Trivy reports customization

Products

• VMware Telco Cloud Automation

Issue/Introduction

Exploring possibility of customizing the Trivy reports to include Tags/Versions column in the Trivy reports. Currently, without this informaiton it is very difficult to determine which image version a particular vulnerability belongs to.

Environment

TCA 3.4

TCA 5

Resolution

1. The Trivy adapter’s role is to translate Harbor scan requests to Trivy and provide vulnerability data back to Harbor and it does not own the CSV export layout.
2. Based on the current Harbor/Trivy reporting behavior, there does not appear to be a supported out-of-the-box configuration option to modify the standard exported vulnerability report format and directly add a Tags/Versions column.
3. Current report functionality is artifact/digest-based, and the artifact digest is the unique identifier for the scanned image artifact.
4. We understand that correlating the digest back to a readable image tag/version may not be straightforward during report review.
5. From a technical perspective, this information can be derived separately from Harbor metadata, as Harbor maintains tag information against artifacts. Therefore, the feasible approach would be to use the Harbor REST API to map the artifact digest from the vulnerability report to the corresponding image tag or tags, and then enrich the exported report through a custom post-processing script.
6. However, creating, maintaining, or validating such a custom reporting script would be an operational/reporting automation activity and falls outside the scope of product break/fix support.
7. Refer to the Harbor API documentation/API Explorer for the relevant artifact and tag metadata APIs and build a post-processing workflow according to your reporting requirements.

 

Additional Information

URL links below for reference:

• Harbor 2.13 REST API & API Explorer
• Harbor 2.6 REST API & API Explorer
• Harbor 2.13 Repositories / Artifacts / Tags reference
• Harbor 2.6 Repositories / Artifacts / Tags reference:

Can also be accessed with this practical API access path:

• https://<harbor-ip-or-fqdn>/devcenter-api-2.0

For older Harbor 2.6.x deployments, the direct Swagger/API Explorer path may be:

• https://<harbor-ip-or-fqdn>/devcenter