fix(hardening): keep the images that fail on CRITICAL findings in the trivy report

jfraeys commented

2026-10-13 18:33:03 -04:00

Owner

Found 2026-10-13 while looking at the failed trivy-scan.service: it exited 1 ('Scan completed with critical vulnerabilities') but the saved report (trivy-scan-20261011_030000.json) contained only 6 images, all with 0 CRITICAL. The journal showed 15 images scanned, 9 failed, 119 CRITICAL in total. Cause: in scan_image an image with CRITICAL findings did 'return 1' BEFORE appending its result to the report, so the report held only the clean images, the leftover .tmp held only the last failing one, and the printed 'trivy convert' hint (which cannot read concatenated JSON anyway) pointed at a file with nothing to act on.

The image's JSON is appended to the report and copied to trivy-scan-/.json BEFORE it is judged.
For each image with CRITICAL findings the journal now lists up to 10 (CVE, package, installed -> fixed or 'no fix yet'); also with --report-only. HIGH findings are not listed.
Exit codes and the 'Failed' count are unchanged. The usage hint points at the per-image files.
scripts/tests/test-container-scan.sh (fake trivy/docker, 10 checks) is wired into lint; restoring the old order fails the two regression checks (report has 1 image not 2; failing image missing).
Not run against real trivy. After deploying (--tags hardening) the next scan is Sunday 03:00.

The 2026-10-11 numbers (from the journal, so the CVE details were never saved): klakegg/hugo:ext-alpine 55, boky/postfix:5.1.0 36, vaultwarden 1.37.1 7 (deployed is 1.37.4 now), cadvisor v0.49.1 5, watchtower 1.7.1 5, lldap:stable 4, authelia 4.39.2 3, fail2ban 1.1.0 3, node-exporter v1.10.2 1.

🤖 Generated with Claude Code

Found 2026-10-13 while looking at the failed trivy-scan.service: it exited 1 ('Scan completed with critical vulnerabilities') but the saved report (trivy-scan-20261011_030000.json) contained only 6 images, all with 0 CRITICAL. The journal showed 15 images scanned, 9 failed, 119 CRITICAL in total. Cause: in scan_image an image with CRITICAL findings did 'return 1' BEFORE appending its result to the report, so the report held only the clean images, the leftover .tmp held only the last failing one, and the printed 'trivy convert' hint (which cannot read concatenated JSON anyway) pointed at a file with nothing to act on. - The image's JSON is appended to the report and copied to trivy-scan-<ts>/<image>.json BEFORE it is judged. - For each image with CRITICAL findings the journal now lists up to 10 (CVE, package, installed -> fixed or 'no fix yet'); also with --report-only. HIGH findings are not listed. - Exit codes and the 'Failed' count are unchanged. The usage hint points at the per-image files. - scripts/tests/test-container-scan.sh (fake trivy/docker, 10 checks) is wired into lint; restoring the old order fails the two regression checks (report has 1 image not 2; failing image missing). - Not run against real trivy. After deploying (--tags hardening) the next scan is Sunday 03:00. The 2026-10-11 numbers (from the journal, so the CVE details were never saved): klakegg/hugo:ext-alpine 55, boky/postfix:5.1.0 36, vaultwarden 1.37.1 7 (deployed is 1.37.4 now), cadvisor v0.49.1 5, watchtower 1.7.1 5, lldap:stable 4, authelia 4.39.2 3, fail2ban 1.1.0 3, node-exporter v1.10.2 1. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jfraeys added 1 commit

2026-10-13 18:33:03 -04:00

fix(hardening): the trivy report dropped exactly the images that failed on CRITICAL findings

Lint / lint (pull_request) Successful in 2m17s

Details

Secret scan / scan (pull_request) Successful in 13s

Details

9b80011507

scan_image returned 1 before appending, so only clean images reached the saved report (2026-10-11: 6 of 15 images, 0 CRITICAL, while
9 images / 119 CRITICAL failed the run) and trivy convert could not read the concatenated file anyway. Keep each image's JSON before
judging it, write one file per image, and print the top CRITICAL CVEs (with fixed versions) into the journal.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

jfraeys referenced this pull request

2026-10-13 18:33:23 -04:00

Infra backlog: capacity, CI verification, alerts, older loose ends #121

jfraeys referenced this pull request

2026-10-13 18:33:24 -04:00

Roadmap: remaining infra and secrets work (tracker) #122

jfraeys merged commit 4e70c3be14 into main

2026-10-13 18:44:32 -04:00

jfraeys referenced this pull request from a commit

2026-10-13 18:44:34 -04:00

Merge pull request 'fix(hardening): keep the images that fail on CRITICAL findings in the trivy report' (#136) from jfraeys/fix/trivy-report-keeps-failures into main

jfraeys referenced this pull request