admin/aquasecurity-trivy
1
0
Fork 0
mirror of https://github.com/aquasecurity/trivy.git synced 2026-02-07 17:23:15 +08:00
Code Issues Packages Projects Releases Wiki Activity

Deployed 45a962705 to dev with MkDocs 1.3.0 and mike 1.1.2

Browse Source
This commit is contained in:
knqyf263
2024-08-24 04:06:08 +00:00
parent 1b58563b11
commit f9878d2c6f
7 changed files with 210 additions and 173 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
dev/docs/coverage/language/python/index.html
View File

@@ -4306,7 +4306,7 @@ The following scanners are supported for Python packages.</p>
<td align="center">Include</td>
<td align="center">-</td>
<td align="center">✓</td>
<td align="center">-</td>
<td align="center">✓</td>
</tr>
<tr>
<td>Pipenv</td>
@@ -4352,8 +4352,14 @@ See <a href="../">here</a> for the detail.</p>
<p>Trivy parses your files generated by package managers in filesystem/repository scanning.</p>
<h3 id="pip">pip</h3>
<h4 id="dependency-detection">Dependency detection</h4>
<p>Trivy only parses <a href="https://packaging.python.org/en/latest/specifications/version-specifiers/#id5">version specifiers</a> with <code>==</code> comparison operator and without <code>.*</code>.
To convert unsupported version specifiers - use the <code>pip freeze</code> command.</p>
<p>By default, Trivy only parses <a href="https://packaging.python.org/en/latest/specifications/version-specifiers/#id5">version specifiers</a> with <code>==</code> comparison operator and without <code>.*</code>.</p>
<p>Using the <a href="#detection-priority">--detection-priority comprehensive</a> option ensures that the tool establishes a minimum version, which is particularly useful in scenarios where identifying the exact version is challenging.
In such case Trivy parses specifiers <code>&gt;=</code>,<code>~=</code> and a trailing <code>.*</code>.</p>
<p><div class="highlight"><pre><span></span><code>keyring &gt;= 4.1.1 # Minimum version 4.1.1
Mopidy-Dirble ~= 1.1 # Minimum version 1.1
python-gitlab==2.0.* # Minimum version 2.0.0
</code></pre></div>
Also, there is a way to convert unsupported version specifiers - use the <code>pip freeze</code> command.</p>
<div class="highlight"><pre><span></span><code>$ cat requirements.txt
boto3~<span class="o">=</span><span class="m">1</span>.24.60
click&gt;<span class="o">=</span><span class="m">8</span>.0