feat(cli): rename `--vuln-type` flag to `--pkg-types` flag #7104

DmitriyLewen · 2024-07-05T09:49:23Z

Description

Rename --vuln-type flag to --pkg-types flag.
See #6269

Before:

➜ trivy -d image --vuln-type os aquasec/trivy
...
2024-07-05T15:45:36+06:00       DEBUG   Vulnerability type      type=[os]
...
aquasec/trivy (alpine 3.20.0)

Total: 10 (UNKNOWN: 0, LOW: 0, MEDIUM: 10, HIGH: 0, CRITICAL: 0)

➜ trivy -d image --vuln-type library aquasec/trivy
...
2024-07-05T15:45:46+06:00       DEBUG   Vulnerability type      type=[library]
...

usr/local/bin/trivy (gobinary)

Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

After:

➜ trivy -d image --vuln-type os aquasec/trivy
2024/07/05 15:47:26 WARN '--vuln-type' is deprecated. Use '--pkg-types' instead.

➜ trivy -d image --pkg-types os aquasec/trivy
...
2024-07-05T15:47:59+06:00       DEBUG   Package types   types=[os]
...

aquasec/trivy (alpine 3.20.0)

Total: 10 (UNKNOWN: 0, LOW: 0, MEDIUM: 10, HIGH: 0, CRITICAL: 0)

➜ trivy -d image --pkg-types library aquasec/trivy
...
2024-07-05T15:48:11+06:00       DEBUG   Package types   types=[library]
...

usr/local/bin/trivy (gobinary)

Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

Related issues

Close use --vuln-type flag for Packages #6269

Checklist

I've read the guidelines for contributing to this repository.
I've followed the conventions in the PR title.
I've added tests that prove my fix is effective or that my feature works.
I've updated the documentation with the relevant information (if needed).
I've added usage information (if the PR introduces new options)
I've included a "before" and "after" example to the description (if the PR is a user interface change).

knqyf263 · 2024-07-05T11:16:45Z

We can leverage aliases.

trivy/pkg/flag/options.go

Lines 68 to 69 in a7a304d

    
           // Aliases represents aliases 
        
           Aliases []Alias

Example:

trivy/pkg/flag/rego_flags.go

Lines 19 to 24 in a7a304d

    
           Aliases: []Alias{ 
        
           	{ 
        
           		Name:       "skip-policy-update", 
        
           		Deprecated: true, 
        
           	}, 
        
           },

DmitriyLewen · 2024-07-08T02:51:24Z

I used Alias.
But I thought the report.go file would be better suited for this flag.
So i moved this flag to this file + rename flag + add Alias.

trivy/pkg/flag/report_flags.go

Lines 109 to 122 in 5bc3fa7

    
           PkgTypesFlag = Flag[[]string]{ 
        
           	Name:       "pkg-types", 
        
           	ConfigName: "pkg-types", 
        
           	Default:    types.PkgTypes, 
        
           	Values:     types.PkgTypes, 
        
           	Usage:      "comma-separated list of package types", 
        
           	Aliases: []Alias{ 
        
           		{ 
        
           			Name:       "vuln-type", 
        
           			ConfigName: "vulnerability.type", 
        
           			Deprecated: true, // --vuln-type was renamed to --pkg-types 
        
           		}, 
        
           	}, 
        
           }

knqyf263 · 2024-07-09T03:40:37Z

I don't think it's a breaking
change. People can keep using --vuln-type. We should announce the deprecation. After a while, we'll delete it, then it'll be a breaking change as the same command no longer works.

It is always difficult to determine the type of PR, but I think it will be a "refactor" when there is no user impact. In this case, UI will be changed. It's not a new feature or bug fix, but I think "feat" is the closest.

DmitriyLewen · 2024-07-09T03:45:19Z

I don't think it's a breaking change

I thought about this.
I renamed VulnType to PkgTypes e.g.:

trivy/pkg/types/target.go

Line 8 in 5bc3fa7

type PkgType = string
trivy/pkg/types/scan.go

Line 25 in 5bc3fa7

PkgTypes []string

These are breaking changes for users using Trivy as a library.

It is always difficult to determine the type of PR, but I think it will be a "refactor" when there is no user impact. In this case, UI will be changed. It's not a new feature or bug fix, but I think "feat" is the closest.

hm... okay, i will change type of PR.

knqyf263 · 2024-07-09T05:29:24Z

These are breaking changes for users using Trivy as a library.

That's a good point. But Trivy is a CLI tool. We could consider whether changing to CLI usage is destructive. Of course, we should ensure the change is minimal for tools importing Trivy, though. Otherwise, adding arguments to an internal function will be a breaking change if it is exported.

@naortalmor1 @tamirkiviti13 @tonaim We changed a variable name. I don't think it will have a major impact, but I thought I'd let you know just in case.

DmitriyLewen · 2024-07-09T05:44:21Z

Okay. I got you.
I updated type of PR

knqyf263

It's not an issue from this PR, but logging doesn't seem to be enabled well. I mean our custom handler is not initialized, and the log format is different.

2024/07/09 10:08:31 WARN '--vuln-type' is deprecated. Use '--pkg-types' instead.
2024-07-09T10:08:31+04:00	INFO	Vulnerability scanning is enabled

knqyf263 · 2024-07-09T06:08:13Z

rpc/scanner/service.proto

  repeated string       scanners           = 2;
  map<string, Licenses> license_categories = 4;
  bool                  include_dev_deps   = 5;
+  repeated string       pkg_types          = 6;


You don't have to add a new field when renaming it. Protobuf uses a number for marshaling/unmarshaling. When you change the field type, like int to string, you need a new field.

Got it! Updated in aeb4f49

DmitriyLewen · 2024-07-09T06:30:22Z

It's not an issue from this PR, but logging doesn't seem to be enabled well. I mean our custom handler is not initialized, and the log format is different.

Created #7124 for this.

knqyf263 · 2024-07-09T06:53:07Z

pkg/types/target.go

-	// VulnTypeLibrary is a vulnerability type of programming language dependencies
-	VulnTypeLibrary = VulnType("library")
+	// PkgTypeLibrary is a package type of programming language dependencies
+	PkgTypeLibrary = PkgType("library")


I want to change it to lang or language as we lately call them "Language-specific packages". (we used to call them libraries, as you know). But I don't want to break compatibility. Do you think we should open another PR? I think it's a good opportunity.

I think it's a good opportunity.

Yeah. Now is the best time for this.

I want to change it to lang or language as we lately call them "Language-specific packages"

I think lang will be enough.

But I don't want to break compatibility. Do you think we should open another PR?

I think it is better to create one more PR for this.
Also we need to create 2 paragraphs in release discussion to attract the attention of users to the fact that we not only renamed flag, but also changed library to lang.
Also in the new PR we need to add warning when user uses library and rename it (like we do with flag aliases)

I think it is better to create one more PR for this.

OK. However, we can announce these changes together in a single thread in GitHub Discussions.
e.g. #7010

Yes, that's a good idea!

…ity#7104)

- Fix --vuln-type flag renamed into --pkg-types aquasecurity/trivy#7104; \n- Adopt package relationships aquasecurity/trivy#7237

* Bump trivy to v0.49.1 * Bump trivy to v0.51.4 - Fix registry version aquasecurity/trivy#6219; - Fix replace zap with slog aquasecurity/trivy#6466; - The fix with slog used a zap to slog bridge (official from zap, but exp). It didn't have a license file, so I hardcoded a commit version that had; - Adopt opts.Align() to validate options object; * Bump trivy to v0.52.2 * Temp change the workflow trigger to test changes * Free up space on runner * Bump trivy to v0.53.0 - Fix go clear cache aquasecurity/trivy#7010 * Bump trivy to v0.54.1 - Fix --vuln-type flag renamed into --pkg-types aquasecurity/trivy#7104; - Adopt package relationships aquasecurity/trivy#7237 * Rollback CI run on target * Clean 'scan cache clean' code and add timeout to it

See aquasecurity/trivy#7104

…#83) * chore(deps): bump github.com/aquasecurity/trivy from 0.53.0 to 0.54.1 Bumps [github.com/aquasecurity/trivy](https://github.com/aquasecurity/trivy) from 0.53.0 to 0.54.1. - [Release notes](https://github.com/aquasecurity/trivy/releases) - [Changelog](https://github.com/aquasecurity/trivy/blob/v0.54.1/CHANGELOG.md) - [Commits](aquasecurity/trivy@v0.53.0...v0.54.1) --- updated-dependencies: - dependency-name: github.com/aquasecurity/trivy dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * fix: Use new flag for vulnerability type See aquasecurity/trivy#7104 * bump: Trivy version for vulnerability DB updates * fix: Specify types of dependencies to analyze It's only necessary to specifiy these types when running the scanners directly, as we do. When running Trivy via the command line it's not necessary. See aquasecurity/trivy#7237 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: André Meira <andre.meira@codacy.com>

DmitriyLewen added 4 commits July 5, 2024 15:25

refactor(flag): move flag from vulnerability_flags.go to report_flags.go

67938f7

refactor(flag): rename VulnType to PkgTypes

f7e262b

docs(cli): rename VulnType to PkgTypes

eefc4ad

docs(config-file): rename VulnType to PkgTypes

403e648

DmitriyLewen self-assigned this Jul 5, 2024

docs(vulnerability): rename VulnType to PkgTypes

5bc3fa7

DmitriyLewen changed the title ~~refactor(cli)!: rename vuln-type to pkg-types~~ refactor(cli)!: rename --vuln-type flag to --pkg-types flag Jul 5, 2024

DmitriyLewen marked this pull request as ready for review July 5, 2024 10:21

DmitriyLewen requested review from chen-keinan and knqyf263 as code owners July 5, 2024 10:21

DmitriyLewen changed the title ~~refactor(cli)!: rename --vuln-type flag to --pkg-types flag~~ feat(cli)!: rename --vuln-type flag to --pkg-types flag Jul 9, 2024

DmitriyLewen changed the title ~~feat(cli)!: rename --vuln-type flag to --pkg-types flag~~ feat(cli): rename --vuln-type flag to --pkg-types flag Jul 9, 2024

knqyf263 reviewed Jul 9, 2024

View reviewed changes

refactor(rpc): rename and not delete vuln-type

aeb4f49

knqyf263 reviewed Jul 9, 2024

View reviewed changes

knqyf263 approved these changes Jul 9, 2024

View reviewed changes

knqyf263 added this pull request to the merge queue Jul 9, 2024

Merged via the queue into aquasecurity:main with commit 7cbdb0a Jul 9, 2024
17 checks passed

aqua-bot mentioned this pull request Jul 9, 2024

release: v0.54.0 [main] #7075

Merged

DmitriyLewen deleted the refactor/pkg-types branch July 9, 2024 08:28

skahn007gl pushed a commit to skahn007gl/trivy that referenced this pull request Jul 23, 2024

feat(cli): rename --vuln-type flag to --pkg-types flag (aquasecur…

1406e23

…ity#7104)

romulets mentioned this pull request Aug 7, 2024

Bump trivy to v0.54.1 and fix breaking changes elastic/cloudbeat#2399

Merged

romulets added a commit to elastic/cloudbeat that referenced this pull request Aug 13, 2024

Bump trivy to v0.54.1

54d01fa

- Fix --vuln-type flag renamed into --pkg-types aquasecurity/trivy#7104; \n- Adopt package relationships aquasecurity/trivy#7237

romulets added a commit to romulets/cloudbeat that referenced this pull request Aug 13, 2024

Bump trivy to v0.54.1

76bb972

- Fix --vuln-type flag renamed into --pkg-types aquasecurity/trivy#7104; \n- Adopt package relationships aquasecurity/trivy#7237

romulets mentioned this pull request Aug 13, 2024

Bump Trivy to v0.54.1 elastic/cloudbeat#2427

Merged

afsmeira added a commit to codacy/codacy-trivy that referenced this pull request Aug 29, 2024

fix: Use new flag for vulnerability type

f143080

See aquasecurity/trivy#7104

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(cli): rename `--vuln-type` flag to `--pkg-types` flag #7104

feat(cli): rename `--vuln-type` flag to `--pkg-types` flag #7104

DmitriyLewen commented Jul 5, 2024

knqyf263 commented Jul 5, 2024

DmitriyLewen commented Jul 8, 2024

knqyf263 commented Jul 9, 2024

DmitriyLewen commented Jul 9, 2024 •

edited

Loading

knqyf263 commented Jul 9, 2024

DmitriyLewen commented Jul 9, 2024

knqyf263 left a comment •

edited

Loading

knqyf263 Jul 9, 2024

DmitriyLewen Jul 9, 2024

DmitriyLewen commented Jul 9, 2024

knqyf263 Jul 9, 2024

DmitriyLewen Jul 9, 2024

knqyf263 Jul 9, 2024

DmitriyLewen Jul 9, 2024

feat(cli): rename --vuln-type flag to --pkg-types flag #7104

feat(cli): rename --vuln-type flag to --pkg-types flag #7104

Conversation

DmitriyLewen commented Jul 5, 2024

Description

Related issues

Checklist

knqyf263 commented Jul 5, 2024

DmitriyLewen commented Jul 8, 2024

knqyf263 commented Jul 9, 2024

DmitriyLewen commented Jul 9, 2024 • edited Loading

knqyf263 commented Jul 9, 2024

DmitriyLewen commented Jul 9, 2024

knqyf263 left a comment • edited Loading

Choose a reason for hiding this comment

knqyf263 Jul 9, 2024

Choose a reason for hiding this comment

DmitriyLewen Jul 9, 2024

Choose a reason for hiding this comment

DmitriyLewen commented Jul 9, 2024

knqyf263 Jul 9, 2024

Choose a reason for hiding this comment

DmitriyLewen Jul 9, 2024

Choose a reason for hiding this comment

knqyf263 Jul 9, 2024

Choose a reason for hiding this comment

DmitriyLewen Jul 9, 2024

Choose a reason for hiding this comment

feat(cli): rename `--vuln-type` flag to `--pkg-types` flag #7104

feat(cli): rename `--vuln-type` flag to `--pkg-types` flag #7104

DmitriyLewen commented Jul 9, 2024 •

edited

Loading

knqyf263 left a comment •

edited

Loading