/config/config_test.go

@@ -44,6 +44,22 @@ func buildSearchConfigWithCVE(enabled bool) *config.ExtensionConfig {
 	return ext
 }
 
+func buildSearchConfigWithCVEDisabled(enabled bool) *config.ExtensionConfig {
+	disabled := false
+	ext := &config.ExtensionConfig{}
+	ext.Search = &config.SearchConfig{
+		BaseConfig: config.BaseConfig{
+			Enable: &enabled,
+		},
+		CVE: &config.CVEConfig{
+			Enable: &disabled,
+			Trivy:  &config.TrivyConfig{},
+		},
+	}
+
+	return ext
+}
+
 func buildEventsConfig(enabled bool) *config.ExtensionConfig {
 	ext := &config.ExtensionConfig{}
 	ext.Events = &events.Config{
@@ -302,6 +318,12 @@ func TestExtensionConfig(t *testing.T) {
 			testMethodWithNilEnable("Search", (*config.ExtensionConfig).IsCveScanningEnabled)
 			testMethodWithDisabledEnable("Search", (*config.ExtensionConfig).IsCveScanningEnabled, buildSearchConfig)
 			testMethodWithEnabledEnable("Search", (*config.ExtensionConfig).IsCveScanningEnabled, buildSearchConfigWithCVE)
+
+			Convey("Test with search enabled but cve explicitly disabled", func() {
+				enabled := true
+				extensionConfig := buildSearchConfigWithCVEDisabled(enabled)
+				So(extensionConfig.IsCveScanningEnabled(), ShouldBeFalse)
+			})
 		})
 
 		Convey("Test IsEventRecorderEnabled()", func() {

pkg/extensions/search/resolver_test.go

@@ -695,8 +695,8 @@ func TestGetReferrers(t *testing.T) {
 	})
 }
 
-func TestQueryResolverErrors(t *testing.T) {
-	Convey("Errors", t, func() {
+func TestQueryResolverErrorsAndEmptyResults(t *testing.T) {
+	Convey("Errors and empty results", t, func() {
 		log := log.NewTestLogger()
 		ctx := graphql.WithResponseContext(context.Background(), graphql.DefaultErrorPresenter,
 			graphql.DefaultRecover)
@@ -735,7 +735,10 @@ func TestQueryResolverErrors(t *testing.T) {
 			So(err, ShouldNotBeNil)
 		})
 
-		Convey("CVEDiffListForImages nill cveinfo", func() {
+		Convey("CVEDiffListForImages nil cveinfo returns empty result", func() {
+			minuend := gql_generated.ImageInput{Repo: "repo1", Tag: "1.0.0", Digest: ref("sha256:minuend")}
+			subtrahend := gql_generated.ImageInput{Repo: "repo2", Tag: "2.0.0", Digest: ref("sha256:subtrahend")}
+
 			resolverConfig := NewResolver(
 				log,
 				storage.StoreController{
@@ -752,9 +755,75 @@ func TestQueryResolverErrors(t *testing.T) {
 
 			qr := queryResolver{resolverConfig}
 
-			_, err := qr.CVEDiffListForImages(ctx, gql_generated.ImageInput{}, gql_generated.ImageInput{},
+			result, err := qr.CVEDiffListForImages(ctx, minuend, subtrahend,
 				&gql_generated.PageInput{}, nil, nil)
-			So(err, ShouldNotBeNil)
+			So(err, ShouldBeNil)
+			So(result, ShouldNotBeNil)
+			So(result.Minuend, ShouldNotBeNil)
+			So(result.Minuend.Repo, ShouldEqual, minuend.Repo)
+			So(result.Minuend.Tag, ShouldEqual, minuend.Tag)
+			So(result.Minuend.Digest, ShouldEqual, minuend.Digest)
+			So(result.Subtrahend, ShouldNotBeNil)
+			So(result.Subtrahend.Repo, ShouldEqual, subtrahend.Repo)
+			So(result.Subtrahend.Tag, ShouldEqual, subtrahend.Tag)
+			So(result.Subtrahend.Digest, ShouldEqual, subtrahend.Digest)
+			So(result.Page, ShouldNotBeNil)
+			So(result.CVEList, ShouldNotBeNil)
+			So(len(result.CVEList), ShouldEqual, 0)
+		})
+
+		Convey("CVEListForImage nil cveinfo returns empty result", func() {
+			resolverConfig := NewResolver(
+				log,
+				storage.StoreController{DefaultStore: mocks.MockedImageStore{}},
+				mocks.MetaDBMock{},
+				nil,
+			)
+
+			qr := queryResolver{resolverConfig}
+
+			result, err := qr.CVEListForImage(ctx, "repo1:1.0.0", &gql_generated.PageInput{}, nil, nil, nil)
+			So(err, ShouldBeNil)
+			So(result, ShouldNotBeNil)
+			So(result.Page, ShouldNotBeNil)
+			So(result.CVEList, ShouldNotBeNil)
+			So(len(result.CVEList), ShouldEqual, 0)
+		})
+
+		Convey("ImageListForCve nil cveinfo returns empty result", func() {
+			resolverConfig := NewResolver(
+				log,
+				storage.StoreController{DefaultStore: mocks.MockedImageStore{}},
+				mocks.MetaDBMock{},
+				nil,
+			)
+
+			qr := queryResolver{resolverConfig}
+
+			result, err := qr.ImageListForCve(ctx, "CVE-123", &gql_generated.Filter{}, &gql_generated.PageInput{})
+			So(err, ShouldBeNil)
+			So(result, ShouldNotBeNil)
+			So(result.Page, ShouldNotBeNil)
+			So(result.Results, ShouldNotBeNil)
+			So(len(result.Results), ShouldEqual, 0)
+		})
+
+		Convey("ImageListWithCVEFixed nil cveinfo returns empty result", func() {
+			resolverConfig := NewResolver(
+				log,
+				storage.StoreController{DefaultStore: mocks.MockedImageStore{}},
+				mocks.MetaDBMock{},
+				nil,
+			)
+
+			qr := queryResolver{resolverConfig}
+
+			result, err := qr.ImageListWithCVEFixed(ctx, "CVE-123", "repo1", &gql_generated.Filter{}, &gql_generated.PageInput{})
+			So(err, ShouldBeNil)
+			So(result, ShouldNotBeNil)
+			So(result.Page, ShouldNotBeNil)
+			So(result.Results, ShouldNotBeNil)
+			So(len(result.Results), ShouldEqual, 0)
 		})
 
 		Convey("CVEDiffListForImages error", func() {