Skip to content

Commit 41d87a0

Browse files
lelialelia
committed
docs: add explicit Trivy versioning guidance for interim use
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
1 parent 786f8d6 commit 41d87a0

4 files changed

Lines changed: 76 additions & 0 deletions

File tree

‎README.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,22 @@ Socket Basics can also run locally or in other CI/CD environments:
7575
> additional review. Review the upstream install path and artifacts carefully
7676
> before adopting it in production CI.
7777

78+
> [!IMPORTANT]
79+
> Interim Trivy guidance outside Socket Basics: the current Socket Basics
80+
> recommendation is to pin independent Trivy usage to `v0.69.3` while we work to
81+
> restore bundled support safely. Aqua's final incident report lists the
82+
> known-safe Trivy binary range as `v0.69.2` to `v0.69.3`; the corresponding
83+
> Docker image tags are `0.69.2` to `0.69.3` without the `v` prefix. We
84+
> standardize on the latest known-safe version, `v0.69.3` / Docker tag `0.69.3`.
85+
> Do not use `v0.69.4`, and audit any cached Docker Hub images for `0.69.5` and
86+
> `0.69.6`.
87+
> If you use Aqua's own GitHub Actions directly outside Socket Basics, Aqua's
88+
> published safe versions are `aquasecurity/trivy-action@v0.35.0` and
89+
> `aquasecurity/setup-trivy@v0.2.6`, and those should still be pinned to full
90+
> commit SHAs.
91+
> Reference:
92+
> https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/
93+
7894
- **[Pre-Commit Hook](docs/pre-commit-hook.md)** — Catch issues before they're committed
7995
- **[Local Docker Installation](docs/local-install-docker.md)** — Run in Docker with no tool installation required
8096
- **[Local Installation](docs/local-installation.md)** — Install security tools natively on your machine

‎docs/github-action.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -498,6 +498,21 @@ jobs:
498498
> pinned pre-built distribution model. Review the upstream install path and
499499
> artifacts carefully before using it in production CI.
500500

501+
> [!IMPORTANT]
502+
> Customer guidance while Trivy is disabled in the Socket Basics GitHub Action:
503+
> if you must keep using Trivy independently in the same workflow, Socket's
504+
> interim recommendation is to pin the Trivy binary to `v0.69.3`.
505+
> Aqua's final incident report lists `v0.69.2` to `v0.69.3` as the
506+
> known-safe binary range; the corresponding Docker image tags are `0.69.2` to
507+
> `0.69.3` without the `v` prefix. We standardize on `v0.69.3` / Docker tag
508+
> `0.69.3` in our examples.
509+
> Do not use `v0.69.4`, and audit any Docker Hub use of `0.69.5` and `0.69.6`.
510+
> If you use Aqua's own actions directly outside Socket Basics, use
511+
> `aquasecurity/trivy-action@v0.35.0` and `aquasecurity/setup-trivy@v0.2.6`, and
512+
> pin them to full commit SHAs.
513+
> Reference:
514+
> https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/
515+
501516
```yaml
502517
name: Container Security
503518
on:
@@ -534,6 +549,11 @@ jobs:
534549
trivy config --exit-code 1 --severity HIGH,CRITICAL Dockerfile
535550
```
536551

552+
If you replace the manual install step with Aqua-maintained actions in your own
553+
workflow outside Socket Basics, Aqua's published safe versions are
554+
`aquasecurity/trivy-action@v0.35.0` and `aquasecurity/setup-trivy@v0.2.6`.
555+
Pin those to full SHAs rather than mutable tags.
556+
537557
### Dockerfile Auto-Discovery
538558

539559
For repositories with multiple Dockerfiles across different directories, you can automatically discover them instead of manually listing each path.

‎docs/local-install-docker.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,19 @@ docker inspect ghcr.io/socketdev/socket-basics:2.0.2 \
6565
> Review the upstream install path and artifacts carefully before adopting it in
6666
> production CI.
6767
68+
> [!IMPORTANT]
69+
> Socket Basics does not currently publish a pre-built Docker image with Trivy
70+
> enabled. If you need Trivy in the meantime, run it separately from Socket
71+
> Basics and pin the independent Trivy image or binary to `v0.69.3`.
72+
> Aqua's final incident report lists `v0.69.2` to `v0.69.3` as the
73+
> known-safe Trivy binary range; the corresponding Docker image tags are
74+
> `0.69.2` to `0.69.3` without the `v` prefix. Socket's interim recommendation is
75+
> the latest known-safe version, `v0.69.3` / Docker tag `0.69.3`.
76+
> Do not use `v0.69.4`, and audit any Docker Hub pulls or caches for `0.69.5`
77+
> and `0.69.6`.
78+
> Reference:
79+
> https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/
80+
6881
### Registries
6982

7083
| Registry | Image |
@@ -377,6 +390,11 @@ docker run --rm \
377390
> Review the upstream install path and artifacts carefully before adopting it in
378391
> production CI.
379392

393+
For customers who still need Trivy before it returns to the Socket Basics image,
394+
the interim recommendation is to run a separate `aquasec/trivy:0.69.3` step or a
395+
host-native `trivy` install pinned to `v0.69.3`, rather than rebuilding the
396+
Socket Basics image and re-enabling Trivy ad hoc.
397+
380398
### Save Results to File
381399

382400
Mount a volume to save scan results:

‎docs/local-installation.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,22 @@ export SOCKET_SECURITY_API_KEY="your-api-key"
202202
> container-based distribution where possible. Review the upstream install path
203203
> and artifacts carefully before using this in production CI.
204204
205+
> [!IMPORTANT]
206+
> Socket's interim recommendation for customers who still need Trivy is to pin
207+
> the binary or Docker image to `v0.69.3`.
208+
> Aqua's final incident report lists the known-safe Trivy binary range as
209+
> `v0.69.2` to `v0.69.3`; the corresponding Docker image tags are `0.69.2` to
210+
> `0.69.3` without the `v` prefix. We standardize on `v0.69.3` / Docker tag
211+
> `0.69.3` because it is the latest version Aqua still classifies as known-safe.
212+
> Do not use `v0.69.4`, and audit any cached Docker Hub images for `0.69.5` and
213+
> `0.69.6`.
214+
> If you use Aqua's own GitHub Actions independently of Socket Basics, Aqua's
215+
> published safe versions are `aquasecurity/trivy-action@v0.35.0` and
216+
> `aquasecurity/setup-trivy@v0.2.6`; pin those by full commit SHA rather than by
217+
> tag.
218+
> Reference:
219+
> https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know/
220+
205221
**Installation:**
206222

207223
```bash
@@ -232,6 +248,12 @@ docker pull aquasec/trivy:0.69.3
232248
trivy --version
233249
```
234250

251+
For this interim path, `trivy --version` should report `Version: 0.69.3`, and a
252+
container-based install should use image tag `aquasec/trivy:0.69.3`. If your
253+
package manager or container reference resolves to some other version, treat
254+
that as a separate review decision rather than assuming it matches the current
255+
Socket Basics guidance.
256+
235257
**Documentation:** https://github.com/aquasecurity/trivy
236258

237259
### OpenGrep (SAST)

0 commit comments

Comments
 (0)