feat(vuln): add Root.io support for container image scanning #9073

knqyf263 · 2025-06-25T13:36:37Z

Overview

The goal is to enable Trivy to scan Root.io container images. Root.io provides patches for three environments: Debian, Ubuntu, and Alpine-based systems. Unlike traditional Linux distributions that provide single fixed versions, Root.io provides version ranges (constraints), requiring flexible version comparison.

Summary

Add version constraint support with multiple operators for flexible version comparison
Implement dynamic driver selection based on package information
Add Root.io environment detection for Debian, Ubuntu, and Alpine systems
Integrate with trivy-db for Root.io vulnerability data
Add constraint-based vulnerability detection using version ranges

Related PRs

feat: Add Root.io vulnerability source support trivy-db#546
feat: Add Root vuln feed vuln-list-update#357
- ⚠️ This PR cannot be merged until those PRs are merged first.

Issues

Close Add Root.io scanning support #9074

- Add constraint.go with support for 5 operators (>, <, >=, <=, ==, !=) - Add compare.go with DEBComparer and APKComparer implementations - Support both comma and space separated constraints - Return errors for empty constraints/versions for security - Comprehensive test coverage with version_test package - All linter issues resolved

- Add version constraint library supporting 5 operators (>, <, >=, <=, ==, !=) - Implement DriverProvider pattern for dynamic driver selection - Add Root.io environment detection based on package version suffixes - Support Debian/Ubuntu (root.io suffix) and Alpine (roo7 suffix) - Add constraint-based vulnerability detection using version ranges - Include comprehensive tests for all components

- Add realistic mockVulnSrc that integrates with existing OS-specific VulnSrc implementations - Fetch advisories from original distributors (Debian, Ubuntu, Alpine) - Transform fixed versions to constraint format (VulnerableVersions, PatchedVersions) - Merge advisories from base OS and Root.io sources - Use actual trivy-db components for more realistic behavior

- Simplify Scanner struct by removing baseOS field (only used in NewScanner) - Add logger field with Root.io prefix for better debugging - Improve constraint checking logic to use VulnerableVersions array - Update isVulnerable method to handle constraint-based vulnerability detection - Add proper error handling and logging in constraint validation - Enhance comments and documentation

- Fix Alpine Root.io pattern from 'roo7' to '-r\d007\d' (e.g., -r10071, -r20072) - Change Debian/Ubuntu pattern from 'root.io' to '.root.io' using regex - Unify pattern matching using single hasPackageWithPattern function with precompiled regex - Simplify tests to only test public Provider function using rootio_test package - Remove redundant private function tests as requested - Fix import sorting in test file

- Fix empty error handling blocks in vulnsrc.go by properly returning errors - Add missing newline at end of driver.go file - Fix import order in provider_test.go as flagged by linter - All lint checks now pass with 0 issues

- Remove mock VulnSrc implementation - Use real trivy-db rootio.VulnSrc - Update go.mod to use trivy-db fork with Root.io support - Fix FixedVersion field mapping to use PatchedVersions

knqyf263 · 2025-06-26T08:09:48Z

pkg/detector/ospkg/rootio/rootio.go

+}
+
+// IsSupportedVersion checks if the version is supported.
+// TODO: Should check if the base OS reaches EOL?


@chait-slim What do you think?

I don't think we have a strong need to check official EOL from our point of view - a use case of our users is using EOL software for longer thanks to the patches we create.

So you create fixes for EOL OS versions (e.g. Alpine 3.18), right?

We support EOL distros, meaning we also create patches for them

DmitriyLewen · 2025-06-26T08:26:30Z

pkg/detector/ospkg/rootio/rootio.go

+}
+
+// Detect vulnerabilities in package using Root.io scanner
+func (s *Scanner) Detect(ctx context.Context, osVer string, _ *ftypes.Repository, pkgs []ftypes.Package) ([]types.DetectedVulnerability, error) {


I think make sense to add tests for this function

- Add Root.io documentation in others directory - Update vulnerability scanner data sources to include Root.io - Add Root.io to mkdocs navigation - Update others index to include Root.io images

- bump trivy-db - use VulnSrcGetter instead of VulnSrc

DmitriyLewen · 2025-06-27T10:46:51Z

For test i changed version of vim in alpine:3.18.7.
https://github.com/DmitriyLewen/trivy-db/pkgs/container/trivy-db is used for test.

rootio:vim (alpine 3.18.7)
==========================
Total: 36 (UNKNOWN: 2, LOW: 5, MEDIUM: 24, HIGH: 5, CRITICAL: 0)

┌────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────┬──────────────────────────────────────────────────────────────┐
│  Library   │ Vulnerability  │ Severity │ Status │ Installed Version │  Fixed Version  │                            Title                             │
├────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────┼──────────────────────────────────────────────────────────────┤
│ libcrypto3 │ CVE-2024-6119  │ HIGH     │ fixed  │ 3.1.5-r0          │ 3.1.7-r0        │ openssl: Possible denial of service in X.509 name checks     │
│            │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2024-6119                    │
│            ├────────────────┼──────────┤        │                   ├─────────────────┼──────────────────────────────────────────────────────────────┤
│            │ CVE-2024-13176 │ MEDIUM   │        │                   │ 3.1.8-r0        │ openssl: Timing side-channel in ECDSA signature computation  │
│            │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2024-13176                   │
...
│            │                │          │        │                   │                 │                                                              │
├────────────┼────────────────┼──────────┤        ├───────────────────┼─────────────────┼──────────────────────────────────────────────────────────────┤
│ vim        │ CVE-2024-22667 │ HIGH     │        │ 9.0.2073-r00070   │ 9.0.2073-r00071 │ vim: Stack buffer over flow in did_set_langmap function in   │
│            │                │          │        │                   │                 │ map.c                                                        │
│            │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2024-22667                   │
│            ├────────────────┼──────────┤        │                   │                 ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2023-48232 │ MEDIUM   │        │                   │                 │ vim: floating point exception in adjust_plines_for_skipcol() │
│            │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2023-48232                   │
│            ├────────────────┤          │        │                   │                 ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2023-48233 │          │        │                   │                 │ vim: overflow with count for :s command                      │
│            │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2023-48233                   │
│            ├────────────────┤          │        │                   │                 ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2023-48234 │          │        │                   │                 │ vim: overflow in nv_z_get_count                              │
│            │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2023-48234                   │
│            ├────────────────┤          │        │                   │                 ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2023-48235 │          │        │                   │                 │ vim: overflow in ex address parsing                          │
│            │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2023-48235                   │
│            ├────────────────┤          │        │                   │                 ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2023-48236 │          │        │                   │                 │ vim: overflow in get_number                                  │
│            │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2023-48236                   │
│            ├────────────────┤          │        │                   │                 ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2023-48237 │          │        │                   │                 │ vim: buffer overflow in shift_line                           │
│            │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2023-48237                   │
│            ├────────────────┼──────────┤        │                   │                 ├──────────────────────────────────────────────────────────────┤
│            │ CVE-2024-43374 │ LOW      │        │                   │                 │ vim: use-after-free in alist_add() in src/arglist.c          │
│            │                │          │        │                   │                 │ https://avd.aquasec.com/nvd/cve-2024-43374                   │
...
└────────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────┴──────────────────────────────────────────────────────────────┘

For vim Trivy took vulns from root.io.
For libcrypto3 Trivy took vulns from alpine DB.

- remove replace to fork - bump trivy-db

knqyf263 · 2025-06-30T05:57:01Z

pkg/detector/ospkg/rootio/rootio_private_test.go

nit: I personally think it's fine to test private functions if really necessary, but as for isVulnerable, it seems like all cases can be covered in constraint_test.go (TestConstraints_Check) and rootio_test.go (TestScanner_Detect). What do you think?

I also thought about this.
But we can't handle case with combination of constraints (e.g. "<1.0.0-2.root.io", ">=1.0.0-2 <1.0.0-3",) TestConstraints_Check.
I wanted to add these test cases in TestScanner_Detect, but with each new test case it became more and more difficult to work with this test.
so I decided to make this separate file so that it would be easy to see/check whether the version is included in the constraints array

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [mirror.gcr.io/aquasec/trivy](https://www.aquasec.com/products/trivy/) ([source](https://github.com/aquasecurity/trivy)) | minor | `0.63.0` -> `0.64.1` | --- ### Release Notes <details> <summary>aquasecurity/trivy (mirror.gcr.io/aquasec/trivy)</summary> ### [`v0.64.1`](https://github.com/aquasecurity/trivy/releases/tag/v0.64.1) [Compare Source](aquasecurity/trivy@v0.64.0...v0.64.1) #### Changelog - [`86ee3c1`](aquasecurity/trivy@86ee3c1) release: v0.64.1 \[release/v0.64] ([#9122](aquasecurity/trivy#9122)) - [`4e12722`](aquasecurity/trivy@4e12722) fix(misconf): skip rewriting expr if attr is nil \[backport: release/v0.64] ([#9127](aquasecurity/trivy#9127)) - [`9a7d384`](aquasecurity/trivy@9a7d384) fix(cli): Add more non-sensitive flags to telemetry \[backport: release/v0.64] ([#9124](aquasecurity/trivy#9124)) - [`53adfba`](aquasecurity/trivy@53adfba) fix(rootio): check full version to detect `root.io` packages \[backport: release/v0.64] ([#9120](aquasecurity/trivy#9120)) - [`8cf1bf9`](aquasecurity/trivy@8cf1bf9) fix(alma): parse epochs from rpmqa file \[backport: release/v0.64] ([#9119](aquasecurity/trivy#9119)) ### [`v0.64.0`](https://github.com/aquasecurity/trivy/blob/HEAD/CHANGELOG.md#0640-2025-06-30) [Compare Source](aquasecurity/trivy@v0.63.0...v0.64.0) ##### Features - **cli:** add version constraints to annoucements ([#9023](aquasecurity/trivy#9023)) ([19efa9f](aquasecurity/trivy@19efa9f)) - **java:** dereference all maven settings.xml env placeholders ([#9024](aquasecurity/trivy#9024)) ([5aade69](aquasecurity/trivy@5aade69)) - **misconf:** add OpenTofu file extension support ([#8747](aquasecurity/trivy#8747)) ([57801d0](aquasecurity/trivy@57801d0)) - **misconf:** normalize CreatedBy for buildah and legacy docker builder ([#8953](aquasecurity/trivy#8953)) ([65e155f](aquasecurity/trivy@65e155f)) - **redhat:** Add EOL date for RHEL 10. ([#8910](aquasecurity/trivy#8910)) ([48258a7](aquasecurity/trivy@48258a7)) - reject unsupported artifact types in remote image retrieval ([#9052](aquasecurity/trivy#9052)) ([1e1e1b5](aquasecurity/trivy@1e1e1b5)) - **sbom:** add manufacturer field to CycloneDX tools metadata ([#9019](aquasecurity/trivy#9019)) ([41d0f94](aquasecurity/trivy@41d0f94)) - **terraform:** add partial evaluation for policy templates ([#8967](aquasecurity/trivy#8967)) ([a9f7dcd](aquasecurity/trivy@a9f7dcd)) - **ubuntu:** add end of life date for Ubuntu 25.04 ([#9077](aquasecurity/trivy#9077)) ([367564a](aquasecurity/trivy@367564a)) - **ubuntu:** add eol date for 20.04-ESM ([#8981](aquasecurity/trivy#8981)) ([87118a0](aquasecurity/trivy@87118a0)) - **vuln:** add Root.io support for container image scanning ([#9073](aquasecurity/trivy#9073)) ([3a0ec0f](aquasecurity/trivy@3a0ec0f)) ##### Bug Fixes - Add missing version check flags ([#8951](aquasecurity/trivy#8951)) ([ef5f8de](aquasecurity/trivy@ef5f8de)) - **cli:** add some values to the telemetry call ([#9056](aquasecurity/trivy#9056)) ([fd2bc91](aquasecurity/trivy@fd2bc91)) - Correctly check for semver versions for trivy version check ([#8948](aquasecurity/trivy#8948)) ([b813527](aquasecurity/trivy@b813527)) - don't show corrupted trivy-db warning for first run ([#8991](aquasecurity/trivy#8991)) ([4ed78e3](aquasecurity/trivy@4ed78e3)) - **misconf:** .Config.User always takes precedence over USER in .History ([#9050](aquasecurity/trivy#9050)) ([371b8cc](aquasecurity/trivy@371b8cc)) - **misconf:** correct Azure value-to-time conversion in AsTimeValue ([#9015](aquasecurity/trivy#9015)) ([40d017b](aquasecurity/trivy@40d017b)) - **misconf:** move disabled checks filtering after analyzer scan ([#9002](aquasecurity/trivy#9002)) ([a58c36d](aquasecurity/trivy@a58c36d)) - **misconf:** reduce log noise on incompatible check ([#9029](aquasecurity/trivy#9029)) ([99c5151](aquasecurity/trivy@99c5151)) - **nodejs:** correctly parse `packages` array of `bun.lock` file ([#8998](aquasecurity/trivy#8998)) ([875ec3a](aquasecurity/trivy@875ec3a)) - **report:** don't panic when report contains vulns, but doesn't contain packages for `table` format ([#8549](aquasecurity/trivy#8549)) ([87fda76](aquasecurity/trivy@87fda76)) - **sbom:** remove unnecessary OS detection check in SBOM decoding ([#9034](aquasecurity/trivy#9034)) ([198789a](aquasecurity/trivy@198789a)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/812 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

…urity#9073) Co-authored-by: DmitriyLewen <dmitriy.lewen@smartforce.io>

knqyf263 added 2 commits June 25, 2025 15:22

knqyf263 self-assigned this Jun 25, 2025

knqyf263 changed the title ~~feat: add root.io support for container image scanning~~ feat(vuln): add Root.io support for container image scanning Jun 25, 2025

knqyf263 added kind/feature Categorizes issue or PR as related to a new feature. scan/vulnerability Issues relating to vulnerability scanning target/container-image Issues relating to container image scanning labels Jun 25, 2025

knqyf263 added 4 commits June 25, 2025 18:39

fix: resolve linter issues

1885e35

- Fix empty error handling blocks in vulnsrc.go by properly returning errors - Add missing newline at end of driver.go file - Fix import order in provider_test.go as flagged by linter - All lint checks now pass with 0 issues

knqyf263 requested a review from DmitriyLewen June 25, 2025 17:30

refactor: replace mock VulnSrc with trivy-db integration

2ed3d7e

- Remove mock VulnSrc implementation - Use real trivy-db rootio.VulnSrc - Update go.mod to use trivy-db fork with Root.io support - Fix FixedVersion field mapping to use PatchedVersions

knqyf263 commented Jun 26, 2025

View reviewed changes

DmitriyLewen reviewed Jun 26, 2025

View reviewed changes

knqyf263 and others added 10 commits June 26, 2025 12:26

docs: add Root.io documentation

3b54435

- Add Root.io documentation in others directory - Update vulnerability scanner data sources to include Root.io - Add Root.io to mkdocs navigation - Update others index to include Root.io images

refactor: use AND logic for constraint.go

978276d

test: add tests for rootio

71ab2b8

Merge branch 'main' into '(feat/rootio-support'

9b35e6b

chore: add comment for IsSupportedVersion

50d153b

test: refactor IsVulnerable testcases

b8853b2

chore(deps): bump trivy-db

2da74d6

docs: mage docs:generate

e988fbf

chore(deps): bump trivy-db

66dfc2a

- bump trivy-db - use VulnSrcGetter instead of VulnSrc

fix: trim patch/minor+patch for OS version

b49a6be

DmitriyLewen marked this pull request as ready for review June 27, 2025 14:03

chore(deps): remove replace

01adf80

- remove replace to fork - bump trivy-db

DmitriyLewen approved these changes Jun 27, 2025

View reviewed changes

DmitriyLewen added this pull request to the merge queue Jun 27, 2025

Merged via the queue into aquasecurity:main with commit 3a0ec0f Jun 27, 2025
17 checks passed

aqua-bot mentioned this pull request Jun 27, 2025

release: v0.64.0 [main] #8955

Merged

knqyf263 deleted the feat/rootio-support branch June 30, 2025 05:41

knqyf263 commented Jun 30, 2025

View reviewed changes

yutatokoi pushed a commit to yutatokoi/trivy that referenced this pull request Aug 12, 2025

feat(vuln): add Root.io support for container image scanning (aquasec…

4ecf526

…urity#9073) Co-authored-by: DmitriyLewen <dmitriy.lewen@smartforce.io>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(vuln): add Root.io support for container image scanning #9073

feat(vuln): add Root.io support for container image scanning #9073

Uh oh!

knqyf263 commented Jun 25, 2025 •

edited

Loading

Uh oh!

knqyf263 Jun 26, 2025

Uh oh!

benjifin Jun 26, 2025

Uh oh!

DmitriyLewen Jun 26, 2025

Uh oh!

chait-slim Jun 26, 2025

Uh oh!

DmitriyLewen Jun 26, 2025

Uh oh!

DmitriyLewen commented Jun 27, 2025

Uh oh!

Uh oh!

knqyf263 Jun 30, 2025

Uh oh!

DmitriyLewen Jun 30, 2025

Uh oh!

Uh oh!

feat(vuln): add Root.io support for container image scanning #9073

feat(vuln): add Root.io support for container image scanning #9073

Uh oh!

Conversation

knqyf263 commented Jun 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

Summary

Related PRs

Issues

Uh oh!

knqyf263 Jun 26, 2025

Choose a reason for hiding this comment

Uh oh!

benjifin Jun 26, 2025

Choose a reason for hiding this comment

Uh oh!

DmitriyLewen Jun 26, 2025

Choose a reason for hiding this comment

Uh oh!

chait-slim Jun 26, 2025

Choose a reason for hiding this comment

Uh oh!

DmitriyLewen Jun 26, 2025

Choose a reason for hiding this comment

Uh oh!

DmitriyLewen commented Jun 27, 2025

Uh oh!

Uh oh!

knqyf263 Jun 30, 2025

Choose a reason for hiding this comment

Uh oh!

DmitriyLewen Jun 30, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

knqyf263 commented Jun 25, 2025 •

edited

Loading