aquasecurity/trivy

feat: add flag to pass credentials to different Git hosting platforms

Open

#6,833 opened on May 31, 2024

View on GitHub
 (1 comment) (6 reactions) (0 assignees)Go (35,000 stars) (371 forks)batch import
help wantedkind/featuretarget/repository

Description

Discussed in https://github.com/aquasecurity/trivy/discussions/6832

Originally posted by psg18dhc May 31, 2024

Description

I noticed that when using BitBucket private repositories it's not possible to scan my code repo as i get auth errors.

GITHUB_TOKEN and GITLAB_TOKEN env vars do not work (because it's not a GitHub repo)

Is there a way to do this securely without having to make the repo public ?

i.e can we have a BITBUCKET_TOKEN env var specifically for this purpose ?

Regards Daniel C

Target

Git Repository

Scanner

None

Contributor guide

Tech stack
go
Domain
securityauthentication
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
clear
Prerequisites
Go programmingTrivy git scanning basicsEnvironment variable handling
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
65
Research direction
Examine how GITHUB TOKEN and GITLAB TOKEN are currently used in the Trivy codebase (e.g., in pkg/fanal or similar). Identify the relevant files and functions that handle authentication for Git repositories. Propose a similar implementation for a BITBUCKET TOKEN environment variable, ensuring consistency and security. Consider adding a command line flag to specify the token. The discussion at https://github.com/aquasecurity/trivy/discussions/6832 may contain additional context.
feat: add flag to pass credentials to different Git hosting platforms · aquasecurity/trivy#6833 | Good First Issue