From e97a53fec45d361558393c75d1c1bfc9ef3e3352 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20Lajeunesse-Robert?= Date: Mon, 16 Mar 2026 17:19:04 -0400 Subject: [PATCH 1/3] Updated the supported lockfile as per the latest version of Trivy 0.69 and OSV Scanner 2.3.3 --- .../boostsecurityio/osv-scanner/filelist.txt | 3 +++ .../boostsecurityio/osv-scanner/module.yaml | 3 +++ .../boostsecurityio/trivy-fs/filelist.txt | 1 + scanners/boostsecurityio/trivy-fs/module.yaml | 23 ++++++++++--------- 4 files changed, 19 insertions(+), 11 deletions(-) diff --git a/scanners/boostsecurityio/osv-scanner/filelist.txt b/scanners/boostsecurityio/osv-scanner/filelist.txt index ec129be1..6327ba6e 100644 --- a/scanners/boostsecurityio/osv-scanner/filelist.txt +++ b/scanners/boostsecurityio/osv-scanner/filelist.txt @@ -11,6 +11,7 @@ pom.xml package-lock.json pnpm-lock.yaml yarn.lock +bun.lock deps.json packages.config packages.lock.json @@ -19,8 +20,10 @@ Pipfile.lock poetry.lock requirements.txt pdm.lock +pylock.toml uv.lock renv.lock Gemfile.lock +gems.locked Cargo.lock osv-scanner.json diff --git a/scanners/boostsecurityio/osv-scanner/module.yaml b/scanners/boostsecurityio/osv-scanner/module.yaml index cf0f9051..cb4226bd 100644 --- a/scanners/boostsecurityio/osv-scanner/module.yaml +++ b/scanners/boostsecurityio/osv-scanner/module.yaml @@ -31,6 +31,7 @@ config: - package-lock.json - pnpm-lock.yaml - yarn.lock + - bun.lock # .Net - deps.json - packages.config @@ -42,11 +43,13 @@ config: - poetry.lock - requirements.txt - pdm.lock + - pylock.toml - uv.lock # R - renv.lock # Ruby - Gemfile.lock + - gems.locked # Rust - Cargo.lock # Custom lockfile http://google.github.io/osv-scanner/supported-languages-and-lockfiles/#custom-lockfiles diff --git a/scanners/boostsecurityio/trivy-fs/filelist.txt b/scanners/boostsecurityio/trivy-fs/filelist.txt index 4dbe1cbf..920b45ff 100644 --- a/scanners/boostsecurityio/trivy-fs/filelist.txt +++ b/scanners/boostsecurityio/trivy-fs/filelist.txt @@ -12,6 +12,7 @@ pom.xml package-lock.json yarn.lock pnpm-lock.yaml +bun.lock composer.lock installed.json Pipfile.lock diff --git a/scanners/boostsecurityio/trivy-fs/module.yaml b/scanners/boostsecurityio/trivy-fs/module.yaml index bba6df5b..aebabf47 100644 --- a/scanners/boostsecurityio/trivy-fs/module.yaml +++ b/scanners/boostsecurityio/trivy-fs/module.yaml @@ -11,36 +11,37 @@ config: support_diff_scan: true support_incremental: true include_files: - # C/C++ https://trivy.dev/v0.61/docs/coverage/language/c/ + # C/C++ https://trivy.dev/v0.69/docs/coverage/language/c/ - conan.lock - # Dart https://trivy.dev/v0.61/docs/coverage/language/dart/ + # Dart https://trivy.dev/v0.69/docs/coverage/language/dart/ - pubspec.lock - # Dotnet https://trivy.dev/v0.61/docs/coverage/language/dotnet/ + # Dotnet https://trivy.dev/v0.69/docs/coverage/language/dotnet/ - "*.deps.json" - packages.config - "*Packages.props" - packages.lock.json - # Elixir https://trivy.dev/v0.61/docs/coverage/language/elixir/ + # Elixir https://trivy.dev/v0.69/docs/coverage/language/elixir/ - mix.lock - # Go https://trivy.dev/v0.61/docs/coverage/language/golang/ + # Go https://trivy.dev/v0.69/docs/coverage/language/golang/ - go.mod - # Java https://trivy.dev/v0.61/docs/coverage/language/java/ + # Java https://trivy.dev/v0.69/docs/coverage/language/java/ - "*gradle.lockfile" - pom.xml - "*.sbt.lock" - # NodeJs https://trivy.dev/v0.61/docs/coverage/language/nodejs/ + # NodeJs https://trivy.dev/v0.69/docs/coverage/language/nodejs/ - package-lock.json - yarn.lock - pnpm-lock.yaml - # Php https://trivy.dev/v0.61/docs/coverage/language/php/ + - bun.lock + # Php https://trivy.dev/v0.69/docs/coverage/language/php/ - composer.lock - installed.json - # Python https://trivy.dev/v0.61/docs/coverage/language/python/ + # Python https://trivy.dev/v0.69/docs/coverage/language/python/ - Pipfile.lock - requirements.txt - poetry.lock - uv.lock - # Ruby https://trivy.dev/v0.61/docs/coverage/language/ruby/ + # Ruby https://trivy.dev/v0.69/docs/coverage/language/ruby/ - Gemfile.lock - .gemspec # RUST https://trivy.dev/v0.61/docs/coverage/language/rust/ @@ -48,7 +49,7 @@ config: # Swift https://trivy.dev/v0.61/docs/coverage/language/swift/ - Package.resolved - Podfile.lock - # Julia https://trivy.dev/v0.61/docs/coverage/language/julia/ + # Julia https://trivy.dev/v0.69/docs/coverage/language/julia/ - Manifest.toml setup: From 2c8ee11f18dc4cc0e42df1345d273263093afb9c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20Lajeunesse-Robert?= Date: Mon, 6 Jul 2026 14:58:38 -0400 Subject: [PATCH 2/3] Updated generic-api-key rule to remove false positives --- scanners/boostsecurityio/gitleaks/boost.toml | 21 ++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/scanners/boostsecurityio/gitleaks/boost.toml b/scanners/boostsecurityio/gitleaks/boost.toml index 9bf7212e..1274c128 100644 --- a/scanners/boostsecurityio/gitleaks/boost.toml +++ b/scanners/boostsecurityio/gitleaks/boost.toml @@ -6,7 +6,20 @@ useDefault = true [[rules]] id = "generic-api-key" - [[rules.allowlists]] - regexTarget = "line" - regexes = [ '''(?i)publicKeyToken="[^"]+"''' ] - paths = [ '''(?i)web\.config''' ] \ No newline at end of file + [[rules.allowlists]] + description = "Don't report on URI" + regexTarget = "match" + regexes = [ + '''(?i)(?:[\w]+\.)+[\w]+:[0-9]{1,5}(?:/[\w]+)+''', + ] + + [[rules.allowlists]] + regexTarget = "line" + regexes = [ '''(?i)publicKeyToken="[^"]+"''' ] + paths = [ '''(?i)web\.config''' ] + + [[rules.allowlists]] + description = "Don't report on translation" + regexTarget = "line" + regexes = [ '''(?i)xmi:type="utility:TranslatableString"''' ] + paths = [ '''(?i)\.msgflow$''' ] \ No newline at end of file From b773c09cd6db04101156f781558906fa1b177116 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=C3=A7ois=20Lajeunesse-Robert?= Date: Mon, 6 Jul 2026 15:07:12 -0400 Subject: [PATCH 3/3] SYnc with main --- .../boostsecurityio/osv-scanner/filelist.txt | 4 +- .../boostsecurityio/osv-scanner/module.yaml | 12 +++-- .../boostsecurityio/trivy-fs/filelist.txt | 1 - scanners/boostsecurityio/trivy-fs/module.yaml | 53 ++++++++----------- 4 files changed, 34 insertions(+), 36 deletions(-) diff --git a/scanners/boostsecurityio/osv-scanner/filelist.txt b/scanners/boostsecurityio/osv-scanner/filelist.txt index 6327ba6e..bee90822 100644 --- a/scanners/boostsecurityio/osv-scanner/filelist.txt +++ b/scanners/boostsecurityio/osv-scanner/filelist.txt @@ -4,16 +4,18 @@ mix.lock go.mod cabal.project.freeze stack.yaml.lock +*.jar buildscript-gradle.lockfile gradle.lockfile verification-metadata.xml pom.xml +bun.lock package-lock.json pnpm-lock.yaml yarn.lock -bun.lock deps.json packages.config +*.csproj packages.lock.json composer.lock Pipfile.lock diff --git a/scanners/boostsecurityio/osv-scanner/module.yaml b/scanners/boostsecurityio/osv-scanner/module.yaml index cb4226bd..1c80a558 100644 --- a/scanners/boostsecurityio/osv-scanner/module.yaml +++ b/scanners/boostsecurityio/osv-scanner/module.yaml @@ -23,16 +23,18 @@ config: - cabal.project.freeze - stack.yaml.lock # Java + - "*.jar" - buildscript-gradle.lockfile - gradle.lockfile - verification-metadata.xml - pom.xml # Javascript + - bun.lock - package-lock.json - pnpm-lock.yaml - yarn.lock - - bun.lock # .Net + - "*.csproj" - deps.json - packages.config - packages.lock.json @@ -66,13 +68,15 @@ steps: - scan: command: docker: - image: public.ecr.aws/boostsecurityio/boost-scanner-osv:2778df1@sha256:73af9ca6458c5dd11dfc61dfa919a9b597f08946622f18628e26696c6e1565ce + image: public.ecr.aws/boostsecurityio/boost-scanner-osv:63fef86@sha256:ad3d944f0dfd99a2ed47d5235a83968c632ca8328eef10752ae1e114ec44db53 command: | - -c 'osv-scanner scan source --recursive --call-analysis=all --format json . 2> /dev/null; exit_code=$?; if [ $exit_code -gt 126 ]; then exit $exit_code; fi' + -c 'GOGC=50 osv-scanner scan source --recursive --call-analysis=all --experimental-plugins=lockfile,sbom,directory,java/archive,dotnet/csproj --format json . 2> /dev/null; exit_code=$?; if [ $exit_code -gt 126 ]; then exit $exit_code; fi' workdir: /project format: sarif post-processor: run: | + CONVERTER_IMAGE=ghcr.io/boostsecurityio/scanner-publishing/boost-converter-sca:0006182@sha256:355688481b8a830c1b8b72b3558f5bb728570310651dbd3568aa847499199592 + if [ -z "$BOOST_SCAN_PATH" ]; then # set since osv-scanner generates absolute paths instead of relative export BOOST_SCAN_CMD_EXEC_PATH="/project" @@ -81,4 +85,4 @@ steps: export BOOST_SCAN_CMD_EXEC_PATH="/project/${BOOST_SCAN_PATH}" fi export PYTHONIOENCODING="utf-8" - docker run -i -e BOOST_SCAN_CMD_EXEC_PATH="$BOOST_SCAN_CMD_EXEC_PATH" -e PYTHONIOENCODING="utf-8" public.ecr.aws/boostsecurityio/boost-converter-sca:fe417cd@sha256:95e68d6b39ca8b4e3e7f9269daa6f3ccfae3e40f6e93e3d068139ab975d0355d process --scanner osv + docker run -i -e BOOST_SCAN_CMD_EXEC_PATH="$BOOST_SCAN_CMD_EXEC_PATH" -e PYTHONIOENCODING="utf-8" "${CONVERTER_IMAGE}" process --scanner osv diff --git a/scanners/boostsecurityio/trivy-fs/filelist.txt b/scanners/boostsecurityio/trivy-fs/filelist.txt index 920b45ff..4dbe1cbf 100644 --- a/scanners/boostsecurityio/trivy-fs/filelist.txt +++ b/scanners/boostsecurityio/trivy-fs/filelist.txt @@ -12,7 +12,6 @@ pom.xml package-lock.json yarn.lock pnpm-lock.yaml -bun.lock composer.lock installed.json Pipfile.lock diff --git a/scanners/boostsecurityio/trivy-fs/module.yaml b/scanners/boostsecurityio/trivy-fs/module.yaml index aebabf47..6633bfe6 100644 --- a/scanners/boostsecurityio/trivy-fs/module.yaml +++ b/scanners/boostsecurityio/trivy-fs/module.yaml @@ -11,37 +11,36 @@ config: support_diff_scan: true support_incremental: true include_files: - # C/C++ https://trivy.dev/v0.69/docs/coverage/language/c/ + # C/C++ https://trivy.dev/v0.61/docs/coverage/language/c/ - conan.lock - # Dart https://trivy.dev/v0.69/docs/coverage/language/dart/ + # Dart https://trivy.dev/v0.61/docs/coverage/language/dart/ - pubspec.lock - # Dotnet https://trivy.dev/v0.69/docs/coverage/language/dotnet/ + # Dotnet https://trivy.dev/v0.61/docs/coverage/language/dotnet/ - "*.deps.json" - packages.config - "*Packages.props" - packages.lock.json - # Elixir https://trivy.dev/v0.69/docs/coverage/language/elixir/ + # Elixir https://trivy.dev/v0.61/docs/coverage/language/elixir/ - mix.lock - # Go https://trivy.dev/v0.69/docs/coverage/language/golang/ + # Go https://trivy.dev/v0.61/docs/coverage/language/golang/ - go.mod - # Java https://trivy.dev/v0.69/docs/coverage/language/java/ + # Java https://trivy.dev/v0.61/docs/coverage/language/java/ - "*gradle.lockfile" - pom.xml - "*.sbt.lock" - # NodeJs https://trivy.dev/v0.69/docs/coverage/language/nodejs/ + # NodeJs https://trivy.dev/v0.61/docs/coverage/language/nodejs/ - package-lock.json - yarn.lock - pnpm-lock.yaml - - bun.lock - # Php https://trivy.dev/v0.69/docs/coverage/language/php/ + # Php https://trivy.dev/v0.61/docs/coverage/language/php/ - composer.lock - installed.json - # Python https://trivy.dev/v0.69/docs/coverage/language/python/ + # Python https://trivy.dev/v0.61/docs/coverage/language/python/ - Pipfile.lock - requirements.txt - poetry.lock - uv.lock - # Ruby https://trivy.dev/v0.69/docs/coverage/language/ruby/ + # Ruby https://trivy.dev/v0.61/docs/coverage/language/ruby/ - Gemfile.lock - .gemspec # RUST https://trivy.dev/v0.61/docs/coverage/language/rust/ @@ -49,7 +48,7 @@ config: # Swift https://trivy.dev/v0.61/docs/coverage/language/swift/ - Package.resolved - Podfile.lock - # Julia https://trivy.dev/v0.69/docs/coverage/language/julia/ + # Julia https://trivy.dev/v0.61/docs/coverage/language/julia/ - Manifest.toml setup: @@ -60,30 +59,25 @@ setup: - name: download trivy environment: VERSION: 0.69.2 - LINUX_X86_64_SHA: affa59a1e37d86e4b8ab2cd02f0ab2e63d22f1bf9cf6a7aa326c884e25e26ce3 - LINUX_ARM64_SHA: c73b97699c317b0d25532b3f188564b4e29d13d5472ce6f8eb078082546a6481 - MACOS_X86_64_SHA: 41f6eac3ebe3a00448a16f08038b55ce769fe2d5128cb0d64bdf282cdad4831a - MACOS_ARM64_SHA: 320c0e6af90b5733b9326da0834240e944c6f44091e50019abdf584237ff4d0c + LINUX_X86_64_SHA: 65b5755bbc851699be0286b453b51c3b1f139a8c1ce731f444210eeaf9a1aa61 + LINUX_ARM64_SHA: 524e496954c761ce5cd9c92baf2f7c2180958015bc25edad31570e102592a37c + MACOS_ARM64_SHA: 28243bee903a5e00fe9074baeb9e57c51ae05514261a53da66ef7f2cc0b352f9 run: | - BINARY_URL="https://github.com/aquasecurity/trivy/releases/download/v${VERSION}" + BINARY_URL="https://assets.build.boostsecurity.io/scanners/trivy/trivy-${VERSION}" ARCH=$(uname -m) case "$(uname -sm)" in "Linux x86_64") - BINARY_URL="${BINARY_URL}/trivy_${VERSION}_Linux-64bit.tar.gz" - SHA="${LINUX_X86_64_SHA} trivy.tgz" + BINARY_URL="${BINARY_URL}/linux/amd64/trivy.gz" + SHA="${LINUX_X86_64_SHA} trivy.gz" ;; "Linux aarch64") - BINARY_URL="${BINARY_URL}/trivy_${VERSION}_Linux-ARM64.tar.gz" - SHA="${LINUX_ARM64_SHA} trivy.tgz" - ;; - "Darwin x86_64") - BINARY_URL="${BINARY_URL}/trivy_${VERSION}_macOS-64bit.tar.gz" - SHA="${MACOS_X86_64_SHA} trivy.tgz" + BINARY_URL="${BINARY_URL}/linux/arm64/trivy.gz" + SHA="${LINUX_ARM64_SHA} trivy.gz" ;; "Darwin arm64") - BINARY_URL="${BINARY_URL}/trivy_${VERSION}_macOS-ARM64.tar.gz" - SHA="${MACOS_ARM64_SHA} trivy.tgz" + BINARY_URL="${BINARY_URL}/darwin/arm64/trivy.gz" + SHA="${MACOS_ARM64_SHA} trivy.gz" ;; *) echo "Unsupported machine: ${OPTARG}" @@ -91,11 +85,10 @@ setup: ;; esac - curl -o trivy.tgz -fsSL "${BINARY_URL}" + curl -o trivy.gz -fsSL "${BINARY_URL}" echo "${SHA}" | sha256sum --check - tar --no-same-owner -zxf trivy.tgz trivy - rm trivy.tgz + gunzip trivy.gz chmod +x trivy steps: