Help us shape the future of Go! Take the 2026 Go Developer Survey

content

package
v0.27.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 26, 2026 License: GPL-3.0 Imports: 35 Imported by: 0

Documentation

Overview

Package content manages the data the sensor's scanners scan with, apart from their binaries: trivy's vulnerability database, the nuclei templates and the semgrep rules (api docs/rfcs/RFC-031-scanner-content-and-managed-sensor-updates.md).

For each kind of content the manager refreshes on a schedule and on demand (the platform's refresh_content command), downloads into a staging directory, verifies, and only then swaps the new version in atomically. A failed download or verification leaves the current version in place and is reported. Scans take the current version when they start (Acquire) and keep it to the end, so a refresh never changes content under a running scan; the previous version is kept for rollback. What the sensor has is reported per tool on the heartbeat (core.ToolInfo.Content).

Where content comes from (registries, mirrors, local directories) is the sensor host's configuration only. The platform's policy can pin versions, set the maximum age and choose semgrep rulesets, but never a source.

Index

Constants

View Source 
const (
	EnvContent            = "SENSOR_CONTENT"                  // "off" disables content management
	EnvDir                = "SENSOR_CONTENT_DIR"              // content root
	EnvInterval           = "SENSOR_CONTENT_REFRESH_INTERVAL" // e.g. "6h"
	EnvKeep               = "SENSOR_CONTENT_KEEP"             // previous versions kept
	EnvTrivyRepos         = "SENSOR_CONTENT_TRIVY_DB_REPOSITORY"
	EnvTrivyJavaDB        = "SENSOR_CONTENT_TRIVY_JAVA_DB"
	EnvTrivyJavaRepo      = "SENSOR_CONTENT_TRIVY_JAVA_DB_REPOSITORY"
	EnvNucleiURL          = "SENSOR_CONTENT_NUCLEI_TEMPLATES_URL"
	EnvNucleiChecksumsURL = "SENSOR_CONTENT_NUCLEI_TEMPLATES_CHECKSUMS_URL"
	EnvNucleiLatestURL    = "SENSOR_CONTENT_NUCLEI_TEMPLATES_LATEST_URL"
	EnvNucleiVersion      = "SENSOR_CONTENT_NUCLEI_TEMPLATES_VERSION"
	EnvNucleiSHA256       = "SENSOR_CONTENT_NUCLEI_TEMPLATES_SHA256"
	EnvNucleiDir          = "SENSOR_CONTENT_NUCLEI_TEMPLATES_DIR"
	EnvNucleiMin          = "SENSOR_CONTENT_NUCLEI_MIN_TEMPLATES"
	EnvNucleiMaxErrors    = "SENSOR_CONTENT_NUCLEI_MAX_TEMPLATE_ERRORS"
	EnvSemgrepRulesets    = "SENSOR_CONTENT_SEMGREP_RULESETS"
	EnvSemgrepRegistry    = "SENSOR_CONTENT_SEMGREP_REGISTRY_URL"
	EnvSemgrepRulesPath   = "SENSOR_CONTENT_SEMGREP_RULES_PATH"
	EnvSemgrepSkipCheck   = "SENSOR_CONTENT_SEMGREP_SKIP_CHECK"
	// The OpenCTEM rules pack: a pinned release (vX.Y.Z) and a mirror of
	// its release downloads (a URL template with {version} and
	// {bare_version}; the signature is checked all the same).
	EnvRulesPackVersion = "SENSOR_CONTENT_SAST_RULES_VERSION"
	EnvRulesPackURL     = "SENSOR_CONTENT_SAST_RULES_URL"
)

Environment variables (all optional).

View Source 
const (
	DefaultNucleiLatestURL    = "https://api.github.com/repos/projectdiscovery/nuclei-templates/releases/latest"
	DefaultNucleiTagURL       = "https://api.github.com/repos/projectdiscovery/nuclei-templates/releases/tags/{version}"
	DefaultNucleiArchiveURL   = "https://github.com/projectdiscovery/nuclei-templates/archive/refs/tags/{version}.tar.gz"
	DefaultNucleiChecksumsURL = "" /* 126-byte string literal not displayed */
	// DefaultNucleiMinTemplates: a release has over ten thousand; fewer than
	// this means a broken or truncated archive.
	DefaultNucleiMinTemplates = 1000
	// DefaultNucleiMaxTemplateErrors is how many templates of a release
	// may fail nuclei's own validation before the release is refused. A
	// release is validated with the private configuration every scan uses
	// (nuclei.NewConfigHome), so a template fails only when this nuclei
	// cannot load it (a release newer than the engine, a broken template):
	// a few such templates do not hold back the rest of a release; more
	// mean the release and the engine do not match.
	DefaultNucleiMaxTemplateErrors = 10

	// BakedReleaseFile records, next to nuclei's own config in the image
	// ($HOME/.config/nuclei), which release the baked templates are and
	// the digest of the archive they were extracted from (written at
	// image build after the archive's SHA-256 was verified).
	BakedReleaseFile = "openctem-templates-release.json"
)

Default nuclei-templates locations (GitHub releases).

View Source 
const (
	DefaultPackLatestURL   = "https://api.github.com/repos/openctemio/sast-rules/releases/latest"
	DefaultPackTagURL      = "https://api.github.com/repos/openctemio/sast-rules/releases/tags/{version}"
	DefaultPackDownloadURL = "https://github.com/openctemio/sast-rules/releases/download/{version}/sast-rules-{bare_version}.tar.gz"
)

The OpenCTEM rules pack (github.com/openctemio/sast-rules): the default rules when no local path and no rulesets are chosen. Each release is a tarball signed (cosign keyless) by the repository's release workflow; the bundle is installed only when that signature verifies.

View Source 
const (
	DefaultInterval = 6 * time.Hour
)

Default schedule.

View Source 
const DefaultSemgrepRegistry = "https://semgrep.dev"

DefaultSemgrepRegistry is where rulesets are fetched (GET <registry>/c/<ruleset>).

View Source 
const EngineOpengrep = "opengrep"

EngineOpengrep names opengrep as the rules' engine.

Variables

View Source 
var DefaultTrivyDBRepositories = []string{"mirror.gcr.io/aquasec/trivy-db:2", "ghcr.io/aquasecurity/trivy-db:2"}

DefaultTrivyDBRepositories are tried in order: trivy's own default (mirror.gcr.io) and the upstream registry.

View Source 
var ErrNoSource = errors.New("unknown content")

ErrNoSource is returned for a content name the manager does not know.

View Source 
var ErrTooLarge = errors.New("content exceeds its size limit")

ErrTooLarge is returned when content exceeds its size limit.

Functions

func ToolOf 

func ToolOf(scanner string) string

ToolOf maps a scanner name to the tool whose content it uses ("trivy-fs" and the other trivy modes use trivy's).

Types

type CommandExecutor 

type CommandExecutor struct {
	Inner   core.CommandExecutor
	Manager *Manager
	// Timeout bounds one refresh command (default 30 minutes).
	Timeout time.Duration
}

CommandExecutor handles refresh_content commands and delegates every other command to Inner.

func (*CommandExecutor) Execute 

func (e *CommandExecutor) Execute(ctx context.Context, cmd *core.Command) (*core.CommandExecutionResult, error)

Execute implements core.CommandExecutor.

type Config 

type Config struct {
	// Root is the content directory.
	Root string
	// Interval is the default refresh interval (the policy may override it).
	Interval time.Duration
	// Keep is how many previous versions are kept for rollback: 0 means
	// the default (1), a negative value none.
	Keep int
	// Verbose logs every refresh.
	Verbose bool
	// Now is the clock (tests).
	Now func() time.Time
	// Logf logs (default: fmt.Printf with a prefix).
	Logf func(format string, args ...any)
}

Config configures a Manager.

type Fetcher 

type Fetcher struct {
	// Client overrides the client (tests).
	Client *http.Client
	// Trusted marks every URL this fetcher reads as host-operator
	// configuration (see above).
	Trusted bool
	// AllowHTTP permits plain http:// URLs (tests; an internal mirror the
	// host operator explicitly configured).
	AllowHTTP bool
}

Fetcher reads content over HTTPS or from local files (file:// URLs or plain paths, for air-gapped hosts).

Outbound clients come from sdk-go httpsec (security-lint Rule 1):

  • the default upstream sources (GitHub, the semgrep registry) are reached with httpsec.SafeHTTPClient, which refuses private, loopback and metadata addresses and re-checks every redirect;
  • a mirror the host operator configured on the sensor (environment, an internal web server that is often on a private address) is reached with httpsec.NewAPIClient, the same trust as SENSOR_API_URL: private addresses allowed, link-local/metadata refused, no redirects.

Sources never come from the platform (api RFC-031 D2: the policy has no URL member), so nothing the platform sends can reach the trusted client.

type Handle 

type Handle struct {
	// Dir is the version directory (absolute, resolved).
	Dir  string
	Meta Meta
	// contains filtered or unexported fields
}

Handle is a version held by a running scan.

func (*Handle) Info 

func (h *Handle) Info() core.ContentInfo

Info is the handle's content as reported.

func (*Handle) Release 

func (h *Handle) Release()

Release lets the version be removed once it is neither current nor kept.

type Importer 

type Importer interface {
	// Baked returns the directory and metadata of baked content, or ok false.
	Baked() (dir string, m *Meta, ok bool)
}

Importer is implemented by a source that can adopt content baked into the image as its first version.

type Manager 

type Manager struct {
	// contains filtered or unexported fields
}

Manager manages the content of every source.

func New 

func New(cfg Config, sources ...Source) (*Manager, error)

New returns a manager over sources. It creates the root, removes staging directories a crash left behind, loads the stored policy and imports content baked into the image where nothing is installed yet.

func NewFromSettings 

func NewFromSettings(s Settings, tools Tools, verbose bool) (*Manager, error)

NewFromSettings builds a manager with a source per tool in use. Baked content is looked for in TRIVY_CACHE_DIR and $HOME/nuclei-templates.

func (*Manager) Acquire 

func (m *Manager) Acquire(name string) *Handle

Acquire returns the current version of content name for a scan, or nil when there is none (the scan then runs as the tool would on its own). The caller must Release it when the scan ends.

func (*Manager) AcquireFor 

func (m *Manager) AcquireFor(tool, name string) *Handle

AcquireFor takes the current version of content name for a scan of tool and records it as the content that scan uses (for its results). nil: no managed version (nil manager included).

func (*Manager) AcquireWait added in v0.12.0 

func (m *Manager) AcquireWait(ctx context.Context, name string) *Handle

AcquireWait is Acquire for a lookup that must not conclude "not installed" from an install in progress: when content name has no current version yet but a refresh of it is running, it waits for that refresh (until ctx ends) and takes what it installed. A version that is already current is returned at once; a refresh replacing it never blocks a reader, which keeps the version it took (the swap is atomic). nil: nothing is installed and no refresh is running, the refresh failed, or ctx ended.

func (*Manager) Content 

func (m *Manager) Content() []core.ContentInfo

Content returns every content's report, for a command result.

func (*Manager) Decorate 

func (m *Manager) Decorate(r core.CapabilityReport) core.CapabilityReport

Decorate attaches the content of each reported tool to a capability report. A reporter that builds the tool inventory itself wraps its report with it.

func (*Manager) LastUsed 

func (m *Manager) LastUsed(tool string) []core.ContentInfo

LastUsed returns the content the last scan of tool started with.

func (*Manager) Names 

func (m *Manager) Names() []string

Names returns the content names, in registration order.

func (*Manager) NoteUsed 

func (m *Manager) NoteUsed(tool string, content []core.ContentInfo)

NoteUsed records the content a scan of tool used, for its results.

func (*Manager) NucleiTemplates 

func (m *Manager) NucleiTemplates(ctx context.Context) (string, core.ContentInfo, func())

NucleiTemplates returns the managed templates directory for a nuclei re-verification, the release it holds and the func that releases it, or "", a zero release and a no-op. A re-verification looks its template up in that set, and a template missing from it reads as "not installed", so while the first release is still being installed it waits for it (until ctx ends) instead of looking in an empty set.

func (*Manager) Policy 

func (m *Manager) Policy() core.ContentPolicy

Policy returns the policy in force.

func (*Manager) Refresh 

func (m *Manager) Refresh(ctx context.Context, names []string, force bool) []Result

Refresh refreshes the named content (all when names is empty). Content still within its maximum age is refreshed too: the source is asked what it has and nothing is downloaded when that is what is current, unless force is set. A refresh already running for a content is joined, not repeated.

func (*Manager) Report 

func (m *Manager) Report(tool string) []core.ContentInfo

Report returns the content of tool as the heartbeat reports it.

func (*Manager) Root 

func (m *Manager) Root() string

Root returns the content directory.

func (*Manager) Run 

func (m *Manager) Run(ctx context.Context)

Run refreshes on schedule until ctx ends: a first check shortly after start, then every interval.

func (*Manager) SetPolicy 

func (m *Manager) SetPolicy(p core.ContentPolicy) error

SetPolicy replaces the policy and keeps it for the next start.

func (*Manager) Wake 

func (m *Manager) Wake()

Wake makes the scheduler re-plan now (a new policy).

func (*Manager) WrapParser 

func (m *Manager) WrapParser(p core.Parser) core.Parser

WrapParser makes a scanner parser stamp the content its tool's scan used onto every report it produces (tool.properties.content), so one-shot, scheduled and dispatched results all carry it whatever pushes them. A nil manager returns p as is.

func (*Manager) WrapScanner 

func (m *Manager) WrapScanner(s core.Scanner) core.Scanner

WrapScanner makes a scanner run on the managed content: every scan takes the current version when it starts and runs a copy of the scanner set up for it, so the shared scanner is never modified and concurrent scans do not interfere. Without a managed version the scanner runs unchanged. Scanners without managed content are returned as they are.

type Meta 

type Meta struct {
	// ID is the version directory's name.
	ID        string     `json:"id"`
	Name      string     `json:"name"`
	Version   string     `json:"version,omitempty"`
	UpdatedAt *time.Time `json:"updated_at,omitempty"`
	FetchedAt time.Time  `json:"fetched_at"`
	// CheckedAt is when the source last confirmed this is the newest (or
	// the pinned) version: set on install and on every unchanged check.
	CheckedAt *time.Time `json:"checked_at,omitempty"`
	// Pinned is set when the policy pinned this version: it may be older
	// than what was installed before, so it is no floor for anti-rollback.
	Pinned bool   `json:"pinned,omitempty"`
	Source string `json:"source,omitempty"`
	Digest string `json:"digest,omitempty"`
	// Checks lists the verification steps this version passed.
	Checks []string `json:"checks,omitempty"`
	// Also is content installed together with this one in the same
	// directory (trivy's Java DB next to its vulnerability DB).
	Also []Meta `json:"also,omitempty"`
}

Meta describes one installed version.

type NucleiTemplates 

type NucleiTemplates struct {
	Binary string // nuclei binary (default "nuclei"), for the load check
	// LatestURL answers the newest release: GitHub's releases/latest JSON
	// ({"tag_name", "published_at"}) or a plain-text tag. Empty: only a
	// pinned version (policy or Version) can be installed.
	LatestURL string
	// TagURL answers one release by tag ({version}), GitHub-shaped; it gives
	// a pinned release its publication date. Empty (mirrors): a pinned
	// release from a local file is dated by the file's mtime, one from an
	// https mirror has no publication date and its age is measured from
	// when the sensor installed it.
	TagURL string
	// ArchiveURL and ChecksumsURL locate a release; {version} is the tag
	// ("v10.4.9"), {bare_version} the tag without "v". https:// or a
	// local file (file:// or an absolute path).
	ArchiveURL   string
	ChecksumsURL string
	// LocalDir, when set, is a template directory installed as is (an
	// air-gapped host's copy), versioned by Version or its digest.
	LocalDir string
	// Version pins the release when the policy does not.
	Version string
	// SHA256 pins the archive digest (hex), instead of the checksums file.
	SHA256       string
	MinTemplates int
	// MaxTemplateErrors is how many templates may fail validation (0:
	// DefaultNucleiMaxTemplateErrors; negative: none).
	MaxTemplateErrors int
	BakedDir          string // templates baked into the image, imported first
	Fetcher           *Fetcher
	Timeout           time.Duration
}

NucleiTemplates is the nuclei-templates release a sensor scans with.

func (*NucleiTemplates) Baked 

func (n *NucleiTemplates) Baked() (string, *Meta, bool)

Baked implements Importer: the templates an image was built with ($HOME/nuclei-templates), with the release and archive digest the image build recorded (BakedReleaseFile), else the version nuclei recorded.

func (*NucleiTemplates) Fetch 

func (n *NucleiTemplates) Fetch(ctx context.Context, dir string, r *Remote, _ core.ContentPin) (*Meta, error)

Fetch implements Source.

func (*NucleiTemplates) Name 

func (n *NucleiTemplates) Name() string

Name implements Source.

func (*NucleiTemplates) Resolve 

func (n *NucleiTemplates) Resolve(ctx context.Context, pin core.ContentPin) (*Remote, error)

Resolve implements Source: the release tag (pinned or newest) and the archive digest from the release's checksums file (or the pinned digest).

func (*NucleiTemplates) Tool 

func (n *NucleiTemplates) Tool() string

Tool implements Source.

func (*NucleiTemplates) Verify 

func (n *NucleiTemplates) Verify(ctx context.Context, dir string, m *Meta) error

Verify implements Source: enough templates on disk, nuclei loads them, and nuclei's own validation (-validate, signed templates only) passes for all but at most maxTemplateErrors of them. Both run with the private configuration a scan of this version uses (templates directory, release, exclusion list), so what passes here is what a scan runs.

type OCIRef 

type OCIRef struct {
	Host, Repo, Tag, Digest string
}

OCIRef is a parsed "host/repo/path:tag" or "host/repo@sha256:..." reference.

func ParseOCIRef 

func ParseOCIRef(s string) (OCIRef, error)

ParseOCIRef parses an image reference with an explicit registry host.

func (OCIRef) Name 

func (r OCIRef) Name() string

Name is host/repo without tag or digest.

func (OCIRef) String 

func (r OCIRef) String() string

String is the reference as written.

type OCIResolver 

type OCIResolver struct {
	// Client overrides the client (tests). Otherwise a registry the host
	// operator configured (Trusted) is reached with httpsec.NewAPIClient
	// (private addresses allowed: internal mirrors), and the default public
	// registries with httpsec.SafeHTTPClient. See Fetcher.
	Client *http.Client
	// Trusted marks the registries as host-operator configuration.
	Trusted bool
	// Scheme is "https" (default); tests use "http".
	Scheme string
	// Username and Password are optional basic credentials.
	Username, Password string
}

OCIResolver resolves references against a registry.

func (*OCIResolver) ResolveDigest 

func (o *OCIResolver) ResolveDigest(ctx context.Context, ref OCIRef) (string, error)

ResolveDigest returns the manifest digest ref points at.

type Preparer 

type Preparer interface {
	Prepare(versionDir string) error
}

Preparer is implemented by a source that adjusts a version directory after install (trivy's shared Java DB link).

type ProbeFunc 

type ProbeFunc func(ctx context.Context, tool string) (version string, installed bool)

ProbeFunc reports a tool's installed version.

type Pusher 

type Pusher struct {
	core.Pusher
	Manager *Manager
}

Pusher stamps the content a scan used onto its results (tool.properties.content) and delegates to the inner pusher.

The content is the version the tool's most recent scan started with. Two scans of one tool that overlap a content swap can be stamped with the newer one; scans themselves always run on one consistent version.

func (*Pusher) PushAssets 

func (p *Pusher) PushAssets(ctx context.Context, report *ctis.Report) (*core.PushResult, error)

PushAssets implements core.Pusher.

func (*Pusher) PushFindings 

func (p *Pusher) PushFindings(ctx context.Context, report *ctis.Report) (*core.PushResult, error)

PushFindings implements core.Pusher.

func (*Pusher) Stamp 

func (p *Pusher) Stamp(report *ctis.Report)

Stamp writes the content the report's tool last scanned with into report.Tool.Properties["content"] (ctis tool properties are free-form).

type Remote 

type Remote struct {
	// Version and Digest identify it; Digest may be empty when the source
	// cannot tell before downloading.
	Version   string
	Digest    string
	UpdatedAt *time.Time
	// Ref is the source's own handle for Fetch (a repository@digest, a URL).
	Ref string
	// Source names where it comes from (reported).
	Source string
}

Remote is what a source offers right now.

type Reporter 

type Reporter struct {
	Manager *Manager
	// Tools are the canonical tool names configured on the sensor.
	Tools []string
	Probe ProbeFunc
	// TTL is how long a probe is reused (default 10 minutes).
	TTL time.Duration
	// contains filtered or unexported fields
}

Reporter reports the configured tools, their versions and their content on every heartbeat. Tool probes are cached.

func (*Reporter) CapabilityReport 

func (r *Reporter) CapabilityReport(ctx context.Context) core.CapabilityReport

CapabilityReport implements core.CapabilityReporter. Capabilities and concurrency are not reported here.

type Result 

type Result struct {
	Name      string
	Refreshed bool // a new version became current
	Unchanged bool // the source offers what is current
	Skipped   bool // not managed
	// Reason says why a content was skipped.
	Reason string
	Err    error
}

Result is the outcome of refreshing one content.

type SemgrepRules 

type SemgrepRules struct {
	// Engine is the tool that runs the rules and checks a new bundle:
	// "semgrep" (default) or "opengrep". Both read the same rules.
	Engine   string
	Binary   string // the engine's binary (default: the engine's name), for the check
	Registry string // registry base URL
	// Rulesets are fetched when the policy names none.
	Rulesets []string
	// LocalPath is a rules file or directory installed as is (air-gapped).
	LocalPath string
	Fetcher   *Fetcher
	// SkipCheck skips running semgrep over the rules (the Go-level check
	// still runs).
	SkipCheck bool
	Timeout   time.Duration
	// PackVersion pins a release of the rules pack (vX.Y.Z) when the policy
	// pins none. PackLatestURL, PackTagURL and PackDownloadURL default to the
	// pack's GitHub releases; a mirror may replace them (the signature is
	// still checked against the pack's release workflow).
	PackVersion     string
	PackLatestURL   string
	PackTagURL      string
	PackDownloadURL string
	// contains filtered or unexported fields
}

SemgrepRules is the rules bundle semgrep and opengrep run, always managed. Its source, in order: a local rules path (air-gapped); the registry rulesets the policy or the operator chose (fetched under the registry's licence, by their choice); otherwise the signed OpenCTEM rules pack (a pinned release, or the newest).

func (*SemgrepRules) Fetch 

func (s *SemgrepRules) Fetch(ctx context.Context, dir string, r *Remote, pin core.ContentPin) (*Meta, error)

Fetch implements Source.

func (*SemgrepRules) Name 

func (s *SemgrepRules) Name() string

Name implements Source.

func (*SemgrepRules) Resolve 

func (s *SemgrepRules) Resolve(ctx context.Context, pin core.ContentPin) (*Remote, error)

Resolve implements Source. A registry cannot tell what a ruleset holds without fetching it, so the comparison happens after Fetch.

func (*SemgrepRules) Tool 

func (s *SemgrepRules) Tool() string

Tool implements Source.

func (*SemgrepRules) Verify 

func (s *SemgrepRules) Verify(ctx context.Context, dir string, m *Meta) error

Verify implements Source: every file is a rules document with rules that have ids, and semgrep accepts the whole bundle.

type Settings 

type Settings struct {
	Enabled  bool
	Root     string
	Interval time.Duration
	Keep     int

	TrivyRepositories []string
	TrivyJavaDB       bool
	TrivyJavaRepo     string

	NucleiArchiveURL   string
	NucleiChecksumsURL string
	NucleiLatestURL    string
	NucleiTagURL       string
	NucleiVersion      string
	NucleiSHA256       string
	NucleiDir          string
	NucleiMin          int
	// NucleiMaxErrors: templates allowed to fail validation (0: the
	// default; -1 from "0" in the environment: none).
	NucleiMaxErrors int
	// NucleiMirror is true when the host operator set any nuclei URL. Only
	// then is the source trusted; the GitHub defaults filled in below are not.
	NucleiMirror bool

	SemgrepRulesets  []string
	SemgrepRegistry  string
	SemgrepRulesPath string
	SemgrepSkipCheck bool
	RulesPackVersion string
	RulesPackURL     string
}

Settings are the host's content settings, from the environment.

func SettingsFromEnv 

func SettingsFromEnv(lookup func(string) (string, bool)) (Settings, error)

SettingsFromEnv reads the settings; lookup is os.LookupEnv in production.

type Source 

type Source interface {
	// Name is the content name (core.ContentTrivyDB, ...).
	Name() string
	// Tool is the tool that uses it ("trivy", "nuclei", "semgrep").
	Tool() string
	// Resolve finds the version to install under pin.
	Resolve(ctx context.Context, pin core.ContentPin) (*Remote, error)
	// Fetch downloads r into the empty directory dir.
	Fetch(ctx context.Context, dir string, r *Remote, pin core.ContentPin) (*Meta, error)
	// Verify checks a fetched directory before it can become current, and
	// records the checks passed on m.
	Verify(ctx context.Context, dir string, m *Meta) error
}

Source is one kind of content.

type Tools 

type Tools struct {
	Trivy, Nuclei, Semgrep, Opengrep bool
}

Tools are the content-using tools a sensor runs, by canonical name.

type TrivyDB 

type TrivyDB struct {
	Binary       string   // trivy binary (default "trivy")
	Repositories []string // OCI repositories, tried in order
	// JavaDB also manages the Java DB (about 800 MB more per version).
	JavaDB bool
	// JavaRepository overrides trivy's Java DB repository.
	JavaRepository string
	Resolver       *OCIResolver
	// BakedDir is a trivy cache directory with a DB baked into the image
	// (TRIVY_CACHE_DIR), imported as the first version.
	BakedDir string
	// Root is the manager's content root (for the shared Java DB link).
	Root    string
	Timeout time.Duration
}

TrivyDB is trivy's vulnerability database (and, optionally, its Java DB): one version directory is a trivy cache directory (db/, java-db/) that scans use with --cache-dir and --skip-db-update.

func (*TrivyDB) Baked 

func (t *TrivyDB) Baked() (string, *Meta, bool)

Baked implements Importer: a trivy cache directory that already holds a database (an image built with one, or a cache volume).

func (*TrivyDB) Fetch 

func (t *TrivyDB) Fetch(ctx context.Context, dir string, r *Remote, _ core.ContentPin) (*Meta, error)

Fetch implements Source.

func (*TrivyDB) Name 

func (t *TrivyDB) Name() string

Name implements Source.

func (*TrivyDB) Prepare 

func (t *TrivyDB) Prepare(versionDir string) error

Prepare implements Preparer: without a managed Java DB, a version links java-db to a shared directory, so the Java DB trivy downloads by itself is kept across database versions.

func (*TrivyDB) Resolve 

func (t *TrivyDB) Resolve(ctx context.Context, pin core.ContentPin) (*Remote, error)

Resolve implements Source: the first repository that answers gives the digest (the pinned one when the policy pins it). If none answers, the first repository's tag is used without a digest: trivy still verifies what it downloads, and the version is compared after the download.

func (*TrivyDB) Tool 

func (t *TrivyDB) Tool() string

Tool implements Source.

func (*TrivyDB) Verify 

func (t *TrivyDB) Verify(ctx context.Context, dir string, m *Meta) error

Verify implements Source: trivy itself must read the database's metadata, with the schema this trivy uses.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.