Merge pull request #5 from reasonerjt/prepare-v0-32-0-ga-release-branch

Prepare v0 32 0 ga release branch

.goreleaser.yml

@@ -29,16 +29,15 @@ changelog:
       - '^release'
 dockers:
   - image_templates:
-      - "docker.io/aquasec/harbor-scanner-trivy:{{ .Version }}"
-      - "public.ecr.aws/aquasecurity/harbor-scanner-trivy:{{ .Version }}"
+      - "docker.io/goharbor/harbor-scanner-trivy:{{ .Version }}"
     ids:
       - scanner-trivy
     build_flag_templates:
       - "--label=org.label-schema.schema-version=1.0"
       - "--label=org.label-schema.name={{ .ProjectName }}"
       - "--label=org.label-schema.description=Harbor scanner adapter for Trivy"
-      - "--label=org.label-schema.vendor=Aqua Security"
+      - "--label=org.label-schema.vendor=Harbor community"
       - "--label=org.label-schema.version={{ .Version }}"
       - "--label=org.label-schema.build-date={{ .Date }}"
-      - "--label=org.label-schema.vcs=https://github.com/aquasecurity/harbor-scanner-trivy"
+      - "--label=org.label-schema.vcs=https://github.com/goharbor/harbor-scanner-trivy"
       - "--label=org.label-schema.vcs-ref={{ .FullCommit }}"

helm/harbor-scanner-trivy/Chart.yaml

@@ -1,11 +1,11 @@
 apiVersion: v1
 name: harbor-scanner-trivy
-version: 0.31.4
-appVersion: 0.31.4
+version: 0.32.0
+appVersion: 0.32.0
 description: Harbor scanner adapter for Trivy
 keywords:
   - scanner
   - harbor
   - vulnerability
 sources:
-- https://github.com/aquasecurity/harbor-scanner-trivy
+- https://github.com/goharbor/harbor-scanner-trivy

helm/harbor-scanner-trivy/templates/statefulset.yaml

@@ -77,6 +77,10 @@ spec:
               value: {{ .Values.scanner.trivy.skipJavaDBUpdate | quote }}
             - name: "SCANNER_TRIVY_OFFLINE_SCAN"
               value: {{ .Values.scanner.trivy.offlineScan | quote }}
+            - name: "SCANNER_TRIVY_DB_REPOSITORY"
+              value: {{ .Values.scanner.trivy.dbRepository | quote }}
+            - name: "SCANNER_TRIVY_JAVA_DB_REPOSITORY"
+              value: {{ .Values.scanner.trivy.javaDBRepository | quote }}
             - name: "SCANNER_TRIVY_GITHUB_TOKEN"
               valueFrom:
                 secretKeyRef:

helm/harbor-scanner-trivy/values.yaml

@@ -3,8 +3,8 @@ fullnameOverride: ""
 
 image:
   registry: docker.io
-  repository: aquasec/harbor-scanner-trivy
-  tag: 0.31.4
+  repository: goharbor/harbor-scanner-trivy
+  tag: 0.32.0
   pullPolicy: IfNotPresent
 
 replicaCount: 1
@@ -78,6 +78,10 @@ scanner:
     ## If the flag is enabled you have to manually download the `trivy-java.db` file and mount it in the
     ## `/home/scanner/.cache/trivy/java-db/trivy-java.db` path (see `cacheDir`).
     skipJavaDBUpdate: false
+    # OCI repository to retrieve the trivy vulnerability database from
+    dbRepository: "ghcr.io/aquasecurity/trivy-db"
+    # OCI repository to retrieve the Java trivy vulnerability database from
+    javaDBRepository: "ghcr.io/aquasecurity/trivy-java-db"
     # offlineScan the flag to disable external API requests to identify dependencies.
     offlineScan: false
     ## gitHubToken the GitHub access token to download Trivy DB
@@ -98,7 +102,7 @@ scanner:
     gitHubToken: ""
     ## insecure the flag to skip verifying registry certificate
     insecure: false
-    # See https://github.com/aquasecurity/trivy#filter-the-vulnerabilities-by-open-policy-agent-policy for details
+    # See https://github.com/goharbor/trivy#filter-the-vulnerabilities-by-open-policy-agent-policy for details
     ignorePolicy: ""
     # ignorePolicy:  |
     #  package trivy

pkg/etc/config.go

@@ -34,6 +34,8 @@ type Trivy struct {
 	IgnorePolicy     string        `env:"SCANNER_TRIVY_IGNORE_POLICY"`
 	SkipDBUpdate     bool          `env:"SCANNER_TRIVY_SKIP_UPDATE" envDefault:"false"`
 	SkipJavaDBUpdate bool          `env:"SCANNER_TRIVY_SKIP_JAVA_DB_UPDATE" envDefault:"false"`
+	DBRepository     string        `env:"SCANNER_TRIVY_DB_REPOSITORY" envDefault:"ghcr.io/aquasecurity/trivy-db"`
+	JavaDBRepository string        `env:"SCANNER_TRIVY_JAVA_DB_REPOSITORY" envDefault:"ghcr.io/aquasecurity/trivy-java-db"`
 	OfflineScan      bool          `env:"SCANNER_TRIVY_OFFLINE_SCAN" envDefault:"false"`
 	GitHubToken      string        `env:"SCANNER_TRIVY_GITHUB_TOKEN"`
 	Insecure         bool          `env:"SCANNER_TRIVY_INSECURE" envDefault:"false"`

pkg/trivy/wrapper.go

@@ -203,6 +203,14 @@ func (w *wrapper) prepareScanCmd(target ScanTarget, outputFile string, opt ScanO
 		args = append(args, "--ignore-policy", w.config.IgnorePolicy)
 	}
 
+	if w.config.DBRepository != "" {
+		args = append(args, "--db-repository", w.config.DBRepository)
+	}
+
+	if w.config.JavaDBRepository != "" {
+		args = append(args, "--java-db-repository", w.config.JavaDBRepository)
+	}
+
 	if w.config.DebugMode {
 		args = append(args, "--debug")
 	}

pkg/trivy/wrapper_test.go

@@ -115,6 +115,8 @@ func TestWrapper_Scan(t *testing.T) {
 			IgnorePolicy:     "/home/scanner/opa/policy.rego",
 			SkipDBUpdate:     true,
 			SkipJavaDBUpdate: true,
+			DBRepository:     "ghcr.io/aquasecurity/trivy-db",
+			JavaDBRepository: "ghcr.io/aquasecurity/trivy-java-db",
 			GitHubToken:      "<github_token>",
 			Insecure:         true,
 			Timeout:          5 * time.Minute,
@@ -153,6 +155,10 @@ func TestWrapper_Scan(t *testing.T) {
 				"--ignore-unfixed",
 				"--skip-db-update",
 				"--skip-java-db-update",
+				"--db-repository",
+				"ghcr.io/aquasecurity/trivy-db",
+				"--java-db-repository",
+				"ghcr.io/aquasecurity/trivy-java-db",
 				"--ignore-policy",
 				"/home/scanner/opa/policy.rego",
 				"--debug",