add Library Scan (with image scan)

[tomoyamachi]

What did you implement:

add library scan via trivy.

• Gemfile.lock
• Pipfile.lock
• poetry.lock
• composer.lock
• package-lock.json
• yarn.lock
• Cargo.lock

Type of change

Please delete options that are not relevant.

• New feature (non-breaking change which adds functionality)

How Has This Been Tested?

test on the following config file.

[servers]

[servers.abuntu]
host         = "xxx.xxx.xxx"
port        = "22"
user        = "tamachi"
keyPath     = "/Users/amachi/.ssh/id_dsa"
findLock = true # auto detect lockfile
lockfiles = [
  "/home/tamachi/lockfiles/package-lock.json"
  "/home/tamachi/lockfiles/yarn.lock"
]

[servers.image]
type="pseudo"
    [servers.image.images.hyperkube]
    name="gcr.io/google-containers/hyperkube"
    tag="v1.11.10"
    [servers.image.images.web-dvwa]
    name="vulnerables/web-dvwa"
    tag="latest"
    [servers.image.images.gcr]
    name="asia.gcr.io/bizshift-stg/api"
    tag="latest"
        [servers.image.images.gcr.dockerOption]
        gcpCredPath="/Users/amachi/Downloads/key.json"

Checklist:

You don't have to satisfy all of the following.

• Write tests
• Write documentation
• Check that there aren't other open pull requests for the same issue/feature
• Format your source code by make fmt
• Pass the test by make test
• Provide verification config / commands
• Enable "Allow edits from maintainers" for this PR
• Update the messages below

[bcmills]

Hi, I got here from golang/go#32879. We're not sure whether this version string should/will be valid in Go 1.13, since it refers to the same commit as v0.16.1.

Could you share some info on how you produced this version string? I'm curious as to how you arrived at a pseudo-version instead of the tagged version.

CC @jayconrod @heschik

[tomoyamachi]

@bcmills That was an odd way.

1. git checkout -b <branch>
2. fixed in a forked repository
3. git tag v0.16.2 && git push origin <branch> --tags
4. add replace github.com/genuinetools/reg => github.com/tomoyamachi/reg v0.16.2 to go.mod, and run go mod tidy
5. something wrong in step 4
6. git tag -d v0.16.2 && git push --tags
7. add replace github.com/genuinetools/reg => github.com/tomoyamachi/reg <branch> to go.mod, and run go mod tidy
8. auto generate v0.16.2-0.20190418055600-c6010b917a55

go version go1.12.3 darwin/amd64

I hope this answer helps you.

[tomoyamachi]

Anyway, I will fix the current versioning.