trivy output does not match trivy@1 - Azure DevOps Pipeline

Open
#99 3 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
25/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
azure
Domain
ci-cd, devops, security

Research direction

Start by reproducing the Ubuntu Azure DevOps pipeline using MicrosoftSecurityDevOps@1, trivy@1, and the supplied gdnconfig path, then compare both task outputs. Investigate why the config path receives the -linux suffix and why the results differ; done means the behavior is explained or corrected and a working Linux-agent example is documented.

Written by the indexing model from the issue text.

Description

Agent: Ubuntu latest, using Azure DevOps pipelines.

I have been running trivy side by side and found the results in MicrosoftSecurityDevOps@1 to be less than the output results running in trivy@1

The lack of working examples for MicrosoftSecurityDevOps@1 probably doesn't help - it takes me some time to figure out how to use the task and i cant get gdnconfig files to work.

I originally started with this config:

- job: microsoft_security_devops
        continueOnError: false
        steps:
        - task: MicrosoftSecurityDevOps@1
          displayName: 'Microsoft Security DevOps'
          inputs:
            command: 'run' 
            tools: terrascan, trivy

I then created a gdnconfig file and tried to use the

config: '$(System.DefaultWorkingDirectory)/workflows/templates/*.gdnconfig'

I tried loads of variances of the path but every single time it adds a postfix '-linux' to the file name. So the path would turn into:

config: '$(System.DefaultWorkingDirectory)/workflows/templates/*-linux.gdnconfig'

Anyway, the output for the results showed 0 for the MicrosoftSecurityDevOps@1 task and 5 (2 critical, 1 high, and 2 medium) using the trivy@1 task.

I have no confidence in what it showing me and the lack of decent examples and clear documentation is compounding the issue.

Any help appreciated - especially if anyone has got a working example of using trivy, with a gdnconfig file on a Linux agent. 😄

Dominant language
TypeScript
Stars
86
Forks
22
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from microsoft/security-devops-azdevops

All issues in microsoft/security-devops-azdevops

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.