{"id":15798045,"url":"https://github.com/grokify/gotrivy","last_synced_at":"2025-09-23T23:12:11.220Z","repository":{"id":205398170,"uuid":"714135107","full_name":"grokify/gotrivy","owner":"grokify","description":"GoTrivy is a golang helper for Trivy. It's initial purpose is to create XSLX files from Trivy JSON reports.","archived":false,"fork":false,"pushed_at":"2024-03-23T16:13:39.000Z","size":484,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2024-03-24T16:53:44.991Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/grokify.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2023-11-04T02:30:26.000Z","updated_at":"2024-04-15T05:41:31.561Z","dependencies_parsed_at":null,"dependency_job_id":"2371312e-8e1c-4829-94bf-1682ddb3b225","html_url":"https://github.com/grokify/gotrivy","commit_stats":null,"previous_names":["grokify/gotrivy"],"tags_count":5,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/grokify%2Fgotrivy","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/grokify%2Fgotrivy/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/grokify%2Fgotrivy/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/grokify%2Fgotrivy/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/grokify","download_url":"https://codeload.github.com/grokify/gotrivy/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246531986,"owners_count":20792735,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-05T00:23:11.134Z","updated_at":"2025-09-23T23:12:11.204Z","avatar_url":"https://github.com/grokify.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n\n# GoTrivy\n\n![](logo_gotrivy.png \"\")\n\n[![Build Status][build-status-svg]][build-status-url]\n[![Lint Status][lint-status-svg]][lint-status-url]\n[![Go Report Card][goreport-svg]][goreport-url]\n[![Docs][docs-godoc-svg]][docs-godoc-url]\n[![License][license-svg]][license-url]\n\n\u003c/div\u003e\n\n`gotrivy` is a Golang helper for [`github.com/aquasecurity/trivy`](https://github.com/aquasecurity/trivy) ([reference](https://pkg.go.dev/github.com/aquasecurity/trivy)).\n\nThe primary purpose of this library is currently to create XSLX reports from a JSON report file. [Trivy provides reports in Table and JSON formats, along with a custom Template capability](https://aquasecurity.github.io/trivy/v0.17.2/examples/report/). This libary provides an additional XLSX option via [`github.com/grokify/gocharts`](https://github.com/grokify/gocharts). This can be run from the CLI as [`cmd/gotrivy/main.go`](cmd/gotrivy/main.go) or it can be done programmatically by inspecting the code of that file.\n\n[`gotrivy.Report`](https://pkg.go.dev/github.com/grokify/gotrivy#Report) is an extension of [`github.com/aquasecurity/trivy/pkg/types.Report`](https://pkg.go.dev/github.com/aquasecurity/trivy/pkg/types#Report).\n\n## Installation\n\n`go install github.com/grokify/gotrivy/cmd/gotrivy`\n\n## Usage\n\n`gotrivy -i \u003cpath-to-report.json\u003e [-o path-to-report.xlsx]`\n\nIf an output file isn't provided, a default output filename and path is used setting the filename to the original filename with a `.xlsx` suffix in the current directory.\n\n## References\n\n### Scan Image\n\nThe following is an example of scanning a local image:\n\n```\n% docker image ls\nREPOSITORY                       TAG       IMAGE ID       CREATED        SIZE\ngrokify/ringcentral-permahooks   v0.2.3    af80576e5e7d   6 months ago   640MB\n% trivy image -f json grokify/ringcentral-permahooks \u003e trivy-report.json\n% gotrivy -i trivy-report.json -o trivy-report.xlsx\n```\n\n### Scan JAR\n\n```\n% trivy -d fs path/to/jar\n% trivy -d fs path/to/pom.xml\n```\n\nExtract `pom.xml` from JAR file:\n\n```\n% unzip myfile.jar pom.xml\n```\n\n```\n% trivy -d fs pom.xml \n2024-10-30T01:26:21.429-0700\tDEBUG\tSeverities: [\"UNKNOWN\" \"LOW\" \"MEDIUM\" \"HIGH\" \"CRITICAL\"]\n2024-10-30T01:26:21.429-0700\tDEBUG\tIgnore statuses\t{\"statuses\": null}\n2024-10-30T01:26:21.440-0700\tDEBUG\tcache dir:  /path/to/Caches/trivy\n2024-10-30T01:26:21.440-0700\tDEBUG\tDB update was skipped because the local DB is the latest\n2024-10-30T01:26:21.440-0700\tDEBUG\tDB Schema: 2, UpdatedAt: 2024-10-30 06:47:03.247108911 +0000 UTC, NextUpdate: 2024-10-31 06:47:03.24710874 +0000 UTC, DownloadedAt: 2024-10-30 07:37:27.722974 +0000 UTC\n2024-10-30T01:26:21.440-0700\tINFO\tVulnerability scanning is enabled\n2024-10-30T01:26:21.440-0700\tDEBUG\tVulnerability type:  [os library]\n2024-10-30T01:26:21.440-0700\tINFO\tSecret scanning is enabled\n2024-10-30T01:26:21.440-0700\tINFO\tIf your scanning is slow, please try '--scanners vuln' to disable secret scanning\n2024-10-30T01:26:21.440-0700\tINFO\tPlease see also https://aquasecurity.github.io/trivy/v0.46/docs/scanner/secret/#recommendation for faster secret detection\n2024-10-30T01:26:21.441-0700\tDEBUG\tNo secret config detected: trivy-secret.yaml\n2024-10-30T01:26:21.441-0700\tDEBUG\tThe nuget packages directory couldn't be found. License search disabled\n2024-10-30T01:26:21.441-0700\tDEBUG\tWalk the file tree rooted at 'pom.xml' in parallel\n2024-10-30T01:26:21.441-0700\tDEBUG\tResolving org.json:json:20220924...\n2024-10-30T01:26:21.625-0700\tDEBUG\tStart parent: org.sonatype.oss:oss-parent:9\n2024-10-30T01:26:21.626-0700\tDEBUG\tExit parent: org.sonatype.oss:oss-parent:9\n2024-10-30T01:26:21.638-0700\tDEBUG\tOS is not detected.\n2024-10-30T01:26:21.638-0700\tDEBUG\tDetected OS: unknown\n2024-10-30T01:26:21.638-0700\tINFO\tNumber of language-specific files: 1\n2024-10-30T01:26:21.638-0700\tINFO\tDetecting pom vulnerabilities...\n2024-10-30T01:26:21.638-0700\tDEBUG\tDetecting library vulnerabilities, type: pom, path: pom.xml\n\npom.xml (pom)\n\nTotal: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 2, CRITICAL: 0)\n\n┌───────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬────────────────────────────────────────────┐\n│    Library    │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                   Title                    │\n├───────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼────────────────────────────────────────────┤\n│ org.json:json │ CVE-2022-45688 │ HIGH     │ fixed  │ 20220924          │ 20230227      │ json stack overflow vulnerability          │\n│               │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2022-45688 │\n│               ├────────────────┤          │        │                   ├───────────────┼────────────────────────────────────────────┤\n│               │ CVE-2023-5072  │          │        │                   │ 20231013      │ JSON-java: parser confusion leads to OOM   │\n│               │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2023-5072  │\n└───────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴────────────────────────────────────────────┘\n```\n\n## Update Trivy Databases\n\n```\n% trivy image --download-db-only\n% trivy image --download-java-db-only\n% trivy image --reset\n```\n\n [build-status-svg]: https://github.com/grokify/gotrivy/actions/workflows/ci.yaml/badge.svg?branch=main\n [build-status-url]: https://github.com/grokify/gotrivy/actions/workflows/ci.yaml\n [lint-status-svg]: https://github.com/grokify/gotrivy/actions/workflows/lint.yaml/badge.svg?branch=main\n [lint-status-url]: https://github.com/grokify/gotrivy/actions/workflows/lint.yaml\n [goreport-svg]: https://goreportcard.com/badge/github.com/grokify/gotrivy\n [goreport-url]: https://goreportcard.com/report/github.com/grokify/gotrivy\n [docs-godoc-svg]: https://pkg.go.dev/badge/github.com/grokify/gotrivy\n [docs-godoc-url]: https://pkg.go.dev/github.com/grokify/gotrivy\n [license-svg]: https://img.shields.io/badge/license-MIT-blue.svg\n [license-url]: https://github.com/grokify/gotrivy/blob/master/LICENSE\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgrokify%2Fgotrivy","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgrokify%2Fgotrivy","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgrokify%2Fgotrivy/lists"}