feat(vex): dependency tree checking with vex-repos

[lbu-hlx]

Description

It seams that the dependency tree checking only works when using vex-files and not when using vex-repos.

Target

None

Scanner

Vulnerability

[knqyf263]

It should work. Can you share an example to replicate it?

[lbu-hlx]

i can't really share that but it was a cyclone-dx SBOM and when only using the Vexfile it worked but when using the repository it didn't.

[knqyf263]

You can create a dummy SBOM to reproduce it.

[lbu-hlx]

this should be it
{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9c1f42fd-6f31-435a-b47b-abde0b10457b", "version": 1, "metadata": { "timestamp": "2024-10-21T14:44:10+00:00", "tools": { "components": [ { "type": "application", "group": "aquasecurity", "name": "trivy", "version": "0.55.2" } ] }, "component": { "bom-ref": "pkg:oci/nginx-unprivileged", "type": "container", "name": "nginx-unprivileged:1.25.4", "purl": "pkg:oci/nginx-unprivileged", "properties": [ { "name": "aquasecurity:trivy:DiffID", "value": "sha256:1f00ff20147800878a4ebc9c283f79149a1dde5cc11d659c69d3a9c0bfeb7d4f" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:2380b1ecb14ba2c2fe93b6ec8f01f38cedd31bf7a7cc8a2943959d23640c661e" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:25b70ef66662785852ae251a5ffeb209e160c9b6d67614f32b0598bca0738ab2" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:2bcb22a020f150fe092089da50822744e55e29f93d2f2a4e804deaa24b1ac30a" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:6305e28d0f0d3909637ed015de4f9cafe6f960fe20aeb126f11cd27b7a2bed79" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:8798b722f49573e6b2c60e61ffbb76c2e89a80ff7c510821c554587d0e50938f" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:9525483725487773082a3c45bc824559f9a2136b2c84bf34f3cbc82b940a83c4" }, { "name": "aquasecurity:trivy:DiffID", "value": "sha256:eb2fb1a8c8808377e9e8e822f1331b22b3fd3f6087c486c07e4eff2a7d196d52" }, { "name": "aquasecurity:trivy:ImageID", "value": "sha256:51f207c63ebc1a98de8013e4d34152df78b5e4200403fb986b7ecdc0068dd793" }, { "name": "aquasecurity:trivy:Labels:maintainer", "value": "NGINX Docker Maintainers <[email protected]>" }, { "name": "aquasecurity:trivy:Labels:org.opencontainers.image.created", "value": "2024-04-15T01:16:47.463Z" }, { "name": "aquasecurity:trivy:Labels:org.opencontainers.image.description", "value": "Unprivileged NGINX Dockerfiles" }, { "name": "aquasecurity:trivy:Labels:org.opencontainers.image.licenses", "value": "Apache-2.0" }, { "name": "aquasecurity:trivy:Labels:org.opencontainers.image.revision", "value": "4f965dda61ecfdc67dc09902108db32d683c64aa" }, { "name": "aquasecurity:trivy:Labels:org.opencontainers.image.source", "value": "https://github.com/nginxinc/docker-nginx-unprivileged" }, { "name": "aquasecurity:trivy:Labels:org.opencontainers.image.title", "value": "docker-nginx-unprivileged" }, { "name": "aquasecurity:trivy:Labels:org.opencontainers.image.url", "value": "https://github.com/nginxinc/docker-nginx-unprivileged" }, { "name": "aquasecurity:trivy:Labels:org.opencontainers.image.version", "value": "1.25.4" }, { "name": "aquasecurity:trivy:SchemaVersion", "value": "2" } ] } }, "components": [ { "bom-ref": "1b2550fa-292a-474b-97c5-8debbe2fd0d8", "type": "operating-system", "name": "debian", "version": "12.5", "properties": [ { "name": "aquasecurity:trivy:Class", "value": "os-pkgs" }, { "name": "aquasecurity:trivy:Type", "value": "debian" } ] }, { "bom-ref": "pkg:deb/debian/[email protected]?arch=amd64&distro=debian-12.5", "type": "library", "supplier": { "name": "Debian Multimedia Maintainers <[email protected]>" }, "name": "libaom3", "version": "3.6.0-1", "licenses": [ { "license": { "name": "BSD-2-Clause" } }, { "license": { "name": "public-domain-md5" } }, { "license": { "name": "BSD-3-Clause" } }, { "license": { "name": "ISC" } }, { "license": { "name": "Expat" } } ], "purl": "pkg:deb/debian/[email protected]?arch=amd64&distro=debian-12.5", "properties": [ { "name": "aquasecurity:trivy:LayerDiffID", "value": "sha256:2380b1ecb14ba2c2fe93b6ec8f01f38cedd31bf7a7cc8a2943959d23640c661e" }, { "name": "aquasecurity:trivy:LayerDigest", "value": "sha256:8751d4444391640d7f664e47a7ec9c1ad97e7a6bb62fb0940f05370641adf457" }, { "name": "aquasecurity:trivy:PkgID", "value": "[email protected]" }, { "name": "aquasecurity:trivy:PkgType", "value": "debian" }, { "name": "aquasecurity:trivy:SrcName", "value": "aom" }, { "name": "aquasecurity:trivy:SrcRelease", "value": "1" }, { "name": "aquasecurity:trivy:SrcVersion", "value": "3.6.0" } ] } ], "dependencies": [ { "ref": "1b2550fa-292a-474b-97c5-8debbe2fd0d8", "dependsOn": [ "pkg:deb/debian/[email protected]?arch=amd64&distro=debian-12.5" ] }, { "ref": "pkg:oci/nginx-unprivileged@sha256%3A7e36111660f0dc116a6af1ab053b0b8091f8399ed2e07bd7083635573ffd69b6?arch=amd64&repository_url=jfrog.hub.vwgroup.com%2Fremote-docker-io%2Fnginxinc%2Fnginx-unprivileged", "dependsOn": [ "1b2550fa-292a-474b-97c5-8debbe2fd0d8" ] } ], "vulnerabilities": [] }

edit: sorry made a mistake

[knqyf263]

@DmitriyLewen Do you have time to take a look?

[DmitriyLewen]

Hello @lbu-hlx
I created test repo with your files - https://github.com/DmitriyLewen/test-vex-repo

My repository.json file:

➜  ~ cat .trivy/vex/repository.yaml 
repositories:
  - name: custom
    url: https://github.com/DmitriyLewen/test-vex-repo
    enabled: true

Trivy works as expected:

➜ trivy -d sbom ./test.cdx.json --vex repo --show-suppressed
...
2024-12-05T18:25:21+06:00	DEBUG	[vex] Reading the repository index...	repo="custom" file_path="/Users/dmitriy/Library/Caches/trivy/vex/repositories/custom/0.1/index.json"
2024-12-05T18:25:21+06:00	DEBUG	[vex] VEX found in the repository	package="pkg:oci/nginx-unprivileged" repo="custom" repo_url="https://github.com/DmitriyLewen/test-vex-repo" file_path="pkg/oci/nginx-unprivileged/vex.json"

test.cdx.json (debian 12.5)

Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 1)

┌─────────┬────────────────┬──────────┬──────────────┬───────────────────┬─────────────────┬───────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │    Status    │ Installed Version │  Fixed Version  │                         Title                         │
├─────────┼────────────────┼──────────┼──────────────┼───────────────────┼─────────────────┼───────────────────────────────────────────────────────┤
│ libaom3 │ CVE-2024-5171  │ CRITICAL │ fixed        │ 3.6.0-1           │ 3.6.0-1+deb12u1 │ libaom: Integer overflow in internal                  │
│         │                │          │              │                   │                 │ function img_alloc_helper                             │
│         │                │          │              │                   │                 │ https://avd.aquasec.com/nvd/cve-2024-5171             │
│         ├────────────────┼──────────┼──────────────┤                   ├─────────────────┼───────────────────────────────────────────────────────┤
│         │ CVE-2023-39616 │ HIGH     │ will_not_fix │                   │                 │ AOMedia v3.0.0 to v3.5.0 was discovered to contain an │
│         │                │          │              │                   │                 │ invalid read mem...                                   │
│         │                │          │              │                   │                 │ https://avd.aquasec.com/nvd/cve-2023-39616            │
└─────────┴────────────────┴──────────┴──────────────┴───────────────────┴─────────────────┴───────────────────────────────────────────────────────┘

Suppressed Vulnerabilities (Total: 1)

┌─────────┬───────────────┬──────────┬──────────────┬─────────────────────────────────────┬─────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │    Status    │              Statement              │                     Source                      │
├─────────┼───────────────┼──────────┼──────────────┼─────────────────────────────────────┼─────────────────────────────────────────────────┤
│ libaom3 │ CVE-2023-6879 │ CRITICAL │ not_affected │ vulnerable_code_not_in_execute_path │ VEX Repository: custom                          │
│         │               │          │              │                                     │ (https://github.com/DmitriyLewen/test-vex-repo) │
└─────────┴───────────────┴──────────┴──────────────┴─────────────────────────────────────┴─────────────────────────────────────────────────┘