-
Notifications
You must be signed in to change notification settings - Fork 2.7k
fix(cli): add some values to the telemetry call #9056
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(cli): add some values to the telemetry call #9056
Conversation
Hi @owenrumney ! I see that PR is not ready for review yet, but I would like to share my implementation idea with you. What if we add a new Below I have given a simple example implementation. Note that I have not added filtering of flags that are actually used. For that, we can add an diff --git a/pkg/flag/options.go b/pkg/flag/options.go
index f0f8276a5..dea33a9dd 100644
--- a/pkg/flag/options.go
+++ b/pkg/flag/options.go
@@ -76,6 +76,8 @@ type Flag[T FlagType] struct {
// Aliases represents aliases
Aliases []Alias
+ NonSensitive bool
+
// value is the value passed through CLI flag, env, or config file.
// It is populated after flag.Parse() is called.
value T
@@ -222,6 +224,10 @@ func (f *Flag[T]) Hidden() bool {
return f.Deprecated != "" || f.Removed != "" || f.Internal
}
+func (f *Flag[T]) IsNonSensitive() bool {
+ return f.NonSensitive
+}
+
func (f *Flag[T]) Value() (t T) {
if f == nil {
return t
@@ -349,6 +355,7 @@ type Flagger interface {
GetDefaultValue() any
GetAliases() []Alias
Hidden() bool
+ IsNonSensitive() bool
Parse() error
Add(cmd *cobra.Command)
@@ -385,6 +392,8 @@ type Options struct {
// We don't want to allow disabled analyzers to be passed by users, but it is necessary for internal use.
DisabledAnalyzers []analyzer.Type
+ Flags *Flags
+
// outputWriter is not initialized via the CLI.
// It is mainly used for testing purposes or by tools that use Trivy as a library.
outputWriter io.Writer
@@ -644,6 +653,7 @@ func (f *Flags) Bind(cmd *cobra.Command) error {
func (f *Flags) ToOptions(args []string) (Options, error) {
opts := Options{
AppVersion: app.Version(),
+ Flags: f,
args: args,
}
diff --git a/pkg/notification/notice.go b/pkg/notification/notice.go
index 491ae0cb5..0fcabff75 100644
--- a/pkg/notification/notice.go
+++ b/pkg/notification/notice.go
+func getUsedArgs(cliOpts flag.Options) []string {
+ var args []string
+ if cliOpts.Flags != nil {
+ for _, flagGroup := range *cliOpts.Flags {
+ for _, f := range flagGroup.Flags() {
+ var val string
+ if f.IsNonSensitive() {
+ type flagger[T flag.FlagType] interface {
+ Value() T
+ }
+ switch ff := f.(type) {
+ case flagger[string]:
+ val = ff.Value()
+ case flagger[int]:
+ val = strconv.Itoa(ff.Value())
+ case flagger[float64]:
+ val = fmt.Sprintf("%f", ff.Value())
+ case flagger[bool]:
+ val = strconv.FormatBool(ff.Value())
+ case flagger[time.Duration]:
+ val = ff.Value().String()
+ case flagger[[]string]:
+ val = strings.Join(ff.Value(), ",")
+ case flagger[map[string][]string]:
+ // TODO
+ }
+
+ } else {
+ val = "<SENSITIVE>"
+ }
+ args = append(args, fmt.Sprintf("%s=%s", f.GetName(), val))
+ }
+ }
+ }
+ return args
+}
+ |
Hey @nikpivkin, Yeah, I like this thanks. I'll have a fiddle with updating to this. Thanks for the proactive review, very helpful 👍 |
8f444ee
to
7c47301
Compare
very small ask, I see that the doc that I hastily wrote has a some typos and formatting issues, could you please add it to the PR: diff --git a/docs/docs/advanced/telemetry.md b/docs/docs/advanced/telemetry.md
index 92763f8b6..315597877 100644
--- a/docs/docs/advanced/telemetry.md
+++ b/docs/docs/advanced/telemetry.md
@@ -1,24 +1,24 @@
# Usage Telemetry
-Trivy collect anonymous usage data in order to help us improve the product. This document explains what is collected and how you can control it.
+Trivy collects anonymous usage data in order to help us improve the product. This document explains what is collected and how you can control it.
## Data collected
The following information could be collected:
-- Environmental information
- - Installation identifier
- - Trivy version
- - Operating system
-- Scan
- - Non-revealing scan options
+- Environmental information:
+ - Installation identifier
+ - Trivy version
+ - Operating system
+- Scan:
+ - Non-revealing scan options
## Privacy
No personal information, scan results, or sensitive data is specifically collected. We take the following measures to ensure that:
-- Installation identifier: one-way hash of machine fingerprint, resulting in opaque string.
-- Scaner: any option that is user controlled is omitted (never collected). For example, file paths, image names, etc are never collected.
+- Installation identifier: one-way hash of machine fingerprint, resulting in opaque ID.
+- Scan: any option that is user-controlled is omitted (never collected). For example, file paths, image names, etc are never collected.
Trivy is an Aqua Security product and adheres to the company's privacy policy: <https://aquasec.com/privacy>. |
62f4190
to
275bc99
Compare
- Updated the VersionChecker to accept command name and cliOptions directly, removing the need for multiple options functions. - Simplified the getFlags function to directly utilize the Flags structure for extracting command line arguments. - Enhanced flag definitions across various files to include TelemetrySafe attribute for better telemetry management. - Modified tests to accommodate changes in the VersionChecker and flag extraction logic, ensuring accurate command and flag headers are sent during update checks. - Removed the deprecated option functions in the notification package to streamline the codebase.
0833a9a
to
7499b8e
Compare
Move the logic to get the set flags into the flag package and process the returned Flaggers
ed4f430
to
b6709eb
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
"github.com/aquasecurity/trivy/pkg/commands" | ||
"github.com/aquasecurity/trivy/pkg/flag" | ||
"github.com/aquasecurity/trivy/pkg/log" | ||
"github.com/spf13/cobra/doc" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
hm.. It looks like linter doesn't check mage dir
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [mirror.gcr.io/aquasec/trivy](https://www.aquasec.com/products/trivy/) ([source](https://github.com/aquasecurity/trivy)) | minor | `0.63.0` -> `0.64.1` | --- ### Release Notes <details> <summary>aquasecurity/trivy (mirror.gcr.io/aquasec/trivy)</summary> ### [`v0.64.1`](https://github.com/aquasecurity/trivy/releases/tag/v0.64.1) [Compare Source](aquasecurity/trivy@v0.64.0...v0.64.1) #### Changelog - [`86ee3c1`](aquasecurity/trivy@86ee3c1) release: v0.64.1 \[release/v0.64] ([#​9122](aquasecurity/trivy#9122)) - [`4e12722`](aquasecurity/trivy@4e12722) fix(misconf): skip rewriting expr if attr is nil \[backport: release/v0.64] ([#​9127](aquasecurity/trivy#9127)) - [`9a7d384`](aquasecurity/trivy@9a7d384) fix(cli): Add more non-sensitive flags to telemetry \[backport: release/v0.64] ([#​9124](aquasecurity/trivy#9124)) - [`53adfba`](aquasecurity/trivy@53adfba) fix(rootio): check full version to detect `root.io` packages \[backport: release/v0.64] ([#​9120](aquasecurity/trivy#9120)) - [`8cf1bf9`](aquasecurity/trivy@8cf1bf9) fix(alma): parse epochs from rpmqa file \[backport: release/v0.64] ([#​9119](aquasecurity/trivy#9119)) ### [`v0.64.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0640-2025-06-30) [Compare Source](aquasecurity/trivy@v0.63.0...v0.64.0) ##### Features - **cli:** add version constraints to annoucements ([#​9023](aquasecurity/trivy#9023)) ([19efa9f](aquasecurity/trivy@19efa9f)) - **java:** dereference all maven settings.xml env placeholders ([#​9024](aquasecurity/trivy#9024)) ([5aade69](aquasecurity/trivy@5aade69)) - **misconf:** add OpenTofu file extension support ([#​8747](aquasecurity/trivy#8747)) ([57801d0](aquasecurity/trivy@57801d0)) - **misconf:** normalize CreatedBy for buildah and legacy docker builder ([#​8953](aquasecurity/trivy#8953)) ([65e155f](aquasecurity/trivy@65e155f)) - **redhat:** Add EOL date for RHEL 10. ([#​8910](aquasecurity/trivy#8910)) ([48258a7](aquasecurity/trivy@48258a7)) - reject unsupported artifact types in remote image retrieval ([#​9052](aquasecurity/trivy#9052)) ([1e1e1b5](aquasecurity/trivy@1e1e1b5)) - **sbom:** add manufacturer field to CycloneDX tools metadata ([#​9019](aquasecurity/trivy#9019)) ([41d0f94](aquasecurity/trivy@41d0f94)) - **terraform:** add partial evaluation for policy templates ([#​8967](aquasecurity/trivy#8967)) ([a9f7dcd](aquasecurity/trivy@a9f7dcd)) - **ubuntu:** add end of life date for Ubuntu 25.04 ([#​9077](aquasecurity/trivy#9077)) ([367564a](aquasecurity/trivy@367564a)) - **ubuntu:** add eol date for 20.04-ESM ([#​8981](aquasecurity/trivy#8981)) ([87118a0](aquasecurity/trivy@87118a0)) - **vuln:** add Root.io support for container image scanning ([#​9073](aquasecurity/trivy#9073)) ([3a0ec0f](aquasecurity/trivy@3a0ec0f)) ##### Bug Fixes - Add missing version check flags ([#​8951](aquasecurity/trivy#8951)) ([ef5f8de](aquasecurity/trivy@ef5f8de)) - **cli:** add some values to the telemetry call ([#​9056](aquasecurity/trivy#9056)) ([fd2bc91](aquasecurity/trivy@fd2bc91)) - Correctly check for semver versions for trivy version check ([#​8948](aquasecurity/trivy#8948)) ([b813527](aquasecurity/trivy@b813527)) - don't show corrupted trivy-db warning for first run ([#​8991](aquasecurity/trivy#8991)) ([4ed78e3](aquasecurity/trivy@4ed78e3)) - **misconf:** .Config.User always takes precedence over USER in .History ([#​9050](aquasecurity/trivy#9050)) ([371b8cc](aquasecurity/trivy@371b8cc)) - **misconf:** correct Azure value-to-time conversion in AsTimeValue ([#​9015](aquasecurity/trivy#9015)) ([40d017b](aquasecurity/trivy@40d017b)) - **misconf:** move disabled checks filtering after analyzer scan ([#​9002](aquasecurity/trivy#9002)) ([a58c36d](aquasecurity/trivy@a58c36d)) - **misconf:** reduce log noise on incompatible check ([#​9029](aquasecurity/trivy#9029)) ([99c5151](aquasecurity/trivy@99c5151)) - **nodejs:** correctly parse `packages` array of `bun.lock` file ([#​8998](aquasecurity/trivy#8998)) ([875ec3a](aquasecurity/trivy@875ec3a)) - **report:** don't panic when report contains vulns, but doesn't contain packages for `table` format ([#​8549](aquasecurity/trivy#8549)) ([87fda76](aquasecurity/trivy@87fda76)) - **sbom:** remove unnecessary OS detection check in SBOM decoding ([#​9034](aquasecurity/trivy#9034)) ([198789a](aquasecurity/trivy@198789a)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xLjMiLCJ1cGRhdGVkSW5WZXIiOiI0MS4xLjMiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImltYWdlIl19--> Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/812 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
Description
Add some information about arguments that are not sensitive and have
discrete values that can be provided.
All flag keys that are explicitly set will be sent,
but only flags marked as TelemetrySafe will include the value
Add tests to validate that the args generated do as required.
Update the documentation to include the flags that will have values passed, this is done in the magefile to ensure additional flags marked TelemetrySafe will be included
Example capture
For the command:
the following payload would be captured
Related issues
Remove this section if you don't have related PRs.
Checklist