added support for CoreOS

Author: amitverse

docs/docs/coverage/os/coreos.md

@@ -0,0 +1,15 @@
+# CoreOS
+Trivy supports the following scanners for OS packages.
+
+|    Scanner    | Supported |
+| :-----------: | :-------: |
+|     SBOM      |     ✓     |
+| Vulnerability |     -     |
+|    License    |     -     |
+
+Please see [here](index.md#supported-os) for supported versions.
+
+## SBOM
+Trivy detects packages that are listed in the [software inventory].
+
+[software inventory]: https://bottlerocket.dev/en/os/1.37.x/concepts/variants/#software-inventory

docs/docs/coverage/os/index.md

@@ -28,11 +28,12 @@ Trivy supports operating systems for
 | [SUSE Linux Enterprise](suse.md)      | 11, 12, 15                          | zypper/rpm       |
 | [SUSE Linux Enterprise Micro](suse.md)| 5, 6                                | zypper/rpm       |
 | [Photon OS](photon.md)                | 1.0, 2.0, 3.0, 4.0                  | tndf/yum/rpm     |
+| [CoreOS Container Linux](coreos.md)   | All versions (EOL)                  | rpm              |
 | [Echo](echo.md)                       | (n/a)                               | apt/dpkg         |
 | [Debian GNU/Linux](debian.md)         | 7, 8, 9, 10, 11, 12                 | apt/dpkg         |
 | [Ubuntu](ubuntu.md)                   | All versions supported by Canonical | apt/dpkg         |
 | [Bottlerocket](bottlerocket.md)       | 1.7.0 and upper                     | bottlerocket     |
-| [OSs with installed Conda](../others/conda.md)  | -                                   | conda            |
+| [OSs with installed Conda](../others/conda.md) | -                                   | conda            |
 
 ## Supported container images
 
@@ -45,6 +46,7 @@ Each page gives more details.
 
 [^1]: CentOS Stream is not supported 
 [^2]: https://github.com/GoogleContainerTools/distroless
+[^3]: CoreOS Container Linux reached end-of-life on May 26, 2020. Consider migrating to Fedora CoreOS.
 
 
 [sbom]: ../../supply-chain/sbom.md

mkdocs.yml

@@ -90,6 +90,7 @@ nav:
               - Ubuntu: docs/coverage/os/ubuntu.md
               - Wolfi: docs/coverage/os/wolfi.md
               - Google Distroless (Images): docs/coverage/os/google-distroless.md
+              - CoreOS Container Linux: docs/coverage/os/coreos.md
           - Language:
               - Overview: docs/coverage/language/index.md
               - C/C++: docs/coverage/language/c.md

pkg/detector/ospkg/coreos/coreos.go

@@ -0,0 +1,28 @@
+package coreos
+
+import (
+	"context"
+
+	osver "github.com/aquasecurity/trivy/pkg/detector/ospkg/version"
+	ftypes "github.com/aquasecurity/trivy/pkg/fanal/types"
+	"github.com/aquasecurity/trivy/pkg/log"
+	"github.com/aquasecurity/trivy/pkg/types"
+)
+
+// Scanner implements the CoreOS scanner
+type Scanner struct {
+}
+
+// NewScanner is the factory method for Scanner
+func NewScanner() *Scanner {
+	return &Scanner{}
+}
+
+func (s *Scanner) Detect(ctx context.Context, _ string, _ *ftypes.Repository, _ []ftypes.Package) ([]types.DetectedVulnerability, error) {
+	log.InfoContext(ctx, "Vulnerability detection of CoreOS packages is currently not supported.")
+	return nil, nil
+}
+
+func (s *Scanner) IsSupportedVersion(ctx context.Context, osFamily ftypes.OSType, osVer string) bool {
+	return osver.Supported(ctx, nil, osFamily, osver.Minor(osVer))
+}

pkg/detector/ospkg/detect.go

@@ -12,6 +12,7 @@ import (
 	"github.com/aquasecurity/trivy/pkg/detector/ospkg/azure"
 	"github.com/aquasecurity/trivy/pkg/detector/ospkg/bottlerocket"
 	"github.com/aquasecurity/trivy/pkg/detector/ospkg/chainguard"
+	"github.com/aquasecurity/trivy/pkg/detector/ospkg/coreos"
 	"github.com/aquasecurity/trivy/pkg/detector/ospkg/debian"
 	"github.com/aquasecurity/trivy/pkg/detector/ospkg/driver"
 	"github.com/aquasecurity/trivy/pkg/detector/ospkg/echo"
@@ -55,6 +56,7 @@ var (
 		ftypes.Chainguard:         chainguard.NewScanner(),
 		ftypes.Echo:               echo.NewScanner(),
 		ftypes.MinimOS:            minimos.NewScanner(),
+		ftypes.CoreOS:             coreos.NewScanner(),
 	}
 
 	// providers dynamically generate drivers based on package information

pkg/fanal/analyzer/const.go

@@ -26,6 +26,7 @@ const (
 	TypeSUSE       Type = "suse"
 	TypeUbuntu     Type = "ubuntu"
 	TypeUbuntuESM  Type = "ubuntu-esm"
+	TypeCoreOS     Type = "coreos"
 
 	// OS Package
 	TypeApk                   Type = "apk"

pkg/fanal/analyzer/os/release/release.go

@@ -78,6 +78,8 @@ func (a osReleaseAnalyzer) Analyze(_ context.Context, input analyzer.AnalysisInp
 			family = types.Echo
 		case "minimos":
 			family = types.MinimOS
+		case "coreos":
+			family = types.CoreOS
 		}
 
 		if family != "" && versionID != "" {

pkg/fanal/analyzer/os/release/release_test.go

@@ -179,6 +179,16 @@ func Test_osReleaseAnalyzer_Analyze(t *testing.T) {
 				},
 			},
 		},
+		{
+			name:      "CoreOS",
+			inputFile: "testdata/coreos",
+			want: &analyzer.AnalysisResult{
+				OS: types.OS{
+					Family: types.CoreOS,
+					Name:   "3.15.4",
+				},
+			},
+		},
 		{
 			name:      "Unknown OS",
 			inputFile: "testdata/unknown",

pkg/fanal/analyzer/os/release/testdata/coreos

@@ -0,0 +1,2 @@
+ID=coreos
+VERSION_ID=3.15.4

pkg/fanal/analyzer/pkg/rpm/rpm.go

@@ -40,6 +40,9 @@ var (
 		// SQLite3
 		"usr/lib/sysimage/rpm/rpmdb.sqlite",
 		"var/lib/rpm/rpmdb.sqlite",
+
+		// CoreOS
+		"usr/share/rpm/rpmdb.sqlite",
 	}
 
 	errUnexpectedNameFormat = xerrors.New("unexpected name format")