aquasecurity/trivy

feat: add flag to pass credentials to different Git hosting platforms

Open

#6,833 建立於 2024年5月31日

在 GitHub 查看
 (1 留言) (6 反應) (0 負責人)Go (35,000 star) (371 fork)batch import
help wantedkind/featuretarget/repository

描述

Discussed in https://github.com/aquasecurity/trivy/discussions/6832

Originally posted by psg18dhc May 31, 2024

Description

I noticed that when using BitBucket private repositories it's not possible to scan my code repo as i get auth errors.

GITHUB_TOKEN and GITLAB_TOKEN env vars do not work (because it's not a GitHub repo)

Is there a way to do this securely without having to make the repo public ?

i.e can we have a BITBUCKET_TOKEN env var specifically for this purpose ?

Regards Daniel C

Target

Git Repository

Scanner

None

貢獻者指南

技術棧
go
領域
securityauthentication
議題類型
feature
難度面向新貢獻者的預計實作難度，1 表示很小改動，5 表示專家級工作。
3
預計時間有經驗貢獻者完成調查、實作、測試並準備 pull request 的粗略時間範圍。
1-2 days
活動狀態議題目前的可參與程度：新鮮、活躍、陳舊、阻塞或等待維護者輸入。
stale
清晰度議題是否清楚說明預期改動、驗收標準和下一步。
clear
前置要求
Go programmingTrivy git scanning basicsEnvironment variable handling
新手友善度1-100 的估計分數，表示該議題對首次貢獻者的友善程度。
65
研究方向
Examine how GITHUB TOKEN and GITLAB TOKEN are currently used in the Trivy codebase (e.g., in pkg/fanal or similar). Identify the relevant files and functions that handle authentication for Git repositories. Propose a similar implementation for a BITBUCKET TOKEN environment variable, ensuring consistency and security. Consider adding a command line flag to specify the token. The discussion at https://github.com/aquasecurity/trivy/discussions/6832 may contain additional context.
feat: add flag to pass credentials to different Git hosting platforms · aquasecurity/trivy#6833 | Good First Issue