diff --git a/README.md b/README.md index 17b60aac2112307ba7cf2f21380905a74227189b..69567d6c9d60533e1874a59357445aeca40a91e7 100644 --- a/README.md +++ b/README.md @@ -403,6 +403,8 @@ It is bound to the `package-test` stage, and uses the following variables: | `trivy-security-level-threshold` / `DOCKER_TRIVY_SECURITY_LEVEL_THRESHOLD` | Severities of vulnerabilities to be displayed (comma separated values: `UNKNOWN`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`) | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` | | `trivy-disabled` / `DOCKER_TRIVY_DISABLED` | Set to `true` to disable Trivy analysis | _(none)_ | | `trivy-args` / `DOCKER_TRIVY_ARGS` | Additional [`trivy client` arguments](https://aquasecurity.github.io/trivy/v0.27.1/docs/references/cli/client/) | `--ignore-unfixed --vuln-type os` | +| `trivy-db-repository` / `DOCKER_TRIVY_DB_REPOSITORY` | Set a custom DB repository path for downloading the trivy database | _(none: default "ghcr.io/aquasecurity/trivy-db")_ | + In addition to a textual report in the console, this job produces the following reports, kept for one day: diff --git a/kicker.json b/kicker.json index 6e6243326ab6c83b822150b3524e4b1d9bcaaf46..fc831df2f933ea44f28a2f49e7c089c1de6f53fe 100644 --- a/kicker.json +++ b/kicker.json @@ -196,6 +196,11 @@ "description": "Additional `trivy client` arguments", "default": "--ignore-unfixed --vuln-type os --exit-on-eol 1", "advanced": true + }, + { + "name": "DOCKER_TRIVY_DB_REPOSITORY", + "description": "Custom DB repository path", + "advanced": true } ] }, diff --git a/templates/gitlab-ci-docker.yml b/templates/gitlab-ci-docker.yml index e4808479677c48a8f64a704a553650eca443781d..dba6029e05c289c1dd85c02583ce0e0150f9a8f5 100644 --- a/templates/gitlab-ci-docker.yml +++ b/templates/gitlab-ci-docker.yml @@ -170,6 +170,9 @@ spec: trivy-args: description: Additional `trivy client` arguments default: --ignore-unfixed --vuln-type os --exit-on-eol 1 + trivy-db-repository: + description: Custom DB repository path + default: '' sbom-disabled: description: Disable Software Bill of Materials type: boolean @@ -245,6 +248,7 @@ variables: DOCKER_TRIVY_SECURITY_LEVEL_THRESHOLD: $[[ inputs.trivy-security-level-threshold ]] DOCKER_TRIVY_IMAGE: $[[ inputs.trivy-image ]] DOCKER_TRIVY_ARGS: $[[ inputs.trivy-args ]] + DOCKER_TRIVY_DB_REPOSITORY: $[[ inputs.trivy-db-repository ]] # SBOM genenration image and arguments DOCKER_SBOM_IMAGE: $[[ inputs.sbom-image ]] @@ -926,7 +930,11 @@ docker-trivy: mkdir -p ./reports if [[ -z "${DOCKER_TRIVY_ADDR}" ]]; then log_warn "\\e[93mYou are using Trivy in standalone mode. To get faster scans, consider setting the DOCKER_TRIVY_ADDR variable to the address of a Trivy server. More info here: https://aquasecurity.github.io/trivy/latest/docs/references/modes/client-server/\\e[0m" - trivy image --download-db-only + if [[ -z "${DOCKER_TRIVY_DB_REPOSITORY}" ]]; then + trivy image --download-db-only + else + trivy image --download-db-only --db-repository ${DOCKER_TRIVY_DB_REPOSITORY} + fi export trivy_opts="image" else log_info "You are using Trivy in client/server mode with the following server: ${DOCKER_TRIVY_ADDR}"