admin/aquasecurity-trivy
1
0
Fork 0
mirror of https://github.com/aquasecurity/trivy.git synced 2026-01-31 13:53:14 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(vex): support per-repo tls configuration (#10030)

Browse Source 
Signed-off-by: Alessio Greggi <alessio.greggi@suse.com>
Co-authored-by: knqyf263 <knqyf263@gmail.com>
This commit is contained in:
Alessio Greggi
2026-01-24 04:59:56 +01:00
committed by GitHub
parent f97ac7e112
commit f809066b07
6 changed files with 60 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
docs/guide/supply-chain/vex/repo.md
View File

@@ -80,6 +80,17 @@ For private repositories:
token: "my-token"
```
#### TLS Verification
In some cases, you might want to skip the TLS verification, per-repository:
```yaml
- name: custom
url: https://example.com/custom-repo
enabled: true
insecure: true
```
#### Repository Priority
The priority of VEX repositories is determined by their order in the configuration file.

4
pkg/downloader/download.go
View File

@@ -105,6 +105,7 @@ func Download(ctx context.Context, src, dst, pwd string, opts Options) (string,
}
type CustomTransport struct {
insecure bool
auth Auth
cachedETag string
newETag string
@@ -112,6 +113,7 @@ type CustomTransport struct {
func NewCustomTransport(opts Options) *CustomTransport {
return &CustomTransport{
insecure: opts.Insecure,
auth: opts.Auth,
cachedETag: opts.ETag,
}
@@ -127,7 +129,7 @@ func (t *CustomTransport) RoundTrip(req *http.Request) (*http.Response, error) {
req.SetBasicAuth(t.auth.Username, t.auth.Password)
}
transport := xhttp.RoundTripper(req.Context())
transport := xhttp.RoundTripper(req.Context(), xhttp.WithInsecure(t.insecure))
if req.URL.Host == "github.com" {
transport = NewGitHubTransport(req.URL, t.auth.Token)
}

6
pkg/vex/repo/manager.go
View File

@@ -173,7 +173,11 @@ func (m *Manager) List(ctx context.Context) error {
if !repo.Enabled {
status = "Disabled"
}
output.WriteString(fmt.Sprintf("- Name: %s\n URL: %s\n Status: %s\n\n", repo.Name, repo.URL, status))
tlsVerify := ""
if repo.Insecure {
tlsVerify = "\n TLS Verify: No"
}
output.WriteString(fmt.Sprintf("- Name: %s\n URL: %s\n Status: %s%s\n\n", repo.Name, repo.URL, status, tlsVerify))
}
}

38
pkg/vex/repo/manager_test.go
View File

@@ -154,9 +154,10 @@ func TestManager_DownloadRepositories(t *testing.T) {
config: repo.Config{
Repositories: []repo.Repository{
{
Name: "test-repo",
URL: ts.URL,
Enabled: true,
Name: "test-repo",
URL: ts.URL,
Enabled: true,
Insecure: true,
},
},
},
@@ -187,9 +188,10 @@ func TestManager_DownloadRepositories(t *testing.T) {
Enabled: true,
},
{
Name: "test-repo",
URL: ts.URL,
Enabled: true,
Name: "test-repo",
URL: ts.URL,
Enabled: true,
Insecure: true,
},
},
},
@@ -212,6 +214,22 @@ func TestManager_DownloadRepositories(t *testing.T) {
wantErr: "failed to download the repository",
wantDownload: false,
},
{
name: "download error insecure flag false",
config: repo.Config{
Repositories: []repo.Repository{
{
Name: "test-repo",
URL: ts.URL,
Enabled: true,
Insecure: false,
},
},
},
location: ts.URL + "/archive.zip",
wantErr: "failed to download the repository",
wantDownload: false,
},
}
for _, tt := range tests {
@@ -262,9 +280,10 @@ func TestManager_List(t *testing.T) {
Enabled: true,
},
{
Name: "custom",
URL: "https://example.com/custom-vex-repo",
Enabled: false,
Name: "custom",
URL: "https://example.com/custom-vex-repo",
Enabled: false,
Insecure: true,
},
},
},
@@ -277,6 +296,7 @@ func TestManager_List(t *testing.T) {
- Name: custom
URL: https://example.com/custom-vex-repo
Status: Disabled
TLS Verify: No
`,
},

10
pkg/vex/repo/repo.go
View File

@@ -93,6 +93,7 @@ type Repository struct {
Username string
Password string
Token string // For Bearer
Insecure bool
dir string // Root directory for this VEX repository, $CACHE_DIR/vex/repositories/$REPO_NAME/
}
@@ -164,7 +165,9 @@ func (r *Repository) downloadManifest(ctx context.Context, opts Options) error {
log.DebugContext(ctx, "Downloading the repository metadata...", log.String("url", u.String()), log.String("dst", r.dir))
_, err = downloader.Download(ctx, u.String(), filepath.Join(r.dir, manifestFile), ".", downloader.Options{
Insecure: opts.Insecure,
// if one between global and per-repo insecure option is set,
// we set it to true accordingly
Insecure: opts.Insecure || r.Insecure,
Auth: downloader.Auth{
Username: r.Username,
Password: r.Password,
@@ -239,8 +242,11 @@ func (r *Repository) download(ctx context.Context, ver Version, dst string, opts
logger := log.With(log.String("repo", r.Name))
logger.DebugContext(ctx, "Downloading repository to cache dir...", log.String("url", loc.URL),
log.String("dir", dst), log.String("etag", etags[loc.URL]))
etag, err := downloader.Download(ctx, loc.URL, dst, ".", downloader.Options{
Insecure: opts.Insecure,
// if one between global and per-repo insecure option is set,
// we set it to true accordingly
Insecure: opts.Insecure || r.Insecure,
Auth: downloader.Auth{
Username: r.Username,
Password: r.Password,

6
pkg/vex/repo/repo_test.go
View File

@@ -301,7 +301,9 @@ func TestRepository_Update(t *testing.T) {
tt.setup(t, tempDir, &r)
ctx := clock.With(t.Context(), tt.clockTime)
err = r.Update(ctx, repo.Options{})
err = r.Update(ctx, repo.Options{
Insecure: true,
})
if tt.wantErr != "" {
assert.ErrorContains(t, err, tt.wantErr)
return
@@ -344,7 +346,7 @@ func setUpManifest(t *testing.T, dir, url string) {
}
func setUpRepository(t *testing.T) *httptest.Server {
return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
return httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
switch r.URL.Path {
case "/archive.zip":
if r.Header.Get("If-None-Match") == "current-etag" {