Trivy: Is the JSON output of Trivy expected to be empty if no Vulns are found?

[jonrau1]

Running Trivy in CI/CD, these are the pertinent lines from my build spec

trivy -f json -o results.json --exit-code 0 --severity HIGH --quiet --auto-refresh $docker_img_name:$docker_tag
trivy -f json -o results.json --exit-code 1 --severity CRITICAL --quiet --auto-refresh $docker_img_name:$docker_tag

Here is the Dockerfile, something simple

FROM ubuntu:vivid

CMD echo "hello world"

And here is the JSON (ignore the values - my env vars are static for testing Trivy right now)

{
  "alpine-test-me:testytest (ubuntu 15.04)": null
}

If it is expected to be empty, that is fine, just want to clarify. As a side note, is there a sample vulnerable container out there to test what it would look like with vulns?

[masahiro331]

@jonrau1

Not found vulnerability

$ trivy -f json alpine:3.10
[
  {
    "Target": "alpine:3.10 (alpine 3.10.2)",
    "Vulnerabilities": null
  }
]

Found vulnerability

$ trivy knqyf263/test-image:1.2.3
$ git clone https://github.com/aquasecurity/trivy-ci-test.git
$ cd trivy-ci-test
$ docker build -t trivy-ci-test .
$ trivy -f json trivy-ci-test

[jonrau1]

@masahiro331

Good to know to expect Null in the output JSON.

I used your above example, building the ci-test image and got these error logs

2019-08-23T02:33:48.263Z    ·[33mWARN·[0m   You should avoid using the :latest tag as it is cached. You need to specify '--clear-cache' option when :latest image is changed 
2019-08-23T02:33:51.244Z    ·[34mINFO·[0m   Detecting Alpine vulnerabilities... 
2019-08-23T02:33:51.248Z    ·[34mINFO·[0m   Updating composer Security DB... 
2019-08-23T02:33:51.602Z    ·[31mFATAL·[0m  error in image scan: failed to scan libraries: failed to scan composer vulnerabilities: failed to update composer advisories: error in batch update: failed to save composer vulnerability: failed to create a bucket: bucket name required 

[Container] 2019/08/23 02:33:51 Command did not exit successfully trivy -f json -o results.json --exit-code 0 --severity HIGH --quiet --auto-refresh trivy-ci-test exit status 1 
[Container] 2019/08/23 02:33:51 Phase complete: BUILD State: FAILED 
[Container] 2019/08/23 02:33:51 Phase context status code: COMMAND_EXECUTION_ERROR Message: Error while executing command: trivy -f json -o results.json --exit-code 0 --severity HIGH --quiet --auto-refresh trivy-ci-test. Reason: exit status 1 

[masahiro331]

Please your trivy version

$ trivy -v

[jonrau1]

wget https://github.com/aquasecurity/trivy/releases/download/v0.0.15/trivy_0.0.15_Linux-64bit.deb
dpkg -i trivy_0.0.15_Linux-64bit.deb
trivy -v
trivy version 0.0.15

[masahiro331]

OK, your trivy is very oldest.
Please update. latest version is 0.1.6.

wget https://github.com/aquasecurity/trivy/releases/download/v0.1.6/trivy_0.1.6_Linux-64bit.deb
dpkg -i trivy_0.1.6_Linux-64bit.deb

[jonrau1]

@masahiro331

That worked! Successfully produced with reports with No Vulns and Vulns, and Exit Code 1 commands on Critical behaved as expected.

I would suggest to update the GitHub readme with version 0.1.6 in the install commands

I also tried this method, and it did not give me that latest version either (Ubuntu 18.04LTS)

sudo apt-get install apt-transport-https gnupg
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
echo deb https://aquasecurity.github.io/trivy-repo/deb bionic main | sudo tee -a /etc/apt/sources.list.d/trivy.list
sudo apt-get update
sudo apt-get install trivy