Trivy: Output the vulnerabilities that are ignored
At the moment, Trivy doesn't list the vulnerabilities that got ignored because of being present in .trivyignore.
It is useful information for someone reviewing/auditing an image to know which vulnerabilities are present but ignored.
ajinkya599
All 6 comments
How do you want to see those vulnerabilities? Can we just display them as a log message or need to output them in the JSON result?
knqyf263
on 14 Oct 2020
@knqyf263 We are building some tooling around Trivy. So we want the vulnerabilities in the JSON result.
ajinkya599
on 22 Oct 2020
Knowing what was ignored in the JSON would be ideal.
The best option would be to show all entries in the ignore file, and which of them were also found in the image.
Having that would allow us to know if something was ignored and found, and if there is something that may not need to be ignored anymore. (ie it was fixed in the base image and no longer needs to be ignored.)
jeff-cook
on 25 Oct 2020
@simar7 @lizrice Any thought?
knqyf263
on 26 Oct 2020
I'm not convinced with the idea of simply including "ignored" results in the main list of vulnerabilities, even if they were marked somehow as "ignore". I'd guess there is a workaround of running trivy twice, once without the ignore file, and comparing the results?
The best option would be to show all entries in the ignore file, and which of them were also found in the image.
I can see the value in this - so in addition to a list of vulnerabilities, there would be an option to output a separate list of ignore file entries and indicate whether they were found or not.
lizrice
on 26 Oct 2020
@lizrice Is this feature being added to your backlog? If so, is there an ETA you could share with us? If not, could you propose any alternatives? Thanks.
anraghun
on 11 Nov 2020
Related issues
knqyf263
路
3Comments
negbie
路
7Comments
nunofernandes
路
4Comments
patrickbaber
路
3Comments
nycalex
路
6Comments
Most helpful comment
I'm not convinced with the idea of simply including "ignored" results in the main list of vulnerabilities, even if they were marked somehow as "ignore". I'd guess there is a workaround of running trivy twice, once without the ignore file, and comparing the results?
I can see the value in this - so in addition to a list of vulnerabilities, there would be an option to output a separate list of ignore file entries and indicate whether they were found or not.