Merge branch 'aquasecurity:main' into deps/upgr-go-github-67

Author: chimanjain

.github/CODEOWNERS

@@ -16,6 +16,8 @@ pkg/iac/                              @nikpivkin
 
 # Helm chart
 helm/trivy/ @afdesk
+# Chart.yaml is bumped automatically by CI, so trivy team may approve it.
+helm/trivy/Chart.yaml @aquasecurity/trivy
 
 # Kubernetes scanning
 pkg/k8s/                         @afdesk

go.mod

@@ -1,7 +1,7 @@
 apiVersion: v2
 name: trivy
-version: 0.23.2
-appVersion: 0.71.2
+version: 0.24.0
+appVersion: 0.72.0
 description: Trivy helm chart
 keywords:
   - scanner

go.sum

@@ -4,8 +4,6 @@ import (
 	"archive/zip"
 	"bufio"
 	"context"
-	"crypto/sha1" // nolint:gosec
-	"encoding/hex"
 	"encoding/xml"
 	"errors"
 	"io"
@@ -20,6 +18,7 @@ import (
 	"golang.org/x/net/html/charset"
 	"golang.org/x/xerrors"
 
+	"github.com/aquasecurity/trivy/pkg/digest"
 	ftypes "github.com/aquasecurity/trivy/pkg/fanal/types"
 	"github.com/aquasecurity/trivy/pkg/licensing"
 	"github.com/aquasecurity/trivy/pkg/log"
@@ -41,6 +40,7 @@ type Parser struct {
 	logger                 *log.Logger
 	rootFilePath           string
 	offline                bool
+	checksum               bool
 	size                   int64
 	licenseConfidenceLevel float64
 
@@ -61,6 +61,14 @@ func WithOffline(offline bool) Option {
 	}
 }
 
+// WithChecksum enables calculation of the SHA-1 digest for every archive
+// (not only the ones that are looked up by SHA-1) and saving it to Package.Digest.
+func WithChecksum(checksum bool) Option {
+	return func(p *Parser) {
+		p.checksum = checksum
+	}
+}
+
 func WithSize(size int64) Option {
 	return func(p *Parser) {
 		p.size = size
@@ -95,6 +103,25 @@ func (p *Parser) Parse(_ context.Context, r xio.ReadSeekerAt) ([]ftypes.Package,
 }
 
 func (p *Parser) parseArtifact(filePath string, size int64, r xio.ReadSeekerAt) ([]ftypes.Package, []ftypes.Dependency, error) {
+	pkgs, deps, err := p.parsePackages(filePath, size, r)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// When a checksum is requested, every package must carry the digest of its
+	// own file. Packages from nested archives (and the one resolved by
+	// searchBySHA1) already have it, so fill in this archive's digest only for
+	// the packages that are still missing one.
+	if p.checksum {
+		if err := fillArchiveDigest(pkgs, r); err != nil {
+			return nil, nil, xerrors.Errorf("unable to set digest for %s: %w", filePath, err)
+		}
+	}
+
+	return pkgs, deps, nil
+}
+
+func (p *Parser) parsePackages(filePath string, size int64, r xio.ReadSeekerAt) ([]ftypes.Package, []ftypes.Dependency, error) {
 	p.logger.Debug("Parsing Java artifacts...", log.FilePath(filePath))
 
 	// Try to extract artifactId and version from the file name
@@ -111,12 +138,12 @@ func (p *Parser) parseArtifact(filePath string, size int64, r xio.ReadSeekerAt)
 	// Such an artifact has no embedded pom.xml (maven-archiver writes pom.xml and
 	// pom.properties together), so it carries no pom.xml license.
 	if !foundPomProps {
-		props, found, err := p.resolveArtifact(r, m, fileProps)
+		pkg, found, err := p.resolveArtifact(r, m, fileProps)
 		if err != nil {
 			return nil, nil, err
 		}
 		if found {
-			pkgs = append(pkgs, props.Package())
+			pkgs = append(pkgs, pkg)
 		}
 	}
 
@@ -129,41 +156,41 @@ func (p *Parser) parseArtifact(filePath string, size int64, r xio.ReadSeekerAt)
 
 // resolveArtifact determines the artifact of the jar itself when pom.properties is absent,
 // trying MANIFEST.MF, then Maven Central by SHA-1, then a heuristic search by file name.
-func (p *Parser) resolveArtifact(r xio.ReadSeekerAt, m manifest, fileProps Properties) (Properties, bool, error) {
+func (p *Parser) resolveArtifact(r xio.ReadSeekerAt, m manifest, fileProps Properties) (ftypes.Package, bool, error) {
 	fileName := filepath.Base(fileProps.FilePath)
 
 	manifestProps := m.properties(fileProps.FilePath)
 	if p.offline {
 		// In offline mode, we will not check if the artifact information is correct.
 		if !manifestProps.Valid() {
 			p.logger.Debug("Unable to identify POM in offline mode", log.String("file", fileName))
-			return Properties{}, false, nil
+			return ftypes.Package{}, false, nil
 		}
-		return manifestProps, true, nil
+		return manifestProps.Package(), true, nil
 	}
 
 	if manifestProps.Valid() {
 		// Even if MANIFEST.MF is found, the groupId and artifactId might not be valid.
 		// We have to make sure that the artifact exists actually.
 		if ok, _ := p.client.Exists(manifestProps.GroupID, manifestProps.ArtifactID); ok {
 			// If groupId and artifactId are valid, they will be returned.
-			return manifestProps, true, nil
+			return manifestProps.Package(), true, nil
 		}
 	}
 
 	// If groupId and artifactId are not found, call Maven Central's search API with SHA-1 digest.
-	props, err := p.searchBySHA1(r, fileProps.FilePath)
+	pkg, err := p.searchBySHA1(r, fileProps.FilePath)
 	if err == nil {
-		return props, true, nil
+		return pkg, true, nil
 	} else if !errors.Is(err, ArtifactNotFoundErr) {
-		return Properties{}, false, xerrors.Errorf("failed to search by SHA1: %w", err)
+		return ftypes.Package{}, false, xerrors.Errorf("failed to search by SHA1: %w", err)
 	}
 
 	p.logger.Debug("No such POM in the central repositories", log.String("file", fileName))
 
 	// Return when artifactId or version from the file name are empty
 	if fileProps.ArtifactID == "" || fileProps.Version == "" {
-		return Properties{}, false, nil
+		return ftypes.Package{}, false, nil
 	}
 
 	// Try to search groupId by artifactId via sonatype API
@@ -172,12 +199,42 @@ func (p *Parser) resolveArtifact(r xio.ReadSeekerAt, m manifest, fileProps Prope
 	if err == nil {
 		p.logger.Debug("POM was determined in a heuristic way", log.String("file", fileName),
 			log.String("artifact", fileProps.String()))
-		return fileProps, true, nil
+		return fileProps.Package(), true, nil
 	} else if !errors.Is(err, ArtifactNotFoundErr) {
-		return Properties{}, false, xerrors.Errorf("failed to search by artifact id: %w", err)
+		return ftypes.Package{}, false, xerrors.Errorf("failed to search by artifact id: %w", err)
 	}
 
-	return Properties{}, false, nil
+	return ftypes.Package{}, false, nil
+}
+
+// fillArchiveDigest sets the SHA-1 digest of the archive (r) on every package
+// that does not have a digest yet. The digest is calculated lazily, so the
+// archive is not read when all packages already carry their own digest.
+//
+// Packages that have no file of their own — e.g. dependencies flattened into a
+// shaded/uber JAR, which only leave a bundled pom.properties behind — all share
+// this archive's digest. That is consistent with their FilePath, which is also
+// the enclosing archive, so the digest stays aligned with the file it refers to.
+func fillArchiveDigest(pkgs []ftypes.Package, r xio.ReadSeekerAt) error {
+	var d digest.Digest
+	for i := range pkgs {
+		if pkgs[i].Digest != "" {
+			continue
+		}
+		// Compute the archive digest at most once and reuse it afterwards.
+		// An empty d means it has not been calculated yet.
+		if d == "" {
+			if _, err := r.Seek(0, io.SeekStart); err != nil {
+				return xerrors.Errorf("file seek error: %w", err)
+			}
+			var err error
+			if d, err = digest.CalcSHA1(r); err != nil {
+				return xerrors.Errorf("unable to calculate SHA-1: %w", err)
+			}
+		}
+		pkgs[i].Digest = d
+	}
+	return nil
 }
 
 func (p *Parser) traverseZip(size int64, r xio.ReadSeekerAt, fileProps Properties) (
@@ -345,22 +402,28 @@ func (p *Parser) parseInnerJar(zf *zip.File, rootPath string) ([]ftypes.Package,
 	return innerPkgs, innerDeps, nil
 }
 
-func (p *Parser) searchBySHA1(r io.ReadSeeker, filePath string) (Properties, error) {
+func (p *Parser) searchBySHA1(r io.ReadSeeker, filePath string) (ftypes.Package, error) {
 	if _, err := r.Seek(0, io.SeekStart); err != nil {
-		return Properties{}, xerrors.Errorf("file seek error: %w", err)
+		return ftypes.Package{}, xerrors.Errorf("file seek error: %w", err)
 	}
-
-	h := sha1.New() // nolint:gosec
-	if _, err := io.Copy(h, r); err != nil {
-		return Properties{}, xerrors.Errorf("unable to calculate SHA-1: %w", err)
+	d, err := digest.CalcSHA1(r)
+	if err != nil {
+		return ftypes.Package{}, xerrors.Errorf("unable to calculate SHA-1: %w", err)
 	}
-	s := hex.EncodeToString(h.Sum(nil))
-	prop, err := p.client.SearchBySHA1(s)
+
+	prop, err := p.client.SearchBySHA1(d.Encoded())
 	if err != nil {
-		return Properties{}, err
+		return ftypes.Package{}, err
 	}
 	prop.FilePath = filePath
-	return prop, nil
+
+	pkg := prop.Package()
+	// searchBySHA1 has already calculated the archive's SHA-1, so stamp it on the
+	// resolved package to avoid recalculating it in fillArchiveDigest.
+	if p.checksum {
+		pkg.Digest = d
+	}
+	return pkg, nil
 }
 
 func isArtifact(name string) bool {

helm/trivy/Chart.yaml

@@ -147,6 +147,11 @@ func buildRunInstruction(s string) string {
 }
 
 func buildHealthcheckInstruction(health *v1.HealthConfig) string {
+	// Config.Healthcheck can be null even when a HEALTHCHECK history line exists
+	// if the image was re-committed by a tool that normalizes HEALTHCHECK NONE to null.
+	if health == nil {
+		return "HEALTHCHECK NONE"
+	}
 	var interval, timeout, startPeriod, retries, command string
 	if health.Interval != 0 {
 		interval = fmt.Sprintf("--interval=%s ", health.Interval)

pkg/dependency/parser/java/jar/parse.go

@@ -458,6 +458,17 @@ HEALTHCHECK NONE
 ENTRYPOINT ["/bin/sh"]
 `,
 		},
+		{
+			name: "healthcheck history without resolved config",
+			input: &v1.ConfigFile{
+				History: []v1.History{
+					{
+						CreatedBy: "HEALTHCHECK NONE",
+					},
+				},
+			},
+			expected: "HEALTHCHECK NONE\n",
+		},
 		{
 			name: "legacy env format",
 			input: &v1.ConfigFile{

pkg/fanal/analyzer/imgconf/dockerfile/dockerfile.go

@@ -1,6 +1,7 @@
 package language
 
 import (
+	"cmp"
 	"context"
 	"io"
 
@@ -95,14 +96,15 @@ func toApplication(fileType types.LangType, filePath, libFilePath string, r xio.
 		deps[dep.ID] = dep.DependsOn
 	}
 
-	for i, pkg := range pkgs {
+	for i := range pkgs {
+		pkg := &pkgs[i]
 		// This file path is populated for virtual file paths within archives, such as nested JAR files.
-		if pkg.FilePath == "" {
-			pkgs[i].FilePath = libFilePath
-		}
-		pkgs[i].DependsOn = deps[pkg.ID]
-		pkgs[i].Digest = d
-		pkgs[i].Indirect = isIndirect(pkg.Relationship) // For backward compatibility
+		pkg.FilePath = cmp.Or(pkg.FilePath, libFilePath)
+		pkg.DependsOn = deps[pkg.ID]
+		// Save the digest only if it has not been calculated for the package yet.
+		// For example, the digest for JAR files is calculated inside the parser.
+		pkg.Digest = cmp.Or(pkg.Digest, d)
+		pkg.Indirect = isIndirect(pkg.Relationship) // For backward compatibility
 	}
 
 	return &types.Application{

pkg/fanal/analyzer/imgconf/dockerfile/dockerfile_test.go

@@ -60,8 +60,12 @@ func (a *javaLibraryAnalyzer) PostAnalyze(ctx context.Context, input analyzer.Po
 	// It will be called on each JAR file
 	onFile := func(path string, info fs.FileInfo, r xio.ReadSeekerAt) (*types.Application, error) {
 		p := jar.NewParser(client, jar.WithSize(info.Size()), jar.WithFilePath(path),
+			jar.WithChecksum(input.Options.FileChecksum),
 			jar.WithLicenseClassifierConfidenceLevel(a.licenseClassifierConfidenceLevel))
-		return language.ParsePackage(ctx, types.Jar, path, r, p, input.Options.FileChecksum)
+		// The jar parser calculates a per-file digest for every (possibly nested)
+		// artifact itself, so language.ParsePackage must not overwrite them with
+		// the enclosing archive's digest.
+		return language.ParsePackage(ctx, types.Jar, path, r, p, false)
 	}
 
 	var apps []types.Application

pkg/fanal/analyzer/language/analyze.go

@@ -82,6 +82,8 @@ func Test_javaLibraryAnalyzer_Analyze(t *testing.T) {
 			},
 		},
 		{
+			// The PAR itself (resolved via its pom.properties) and the nested
+			// `jackson-core` JAR must each carry the digest of their own file.
 			name:            "happy path (PAR file)",
 			inputFile:       "testdata/test.par",
 			includeChecksum: true,
@@ -91,20 +93,29 @@ func Test_javaLibraryAnalyzer_Analyze(t *testing.T) {
 						Type:     types.Jar,
 						FilePath: "testdata/test.par",
 						Packages: types.Packages{
+							{
+								Name:     "com.example:par-app",
+								FilePath: "testdata/test.par",
+								Version:  "3.0.0",
+								Digest:   "sha1:bdce3e13cc5d39960ab7f7644ae24d82becd2ba2",
+							},
 							{
 								Name:     "com.fasterxml.jackson.core:jackson-core",
 								FilePath: "testdata/test.par/lib/jackson-core-2.9.10.jar",
 								Version:  "2.9.10",
-								Digest:   "sha1:d40913470259cfba6dcc90f96bcaa9bcff1b72e0",
+								Digest:   "sha1:66b715dec9dd8b0f39f3296e67e05913bf422d0c",
 							},
 						},
 					},
 				},
 			},
 		},
 		{
-			name:      "happy path (package found in trivy-java-db by sha1)",
-			inputFile: "testdata/test.jar",
+			// The package is resolved by SHA-1 in trivy-java-db, and that SHA-1 is
+			// also stored as the package digest.
+			name:            "happy path (package found in trivy-java-db by sha1)",
+			inputFile:       "testdata/test.jar",
+			includeChecksum: true,
 			want: &analyzer.AnalysisResult{
 				Applications: []types.Application{
 					{
@@ -115,6 +126,7 @@ func Test_javaLibraryAnalyzer_Analyze(t *testing.T) {
 								Name:     "org.apache.tomcat.embed:tomcat-embed-websocket",
 								FilePath: "testdata/test.jar",
 								Version:  "9.0.65",
+								Digest:   "sha1:bd70dfeb39cc83c6934be24fa377b21e541dbe76",
 								Licenses: []string{"Apache-2.0"},
 							},
 						},