Skip to content

Conversation

owenrumney
Copy link
Contributor

@owenrumney owenrumney commented Jun 19, 2025

Description

Add some information about arguments that are not sensitive and have
discrete values that can be provided.

All flag keys that are explicitly set will be sent,
but only flags marked as TelemetrySafe will include the value

Add tests to validate that the args generated do as required.

Update the documentation to include the flags that will have values passed, this is done in the magefile to ensure additional flags marked TelemetrySafe will be included

Example capture

For the command:

trivy fs --security-checks=misconfig --severity=LOW,HIGH -s CRITICAL --ignorefile ../trivy-ci-test/.trivyignore.yaml -d ../trivy-ci-test 

the following payload would be captured

{
  "properties": {
    "distinct_id": "7340dc2a09cfce927e881d15492270c3d89552982399793eddb562b02525d5a0",
    "os": "darwin",
    "arch": "arm64",
    "command": "fs",
    "command_flags": "--debug=true --ignorefile=****** --severity=LOW,HIGH,CRITICAL --scanners=misconfig",
    "user_agent": "trivy/dev"
  }
}

Related issues

Remove this section if you don't have related PRs.

Checklist

  • I've read the guidelines for contributing to this repository.
  • I've followed the conventions in the PR title.
  • I've added tests that prove my fix is effective or that my feature works.
  • I've updated the documentation with the relevant information (if needed).

@owenrumney owenrumney requested a review from knqyf263 as a code owner June 19, 2025 16:06
@owenrumney owenrumney marked this pull request as draft June 19, 2025 16:06
@nikpivkin
Copy link
Contributor

Hi @owenrumney !

I see that PR is not ready for review yet, but I would like to share my implementation idea with you. What if we add a new NonSensitive field for flags, which indicates that the field does not contain sensitive data and can be used for telemetry. The field will default to false, which will prevent it from being accidentally sent when new flags are added. This will allow us to dynamically collect all used flags from different sources (cli arguments, environment variables or config files) and not have to process them manually and generate a list of flags to be collected for documentation.

Below I have given a simple example implementation. Note that I have not added filtering of flags that are actually used. For that, we can add an isUsed field that is set after calling viper.Get and filter on that field. Let me know if I missed something.

diff --git a/pkg/flag/options.go b/pkg/flag/options.go
index f0f8276a5..dea33a9dd 100644
--- a/pkg/flag/options.go
+++ b/pkg/flag/options.go
@@ -76,6 +76,8 @@ type Flag[T FlagType] struct {
        // Aliases represents aliases
        Aliases []Alias
 
+       NonSensitive bool
+
        // value is the value passed through CLI flag, env, or config file.
        // It is populated after flag.Parse() is called.
        value T
@@ -222,6 +224,10 @@ func (f *Flag[T]) Hidden() bool {
        return f.Deprecated != "" || f.Removed != "" || f.Internal
 }
 
+func (f *Flag[T]) IsNonSensitive() bool {
+       return f.NonSensitive
+}
+
 func (f *Flag[T]) Value() (t T) {
        if f == nil {
                return t
@@ -349,6 +355,7 @@ type Flagger interface {
        GetDefaultValue() any
        GetAliases() []Alias
        Hidden() bool
+       IsNonSensitive() bool
 
        Parse() error
        Add(cmd *cobra.Command)
@@ -385,6 +392,8 @@ type Options struct {
        // We don't want to allow disabled analyzers to be passed by users, but it is necessary for internal use.
        DisabledAnalyzers []analyzer.Type
 
+       Flags *Flags
+
        // outputWriter is not initialized via the CLI.
        // It is mainly used for testing purposes or by tools that use Trivy as a library.
        outputWriter io.Writer
@@ -644,6 +653,7 @@ func (f *Flags) Bind(cmd *cobra.Command) error {
 func (f *Flags) ToOptions(args []string) (Options, error) {
        opts := Options{
                AppVersion: app.Version(),
+               Flags:      f,
                args:       args,
        }

diff --git a/pkg/notification/notice.go b/pkg/notification/notice.go
index 491ae0cb5..0fcabff75 100644
--- a/pkg/notification/notice.go
+++ b/pkg/notification/notice.go
+func getUsedArgs(cliOpts flag.Options) []string {
+       var args []string
+       if cliOpts.Flags != nil {
+               for _, flagGroup := range *cliOpts.Flags {
+                       for _, f := range flagGroup.Flags() {
+                               var val string
+                               if f.IsNonSensitive() {
+                                       type flagger[T flag.FlagType] interface {
+                                               Value() T
+                                       }
+                                       switch ff := f.(type) {
+                                       case flagger[string]:
+                                               val = ff.Value()
+                                       case flagger[int]:
+                                               val = strconv.Itoa(ff.Value())
+                                       case flagger[float64]:
+                                               val = fmt.Sprintf("%f", ff.Value())
+                                       case flagger[bool]:
+                                               val = strconv.FormatBool(ff.Value())
+                                       case flagger[time.Duration]:
+                                               val = ff.Value().String()
+                                       case flagger[[]string]:
+                                               val = strings.Join(ff.Value(), ",")
+                                       case flagger[map[string][]string]:
+                                               // TODO
+                                       }
+
+                               } else {
+                                       val = "<SENSITIVE>"
+                               }
+                               args = append(args, fmt.Sprintf("%s=%s", f.GetName(), val))
+                       }
+               }
+       }
+       return args
+}
+

@owenrumney
Copy link
Contributor Author

owenrumney commented Jun 20, 2025

Hey @nikpivkin, Yeah, I like this thanks. I'll have a fiddle with updating to this. Thanks for the proactive review, very helpful 👍

@owenrumney owenrumney force-pushed the feat/add-select-command-values-in-telemetry branch 2 times, most recently from 8f444ee to 7c47301 Compare June 20, 2025 16:15
@itaysk
Copy link
Contributor

itaysk commented Jun 21, 2025

very small ask, I see that the doc that I hastily wrote has a some typos and formatting issues, could you please add it to the PR:

diff --git a/docs/docs/advanced/telemetry.md b/docs/docs/advanced/telemetry.md
index 92763f8b6..315597877 100644
--- a/docs/docs/advanced/telemetry.md
+++ b/docs/docs/advanced/telemetry.md
@@ -1,24 +1,24 @@
 # Usage Telemetry
 
-Trivy collect anonymous usage data in order to help us improve the product. This document explains what is collected and how you can control it.
+Trivy collects anonymous usage data in order to help us improve the product. This document explains what is collected and how you can control it.
 
 ## Data collected
 
 The following information could be collected:
 
-- Environmental information
-  - Installation identifier
-  - Trivy version
-  - Operating system
-- Scan
-  - Non-revealing scan options
+- Environmental information:
+    - Installation identifier
+    - Trivy version
+    - Operating system
+- Scan:
+    - Non-revealing scan options
 
 ## Privacy
 
 No personal information, scan results, or sensitive data is specifically collected. We take the following measures to ensure that:
 
-- Installation identifier: one-way hash of machine fingerprint, resulting in opaque string.
-- Scaner: any option that is user controlled is omitted (never collected). For example, file paths, image names, etc are never collected.
+- Installation identifier: one-way hash of machine fingerprint, resulting in opaque ID.
+- Scan: any option that is user-controlled is omitted (never collected). For example, file paths, image names, etc are never collected.
 
 Trivy is an Aqua Security product and adheres to the company's privacy policy: <https://aquasec.com/privacy>.

@owenrumney owenrumney changed the title feat(cli): add some values to the telemetry call fix(cli): add some values to the telemetry call Jun 21, 2025
@owenrumney owenrumney force-pushed the feat/add-select-command-values-in-telemetry branch 2 times, most recently from 62f4190 to 275bc99 Compare June 21, 2025 10:48
@owenrumney owenrumney marked this pull request as ready for review June 23, 2025 07:28
- Updated the VersionChecker to accept command name and cliOptions directly, removing the need for multiple options functions.
- Simplified the getFlags function to directly utilize the Flags structure for extracting command line arguments.
- Enhanced flag definitions across various files to include TelemetrySafe attribute for better telemetry management.
- Modified tests to accommodate changes in the VersionChecker and flag extraction logic, ensuring accurate command and flag headers are sent during update checks.
- Removed the deprecated option functions in the notification package to streamline the codebase.
@owenrumney owenrumney force-pushed the feat/add-select-command-values-in-telemetry branch from 0833a9a to 7499b8e Compare June 25, 2025 07:44
Move the logic to get the set flags into the flag package and process
the returned Flaggers
@owenrumney owenrumney force-pushed the feat/add-select-command-values-in-telemetry branch from ed4f430 to b6709eb Compare June 25, 2025 12:29
Copy link
Contributor

@nikpivkin nikpivkin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@simar7 simar7 self-requested a review June 27, 2025 03:41
Copy link
Member

@simar7 simar7 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:shipit:

Copy link
Contributor

@DmitriyLewen DmitriyLewen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

"github.com/aquasecurity/trivy/pkg/commands"
"github.com/aquasecurity/trivy/pkg/flag"
"github.com/aquasecurity/trivy/pkg/log"
"github.com/spf13/cobra/doc"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hm.. It looks like linter doesn't check mage dir

@owenrumney owenrumney added this pull request to the merge queue Jun 27, 2025
Merged via the queue into aquasecurity:main with commit fd2bc91 Jun 27, 2025
17 checks passed
@owenrumney owenrumney deleted the feat/add-select-command-values-in-telemetry branch June 27, 2025 07:33
alexlebens pushed a commit to alexlebens/infrastructure that referenced this pull request Jul 5, 2025
This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [mirror.gcr.io/aquasec/trivy](https://www.aquasec.com/products/trivy/) ([source](https://github.com/aquasecurity/trivy)) | minor | `0.63.0` -> `0.64.1` |

---

### Release Notes

<details>
<summary>aquasecurity/trivy (mirror.gcr.io/aquasec/trivy)</summary>

### [`v0.64.1`](https://github.com/aquasecurity/trivy/releases/tag/v0.64.1)

[Compare Source](aquasecurity/trivy@v0.64.0...v0.64.1)

#### Changelog

- [`86ee3c1`](aquasecurity/trivy@86ee3c1) release: v0.64.1 \[release/v0.64] ([#&#8203;9122](aquasecurity/trivy#9122))
- [`4e12722`](aquasecurity/trivy@4e12722) fix(misconf): skip rewriting expr if attr is nil \[backport: release/v0.64] ([#&#8203;9127](aquasecurity/trivy#9127))
- [`9a7d384`](aquasecurity/trivy@9a7d384) fix(cli): Add more non-sensitive flags to telemetry \[backport: release/v0.64] ([#&#8203;9124](aquasecurity/trivy#9124))
- [`53adfba`](aquasecurity/trivy@53adfba) fix(rootio): check full version to detect `root.io` packages \[backport: release/v0.64] ([#&#8203;9120](aquasecurity/trivy#9120))
- [`8cf1bf9`](aquasecurity/trivy@8cf1bf9) fix(alma): parse epochs from rpmqa file \[backport: release/v0.64] ([#&#8203;9119](aquasecurity/trivy#9119))

### [`v0.64.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0640-2025-06-30)

[Compare Source](aquasecurity/trivy@v0.63.0...v0.64.0)

##### Features

- **cli:** add version constraints to annoucements ([#&#8203;9023](aquasecurity/trivy#9023)) ([19efa9f](aquasecurity/trivy@19efa9f))
- **java:** dereference all maven settings.xml env placeholders ([#&#8203;9024](aquasecurity/trivy#9024)) ([5aade69](aquasecurity/trivy@5aade69))
- **misconf:** add OpenTofu file extension support ([#&#8203;8747](aquasecurity/trivy#8747)) ([57801d0](aquasecurity/trivy@57801d0))
- **misconf:** normalize CreatedBy for buildah and legacy docker builder ([#&#8203;8953](aquasecurity/trivy#8953)) ([65e155f](aquasecurity/trivy@65e155f))
- **redhat:** Add EOL date for RHEL 10. ([#&#8203;8910](aquasecurity/trivy#8910)) ([48258a7](aquasecurity/trivy@48258a7))
- reject unsupported artifact types in remote image retrieval ([#&#8203;9052](aquasecurity/trivy#9052)) ([1e1e1b5](aquasecurity/trivy@1e1e1b5))
- **sbom:** add manufacturer field to CycloneDX tools metadata ([#&#8203;9019](aquasecurity/trivy#9019)) ([41d0f94](aquasecurity/trivy@41d0f94))
- **terraform:** add partial evaluation for policy templates ([#&#8203;8967](aquasecurity/trivy#8967)) ([a9f7dcd](aquasecurity/trivy@a9f7dcd))
- **ubuntu:** add end of life date for Ubuntu 25.04 ([#&#8203;9077](aquasecurity/trivy#9077)) ([367564a](aquasecurity/trivy@367564a))
- **ubuntu:** add eol date for 20.04-ESM ([#&#8203;8981](aquasecurity/trivy#8981)) ([87118a0](aquasecurity/trivy@87118a0))
- **vuln:** add Root.io support for container image scanning ([#&#8203;9073](aquasecurity/trivy#9073)) ([3a0ec0f](aquasecurity/trivy@3a0ec0f))

##### Bug Fixes

- Add missing version check flags ([#&#8203;8951](aquasecurity/trivy#8951)) ([ef5f8de](aquasecurity/trivy@ef5f8de))
- **cli:** add some values to the telemetry call ([#&#8203;9056](aquasecurity/trivy#9056)) ([fd2bc91](aquasecurity/trivy@fd2bc91))
- Correctly check for semver versions for trivy version check ([#&#8203;8948](aquasecurity/trivy#8948)) ([b813527](aquasecurity/trivy@b813527))
- don't show corrupted trivy-db warning for first run ([#&#8203;8991](aquasecurity/trivy#8991)) ([4ed78e3](aquasecurity/trivy@4ed78e3))
- **misconf:** .Config.User always takes precedence over USER in .History ([#&#8203;9050](aquasecurity/trivy#9050)) ([371b8cc](aquasecurity/trivy@371b8cc))
- **misconf:** correct Azure value-to-time conversion in AsTimeValue ([#&#8203;9015](aquasecurity/trivy#9015)) ([40d017b](aquasecurity/trivy@40d017b))
- **misconf:** move disabled checks filtering after analyzer scan ([#&#8203;9002](aquasecurity/trivy#9002)) ([a58c36d](aquasecurity/trivy@a58c36d))
- **misconf:** reduce log noise on incompatible check ([#&#8203;9029](aquasecurity/trivy#9029)) ([99c5151](aquasecurity/trivy@99c5151))
- **nodejs:** correctly parse `packages` array of `bun.lock` file ([#&#8203;8998](aquasecurity/trivy#8998)) ([875ec3a](aquasecurity/trivy@875ec3a))
- **report:** don't panic when report contains vulns, but doesn't contain packages for `table` format ([#&#8203;8549](aquasecurity/trivy#8549)) ([87fda76](aquasecurity/trivy@87fda76))
- **sbom:** remove unnecessary OS detection check in SBOM decoding ([#&#8203;9034](aquasecurity/trivy#9034)) ([198789a](aquasecurity/trivy@198789a))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0MS4xLjMiLCJ1cGRhdGVkSW5WZXIiOiI0MS4xLjMiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImltYWdlIl19-->

Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/812
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>
yutatokoi pushed a commit to yutatokoi/trivy that referenced this pull request Aug 12, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

fix(cli): Add select command values in telemetry message
5 participants