Description
Trivy-as-a-library consumers cannot set OS package detection driver/provider overrides at the scanner they actually construct. ospkgDetector.NewDetector accepts WithDriver / WithProvider options (re-exposed in #10740), but that detector is created internally inside (*scanner).Scan. Consumers build ospkg.NewScanner() and pass it to local.NewService, so today there is no way to thread the options down to NewDetector without reaching into the inner constructor.
Expected behavior
ospkg.NewScanner should accept the same ospkgDetector.Option values and forward them to ospkgDetector.NewDetector when it builds the detector, using the standard functional-options pattern (no global mutable state).
Usage:
osScanner := ospkg.NewScanner(ospkgDetector.WithProvider(myProvider))
svc := local.NewService(app, osScanner, langScanner, vulnClient)
This mirrors the grpc.NewServer(opts ...ServerOption) approach, where the top-level constructor collects options and threads them down to the components it builds internally.
Background
The Commercial team consumes the upstream Scan function and needs the driver/provider overrides configurable one level up, at the scanner they construct, rather than only on the inner ospkgDetector.NewDetector.
Related
Description
Trivy-as-a-library consumers cannot set OS package detection driver/provider overrides at the scanner they actually construct.
ospkgDetector.NewDetectoracceptsWithDriver/WithProvideroptions (re-exposed in #10740), but that detector is created internally inside(*scanner).Scan. Consumers buildospkg.NewScanner()and pass it tolocal.NewService, so today there is no way to thread the options down toNewDetectorwithout reaching into the inner constructor.Expected behavior
ospkg.NewScannershould accept the sameospkgDetector.Optionvalues and forward them toospkgDetector.NewDetectorwhen it builds the detector, using the standard functional-options pattern (no global mutable state).Usage:
This mirrors the
grpc.NewServer(opts ...ServerOption)approach, where the top-level constructor collects options and threads them down to the components it builds internally.Background
The Commercial team consumes the upstream
Scanfunction and needs the driver/provider overrides configurable one level up, at the scanner they construct, rather than only on the innerospkgDetector.NewDetector.Related
ospkgDetector.NewDetector)