search

go-spatial / tegola

Tegola is a Mapbox Vector Tile server written in Go
http://tegola.io/
MIT License
1.28k stars 194 forks source link

Implement Trivy code scanning to help identify vulns #1005

Open ARolek opened 1 month ago

ARolek commented 1 month ago

@fjrsaracho surfaced an issue reported by the code scanning tool Trivy. This issue is about implementing Trivy to do a scan weekly so we can stay on top of vulns even if code is not being pushed.

It is under Apache License 2.0. Including comercial usage. You can read more on following link: https://github.com/aquasecurity/trivy/blob/main/LICENSE

Not sure if it fits for you as a real "open-source"

Originally posted by @fjrsaracho in https://github.com/go-spatial/tegola/issues/1000#issuecomment-2237342860

iwpnd commented 1 month ago

Github offers code scanning too natively if that is an option.

ARolek commented 1 month ago

@iwpnd yeah they do, via CodeQL. From my understanding Trivy and CodeQL overlap, but also cover different parts of the codebase. CodeQL would cover the Go and JS code, and Trivy covers the Dockerfile. I still need to research some of the details, but this is my high level understanding.

iwpnd commented 1 month ago

For docker we should be able to get away with Dependabot keeping the image updated.