refactor: unify package addition and vulnerability scanning

pkg/scanner/langpkg/scan.go

@@ -24,7 +24,6 @@ var (
 )
 
 type Scanner interface {
- Packages(target types.ScanTarget, options types.ScanOptions) types.Results
  Scan(ctx context.Context, target types.ScanTarget, options types.ScanOptions) (types.Results, error)
 }
 
@@ -34,24 +33,7 @@ func NewScanner() Scanner {
  return &scanner{}
 }
 
-func (s *scanner) Packages(target types.ScanTarget, _ types.ScanOptions) types.Results {
- var results types.Results
- for _, app := range target.Applications {
- if len(app.Packages) == 0 {
- continue
- }
-
- results = append(results, types.Result{
- Target: targetName(app.Type, app.FilePath),
- Class: types.ClassLangPkg,
- Type: app.Type,
- Packages: app.Packages,
- })
- }
- return results
-}
-
-func (s *scanner) Scan(ctx context.Context, target types.ScanTarget, _ types.ScanOptions) (types.Results, error) {
+func (s *scanner) Scan(ctx context.Context, target types.ScanTarget, opts types.ScanOptions) (types.Results, error) {
  apps := target.Applications
  log.Info("Number of language-specific files", log.Int("num", len(apps)))
  if len(apps) == 0 {
@@ -66,34 +48,53 @@ func (s *scanner) Scan(ctx context.Context, target types.ScanTarget, _ types.Sca
  }
 
  ctx = log.WithContextPrefix(ctx, string(app.Type))
+ result := types.Result{
+ Target: targetName(app.Type, app.FilePath),
+ Class: types.ClassLangPkg,
+ Type: app.Type,
+ }
 
- // Prevent the same log messages from being displayed many times for the same type.
- if _, ok := printedTypes[app.Type]; !ok {
- log.InfoContext(ctx, "Detecting vulnerabilities...")
- printedTypes[app.Type] = struct{}{}
+ if opts.ListAllPackages {
+ sort.Sort(app.Packages)
+ result.Packages = app.Packages
  }
 
- log.DebugContext(ctx, "Scanning packages from the file", log.String("file_path", app.FilePath))
- vulns, err := library.Detect(ctx, app.Type, app.Packages)
- if err != nil {
- return nil, xerrors.Errorf("failed vulnerability detection of packages: %w", err)
- } else if len(vulns) == 0 {
- continue
+ if opts.Scanners.Enabled(types.VulnerabilityScanner) {
+  var err error
+  result.Vulnerabilities, err = s.scanVulnerabilities(ctx, app, printedTypes)
+ if err != nil {
+  return nil, err
+ }
  }
 
- results = append(results, types.Result{
- Target: targetName(app.Type, app.FilePath),
- Vulnerabilities: vulns,
- Class: types.ClassLangPkg,
- Type: app.Type,
- })
+ if len(result.Packages) == 0 && len(result.Vulnerabilities) == 0 {
+ continue
+ }
+ results = append(results, result)
  }
  sort.Slice(results, func(i, j int) bool {
  return results[i].Target < results[j].Target
  })
  return results, nil
 }
 
+func (s *scanner) scanVulnerabilities(ctx context.Context, app ftypes.Application, printedTypes map[ftypes.LangType]struct{}) (
+ []types.DetectedVulnerability, error) {
+
+ // Prevent the same log messages from being displayed many times for the same type.
+ if _, ok := printedTypes[app.Type]; !ok {
+ log.InfoContext(ctx, "Detecting vulnerabilities...")
+ printedTypes[app.Type] = struct{}{}
+ }
+
+ log.DebugContext(ctx, "Scanning packages for vulnerabilities", log.String("file_path", app.FilePath))
+ vulns, err := library.Detect(ctx, app.Type, app.Packages)
+ if err != nil {
+ return nil, xerrors.Errorf("failed vulnerability detection of libraries: %w", err)
+ }
+ return vulns, err
+}
+
 func targetName(appType ftypes.LangType, filePath string) string {
  if t, ok := PkgTargets[appType]; ok && filePath == "" {
  // When the file path is empty, we will overwrite it with the pre-defined value.

pkg/scanner/local/scan.go

@@ -14,6 +14,7 @@ import (
  "golang.org/x/xerrors"
 
  dbTypes "github.com/aquasecurity/trivy-db/pkg/types"
+ ospkgDetector "github.com/aquasecurity/trivy/pkg/detector/ospkg"
  "github.com/aquasecurity/trivy/pkg/fanal/analyzer"
  "github.com/aquasecurity/trivy/pkg/fanal/applier"
  ftypes "github.com/aquasecurity/trivy/pkg/fanal/types"
@@ -105,39 +106,19 @@ func (s Scanner) Scan(ctx context.Context, targetName, artifactKey string, blobK
 }
 
 func (s Scanner) ScanTarget(ctx context.Context, target types.ScanTarget, options types.ScanOptions) (types.Results, ftypes.OS, error) {
- var eosl bool
- var results, pkgResults types.Results
- var err error
+ var results types.Results
 
  // By default, we need to remove dev dependencies from the result
  // IncludeDevDeps option allows you not to remove them
  excludeDevDeps(target.Applications, options.IncludeDevDeps)
 
- // Fill OS packages and language-specific packages
- if options.ListAllPackages {
- if res := s.osPkgScanner.Packages(target, options); len(res.Packages) != 0 {
- pkgResults = append(pkgResults, res)
- }
- pkgResults = append(pkgResults, s.langPkgScanner.Packages(target, options)...)
- }
-
- // Scan packages for vulnerabilities
- if options.Scanners.Enabled(types.VulnerabilityScanner) {
- var vulnResults types.Results
- vulnResults, eosl, err = s.scanVulnerabilities(ctx, target, options)
- if err != nil {
- return nil, ftypes.OS{}, xerrors.Errorf("failed to detect vulnerabilities: %w", err)
- }
- target.OS.Eosl = eosl
-
- // Merge package results into vulnerability results
- mergedResults := s.fillPkgsInVulns(pkgResults, vulnResults)
-
- results = append(results, mergedResults...)
- } else {
- // If vulnerability scanning is not enabled, it just adds package results.
- results = append(results, pkgResults...)
+ // Add packages if needed and scan packages for vulnerabilities
+ vulnResults, eosl, err := s.scanVulnerabilities(ctx, target, options)
+ if err != nil {
+ return nil, ftypes.OS{}, xerrors.Errorf("failed to detect vulnerabilities: %w", err)
  }
+ target.OS.Eosl = eosl
+ results = append(results, vulnResults...)
 
  // Store misconfigurations
  results = append(results, s.misconfsToResults(target.Misconfigurations, options)...)
@@ -172,17 +153,24 @@ func (s Scanner) ScanTarget(ctx context.Context, target types.ScanTarget, option
 
 func (s Scanner) scanVulnerabilities(ctx context.Context, target types.ScanTarget, options types.ScanOptions) (
  types.Results, bool, error) {
+ if !options.ListAllPackages && !options.Scanners.Enabled(types.VulnerabilityScanner) {
+ return nil, false, nil
+ }
+
  var eosl bool
  var results types.Results
 
  if slices.Contains(options.VulnType, types.VulnTypeOS) {
  vuln, detectedEOSL, err := s.osPkgScanner.Scan(ctx, target, options)
- if err != nil {
+ switch {
+ case errors.Is(err, ospkgDetector.ErrUnsupportedOS):
+ // do nothing
+ case err != nil:
  return nil, false, xerrors.Errorf("unable to scan OS packages: %w", err)
- } else if vuln.Target != "" {
+ case vuln.Target != "":
  results = append(results, vuln)
+ eosl = detectedEOSL
  }
- eosl = detectedEOSL
  }
 
  if slices.Contains(options.VulnType, types.VulnTypeLibrary) {
@@ -196,24 +184,6 @@ func (s Scanner) scanVulnerabilities(ctx context.Context, target types.ScanTarge
  return results, eosl, nil
 }
 
-func (s Scanner) fillPkgsInVulns(pkgResults, vulnResults types.Results) types.Results {
- var results types.Results
- if len(pkgResults) == 0 { // '--list-all-pkgs' == false or packages not found
- return vulnResults
- }
- for _, result := range pkgResults {
- if r, found := lo.Find(vulnResults, func(r types.Result) bool {
- return r.Class == result.Class && r.Target == result.Target && r.Type == result.Type
- }); found {
- r.Packages = result.Packages
- results = append(results, r)
- } else { // when package result has no vulnerabilities we still need to add it to result(for 'list-all-pkgs')
- results = append(results, result)
- }
- }
- return results
-}
-
 func (s Scanner) misconfsToResults(misconfs []ftypes.Misconfiguration, options types.ScanOptions) types.Results {
  if !ShouldScanMisconfigOrRbac(options.Scanners) &&
  !options.ImageConfigScanners.Enabled(types.MisconfigScanner) {

pkg/scanner/ospkg/scan.go

@@ -2,7 +2,6 @@ package ospkg
 
 import (
  "context"
- "errors"
  "fmt"
  "sort"
  "time"
@@ -15,7 +14,6 @@ import (
 )
 
 type Scanner interface {
- Packages(target types.ScanTarget, options types.ScanOptions) types.Result
  Scan(ctx context.Context, target types.ScanTarget, options types.ScanOptions) (types.Result, bool, error)
 }
 
@@ -25,21 +23,7 @@ func NewScanner() Scanner {
  return &scanner{}
 }
 
-func (s *scanner) Packages(target types.ScanTarget, _ types.ScanOptions) types.Result {
- if len(target.Packages) == 0 || !target.OS.Detected() {
- return types.Result{}
- }
-
- sort.Sort(target.Packages)
- return types.Result{
- Target: fmt.Sprintf("%s (%s %s)", target.Name, target.OS.Family, target.OS.Name),
- Class: types.ClassOSPkg,
- Type: target.OS.Family,
- Packages: target.Packages,
- }
-}
-
-func (s *scanner) Scan(ctx context.Context, target types.ScanTarget, _ types.ScanOptions) (types.Result, bool, error) {
+func (s *scanner) Scan(ctx context.Context, target types.ScanTarget, opts types.ScanOptions) (types.Result, bool, error) {
  if !target.OS.Detected() {
  log.Debug("Detected OS: unknown")
  return types.Result{}, false, nil
@@ -52,19 +36,29 @@ func (s *scanner) Scan(ctx context.Context, target types.ScanTarget, _ types.Sca
  target.OS.Name += "-ESM"
  }
 
+ result := types.Result{
+ Target: fmt.Sprintf("%s (%s %s)", target.Name, target.OS.Family, target.OS.Name),
+ Class: types.ClassOSPkg,
+ Type: target.OS.Family,
+ }
+
+ if opts.ListAllPackages {
+ sort.Sort(target.Packages)
+ result.Packages = target.Packages
+ }
+
+ if !opts.Scanners.Enabled(types.VulnerabilityScanner) {
+ // Return packages only
+ return result, false, nil
+ }
+
  vulns, eosl, err := ospkgDetector.Detect(ctx, "", target.OS.Family, target.OS.Name, target.Repository, time.Time{},
  target.Packages)
- if errors.Is(err, ospkgDetector.ErrUnsupportedOS) {
- return types.Result{}, false, nil
- } else if err != nil {
- return types.Result{}, false, xerrors.Errorf("failed vulnerability detection of OS packages: %w", err)
+ if err != nil {
+ // Return a result for those who want to override the error handling.
+ return result, false, xerrors.Errorf("failed vulnerability detection of OS packages: %w", err)
  }
+ result.Vulnerabilities = vulns
 
- artifactDetail := fmt.Sprintf("%s (%s %s)", target.Name, target.OS.Family, target.OS.Name)
- return types.Result{
- Target: artifactDetail,
- Vulnerabilities: vulns,
- Class: types.ClassOSPkg,
- Type: target.OS.Family,
- }, eosl, nil
+ return result, eosl, nil
 }