Support gradle checks for multi project repos.

[mbaitelman]

Description

We are looking to add trivy to our multi project repository.
We use gradle for dependencies and use the lock options to produce .lockfiles however the trivy code doesnt find ours.
Looking over the codebase that handles this logic I see that the check is for gradle.lockfile as a suffix.
However for multi project repositories the naming convention is different and looks more like gradle/dependency-locks/compileClasspath.lockfile ie gradle/dependency-locks/{action}.lockfile.
Here is a public example from Atlassian's infrastructure.
https://github.com/atlassian/infrastructure/blob/master/gradle/dependency-locks/compileClasspath.lockfile

Desired Behavior

Gradle lockfiles are scanned even when the are not named gradle.lockfile

Actual Behavior

Gradle multi project lockfiles are not being scanned since they are not named gradle.lockfile

Reproduction Steps

1. Download https://github.com/atlassian/infrastructure
2. run trivy `trivy fs . --debug`
3. Look for references to gradle lockfiles being checked.

Target

Filesystem

Scanner

Vulnerability

Output Format

Table

Mode

Standalone

Debug Output

trivy fs . --debug

C:\workspace\infrastructure [master ≡]> trivy fs . --debug
2023-06-16T19:44:01.742-0700    DEBUG   Severities: ["UNKNOWN" "LOW" "MEDIUM" "HIGH" "CRITICAL"]
2023-06-16T19:44:01.763-0700    DEBUG   cache dir:  C:\Users\me\AppData\Local\trivy
2023-06-16T19:44:01.771-0700    INFO    Need to update DB
2023-06-16T19:44:01.771-0700    INFO    DB Repository: ghcr.io/aquasecurity/trivy-db
2023-06-16T19:44:01.771-0700    INFO    Downloading DB...
37.75 MiB / 37.75 MiB [---------------------------------------------------------------------------------------------------------------------------------------------------------------] 100.00% 3.35 MiB p/s 11s
2023-06-16T19:44:15.348-0700    DEBUG   Updating database metadata...
2023-06-16T19:44:15.366-0700    DEBUG   DB Schema: 2, UpdatedAt: 2023-06-17 00:11:11.682568085 +0000 UTC, NextUpdate: 2023-06-17 06:11:11.682567685 +0000 UTC, DownloadedAt: 2023-06-17 02:44:15.3507978 +0000 UTC
2023-06-16T19:44:15.368-0700    INFO    Vulnerability scanning is enabled
2023-06-16T19:44:15.368-0700    DEBUG   Vulnerability type:  [os library]
2023-06-16T19:44:15.368-0700    INFO    Secret scanning is enabled
2023-06-16T19:44:15.368-0700    INFO    If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2023-06-16T19:44:15.368-0700    INFO    Please see also https://aquasecurity.github.io/trivy/v0.42/docs/secret/scanning/#recommendation for faster secret detection
2023-06-16T19:44:15.369-0700    DEBUG   No secret config detected: trivy-secret.yaml
2023-06-16T19:44:15.370-0700    DEBUG   Walk the file tree rooted at '.' in parallel
2023-06-16T19:44:15.898-0700    DEBUG   OS is not detected.
2023-06-16T19:44:15.898-0700    DEBUG   Detected OS: unknown
2023-06-16T19:44:15.898-0700    INFO    Number of language-specific files: 0

Operating System

Windows

Version

Version: 0.42.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2023-06-17 00:11:11.682568085 +0000 UTC
  NextUpdate: 2023-06-17 06:11:11.682567685 +0000 UTC
  DownloadedAt: 2023-06-17 02:44:15.3507978 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2023-06-16 00:51:43.297351753 +0000 UTC
  NextUpdate: 2023-06-19 00:51:43.297350953 +0000 UTC
  DownloadedAt: 2023-06-16 16:02:32.9392626 +0000 UTC

Checklist

• Run trivy --reset
• Read the troubleshooting

[knqyf263]

--file-patttens helps.
https://aquasecurity.github.io/trivy/v0.42/docs/configuration/skipping/#file-patterns

[mbaitelman]

Thank you for that suggestion.
However it didnt work.
I tried both trivy fs . --debug --file-patterns "java:.*.lockfile" and trivy fs . --debug --file-patterns "gradle:.*.lockfile"
Is there a different way I should be passing in those values?

[nikpivkin]

Hi @mbaitelman , try the following command: trivy fs . -d --file-patterns "gradle-lockfile:.*.lockfile"

[mbaitelman]

Thank you, that worked and helped us find a few issues we should be addressing.

[mbaitelman]

Would it make sense to add these patterns to the code as well (if I can figure out the go code), or its not something that would work with the tools.

[anessi]

I wanted to have a single lockfile for all runtimeClasspath dependencies of a multi-module project that I can use for vulnerability scanning with trivy. This is the task I came up with. It probably can be improved here and there, but it works:

task generateLockfile {
  doLast {
    def allRuntimeDependencies = [:]  // map used for deduplication
    subprojects.each { subproject ->
      subproject.configurations.runtimeClasspath.resolvedConfiguration.resolvedArtifacts.each { artifact ->
        def artifactId = artifact.id.componentIdentifier.toString()
        if (!artifactId.startsWith("project :")) { // exclude project dependencies
          allRuntimeDependencies.put(artifactId, artifact)
        }
      }
    }
    // write lockfile
    def depList = allRuntimeDependencies.collect { artifactId, artifact -> artifactId }.sort()
    new File("gradle.lockfile").withWriter { w ->
      w << "# This file is generated by build.gradle and contains all dependencies from all subprojects\n"
      w << "# It can be used by trivy to scan for vulnerabilities: trivy fs ./gradle.lockfile\n"
      depList.each { dependency ->
        w << "${dependency}=runtimeClasspath\n"
      }
    }
  }
}

Scanning the single file with trivy is easy:
trivy fs ./gradle.lockfile

[akleemans]

That is very helpful, thank you!