Skip to content

Commit 3a0ec0f

Browse files
knqyf263DmitriyLewen
knqyf263
and
DmitriyLewen
authored
feat(vuln): add Root.io support for container image scanning (#9073)
Co-authored-by: DmitriyLewen <[email protected]>
1 parent 41d0f94 commit 3a0ec0f

27 files changed

+1481
-24
lines changed

‎docs/docs/coverage/others/index.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ Trivy supports them for
1515
| [Bitnami packages](bitnami.md) | `/opt/bitnami/<component>/.spdx-<component>.spdx` | ✅ | ✅ | - | - |
1616
| [Conda](conda.md) | `<conda-root>/envs/<env>/conda-meta/<package>.json` | ✅ | ✅ | - | - |
1717
| | `environment.yml` | - | - | ✅ | ✅ |
18+
| [Root.io images](rootio.md) | - | ✅ | ✅ | - | - |
1819
| [RPM Archives](rpm.md) | `*.rpm` | ✅[^5] | ✅[^5] | ✅[^5] | ✅[^5] |
1920

2021
[sbom]: ../../supply-chain/sbom.md

‎docs/docs/coverage/others/rootio.md

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Root.io
2+
3+
!!! warning "EXPERIMENTAL"
4+
Scanning results may be inaccurate.
5+
6+
While it is not an OS, this page describes the details of [Root.io](https://root.io/) patch distribution service.
7+
Root.io provides security patches for [Debian](../os/debian.md), [Ubuntu](../os/ubuntu.md), and [Alpine](../os/alpine.md)-based container images.
8+
Root.io patches are detected when Trivy finds packages with specific version suffixes:
9+
10+
- **Debian/Ubuntu**: packages with `.root.io` in version string
11+
- **Alpine**: packages with `-r\d007\d` pattern in version string (e.g., `-r10071`, `-r20072`)
12+
13+
When Root.io patches are detected, Trivy automatically switches to Root.io scanning mode for vulnerability detection.
14+
Even when the original OS distributor (Debian, Ubuntu, Alpine) has not provided a patch for a vulnerability, Trivy will display Root.io patches if they are available.
15+
16+
For detailed information about supported scanners, features, and functionality, please refer to the documentation for the underlying OS:
17+
18+
- [Debian](../os/debian.md)
19+
- [Ubuntu](../os/ubuntu.md)
20+
- [Alpine](../os/alpine.md)

‎docs/docs/references/configuration/cli/trivy_filesystem.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,7 @@ trivy filesystem [flags] PATH
169169
- govulndb
170170
- echo
171171
- minimos
172+
- rootio
172173
- auto
173174
(default [auto])
174175
```

‎docs/docs/references/configuration/cli/trivy_image.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -190,6 +190,7 @@ trivy image [flags] IMAGE_NAME
190190
- govulndb
191191
- echo
192192
- minimos
193+
- rootio
193194
- auto
194195
(default [auto])
195196
```

‎docs/docs/references/configuration/cli/trivy_kubernetes.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -178,6 +178,7 @@ trivy kubernetes [flags] [CONTEXT]
178178
- govulndb
179179
- echo
180180
- minimos
181+
- rootio
181182
- auto
182183
(default [auto])
183184
```

‎docs/docs/references/configuration/cli/trivy_repository.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -168,6 +168,7 @@ trivy repository [flags] (REPO_PATH | REPO_URL)
168168
- govulndb
169169
- echo
170170
- minimos
171+
- rootio
171172
- auto
172173
(default [auto])
173174
```

‎docs/docs/references/configuration/cli/trivy_rootfs.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,6 +170,7 @@ trivy rootfs [flags] ROOTDIR
170170
- govulndb
171171
- echo
172172
- minimos
173+
- rootio
173174
- auto
174175
(default [auto])
175176
```

‎docs/docs/references/configuration/cli/trivy_sbom.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,7 @@ trivy sbom [flags] SBOM_PATH
139139
- govulndb
140140
- echo
141141
- minimos
142+
- rootio
142143
- auto
143144
(default [auto])
144145
```

‎docs/docs/references/configuration/cli/trivy_vm.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,7 @@ trivy vm [flags] VM_IMAGE
155155
- govulndb
156156
- echo
157157
- minimos
158+
- rootio
158159
- auto
159160
(default [auto])
160161
```

‎docs/docs/scanner/vulnerability.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ See [here](../coverage/os/index.md#supported-os) for the supported OSes.
3737
| Azure Linux (CBL-Mariner) | [OVAL][azure] |
3838
| OpenSUSE/SLES | [CVRF][suse] |
3939
| Photon OS | [Photon Security Advisory][photon] |
40+
| Root.io | [Root.io Patch Feed][rootio] |
4041

4142
#### Data Source Selection
4243
Trivy **only** consumes security advisories from the sources listed in the above table.
@@ -394,6 +395,7 @@ Example logic for the following vendor severity levels when scanning an Alpine i
394395
[suse]: http://ftp.suse.com/pub/projects/security/cvrf/
395396
[photon]: https://packages.vmware.com/photon/photon_cve_metadata/
396397
[azure]: https://github.com/microsoft/AzureLinuxVulnerabilityData/
398+
[rootio]: https://api.root.io/external/patch_feed
397399
398400
[php-ghsa]: https://github.com/advisories?query=ecosystem%3Acomposer
399401
[python-ghsa]: https://github.com/advisories?query=ecosystem%3Apip

0 commit comments

Comments
 (0)