aquasecurity/trivy

feat: add flag to pass credentials to different Git hosting platforms

Open

#6,833 创建于 2024年5月31日

在 GitHub 查看
 (1 评论) (6 反应) (0 负责人)Go (35,000 star) (371 fork)batch import
help wantedkind/featuretarget/repository

描述

Discussed in https://github.com/aquasecurity/trivy/discussions/6832

Originally posted by psg18dhc May 31, 2024

Description

I noticed that when using BitBucket private repositories it's not possible to scan my code repo as i get auth errors.

GITHUB_TOKEN and GITLAB_TOKEN env vars do not work (because it's not a GitHub repo)

Is there a way to do this securely without having to make the repo public ?

i.e can we have a BITBUCKET_TOKEN env var specifically for this purpose ?

Regards Daniel C

Target

Git Repository

Scanner

None

贡献者指南

技术栈
go
领域
securityauthentication
议题类型
feature
难度面向新贡献者的预计实现难度，1 表示很小改动，5 表示专家级工作。
3
预计时间有经验贡献者完成调查、实现、测试并准备 pull request 的粗略时间范围。
1-2 days
活动状态议题当前的可参与程度：新鲜、活跃、陈旧、阻塞或等待维护者输入。
stale
清晰度议题是否清楚说明期望改动、验收标准和下一步。
clear
前置要求
Go programmingTrivy git scanning basicsEnvironment variable handling
新手友好度1-100 的估计分数，表示该议题对首次贡献者的友好程度。
65
研究方向
Examine how GITHUB TOKEN and GITLAB TOKEN are currently used in the Trivy codebase (e.g., in pkg/fanal or similar). Identify the relevant files and functions that handle authentication for Git repositories. Propose a similar implementation for a BITBUCKET TOKEN environment variable, ensuring consistency and security. Consider adding a command line flag to specify the token. The discussion at https://github.com/aquasecurity/trivy/discussions/6832 may contain additional context.
feat: add flag to pass credentials to different Git hosting platforms · aquasecurity/trivy#6833 | Good First Issue