feat(vex): VEX Repository support

[knqyf263]

Description

This PR introduces VEX (Vulnerability Exploitability eXchange) Repository integration into Trivy. While Trivy currently supports VEX through the --vex flag for local VEX files, manually finding and managing relevant VEX documents for each scan is impractical and time-consuming for users. This new feature addresses this limitation by enabling automatic discovery and application of VEX data during vulnerability scans, primarily to filter out vulnerabilities that are not exploitable in the scanned context by leveraging community-maintained VEX information.

Usage

$ trivy image ghcr.io/aquasecurity/trivy:0.50.0 --vex repo --show-suppressed
2024-07-20T11:22:58+04:00       INFO    [vex] The default repository config has been created    
file_path="/home/test/.trivy/vex/repository.yaml"
2024-07-20T11:23:23+04:00       INFO    [vex] Updating repository...    repo="default" url="https://github.com/aquasecurity/vexhub"
...

Suppressed Vulnerabilities (Total: 4)
=====================================
┌───────────────┬────────────────┬──────────┬──────────────┬───────────────────────────────────────────────────┬──────────────────────────────────────────┐
│    Library    │ Vulnerability  │ Severity │    Status    │                     Statement                     │                  Source                  │
├───────────────┼────────────────┼──────────┼──────────────┼───────────────────────────────────────────────────┼──────────────────────────────────────────┤
│ busybox       │ CVE-2023-42364 │ MEDIUM   │ not_affected │ vulnerable_code_cannot_be_controlled_by_adversary │ VEX Repository: default                  │
│               │                │          │              │                                                   │ (https://github.com/aquasecurity/vexhub) │
│               ├────────────────┤          │              │                                                   │                                          │
│               │ CVE-2023-42365 │          │              │                                                   │                                          │
│               │                │          │              │                                                   │                                          │
├───────────────┼────────────────┤          │              │                                                   │                                          │
│ busybox-binsh │ CVE-2023-42364 │          │              │                                                   │                                          │
│               │                │          │              │                                                   │                                          │
│               ├────────────────┤          │              │                                                   │                                          │
│               │ CVE-2023-42365 │          │              │                                                   │                                          │
│               │                │          │              │                                                   │                                          │
└───────────────┴────────────────┴──────────┴──────────────┴───────────────────────────────────────────────────┴──────────────────────────────────────────┘

New Features

1. VEX Repository support:

   • Automatic download and caching of VEX data from configured repositories
   • Periodic updates based on repository-specific intervals
   • Filtering of vulnerabilities based on VEX information

2. New CLI option:

   • --vex repo: Enable VEX repository integration during scans (extends the existing --vex flag)

3. New CLI commands:

   • trivy vex repo init: Initialize the default VEX repository configuration
   • trivy vex repo list: List configured VEX repositories
   • trivy vex repo download: Pre-cache VEX data for configured repositories

4. Cache management:

   • Use trivy clean --vex-repo to clear the VEX repository cache

Implementation Details

• VEX repositories are configured in $HOME_DIR/.trivy/vex/repository.yaml
  • The default repository is VEX Hub.
• VEX data is cached in $CACHE_DIR/vex/repositories/
• The feature supports both HTTPS and GitHub-hosted repositories
• VEX filtering is performed after the regular vulnerability scan
• Users can add custom repositories that adhere to the VEX Repository Specification

Benefits

• Enhanced accuracy: Filter out vulnerabilities that are not exploitable in the specific context of the scanned software
• Focused remediation: Help security teams prioritize truly actionable vulnerabilities
• Practical VEX utilization: Make VEX integration a viable option for day-to-day vulnerability management by automating the discovery and application of relevant VEX data
• Flexibility: Support for multiple VEX sources, including custom repositories
• Efficiency: Local caching with controlled update intervals

Next Steps

This feature is initially designed to be opt-in to allow for testing and feedback. Existing Trivy functionality remains unchanged unless the new VEX repository options are explicitly used. However, given the benefits of VEX integration, we plan to transition this feature to opt-out in a future release. This change will make VEX repository integration the default behavior, further enhancing Trivy's vulnerability scanning capabilities for all users.

Issues

• Close feat(vex): add support for VEX Repository #7212

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

@DmitriyLewen ubuntu-latest-m is still down. I switched it to ubuntu-latest so I can confirm this PR passes all tests. It's all green now, and I marked this PR ready for review. I'll change it back to ubuntu-latest-m after GitHub gets fixed.

[DmitriyLewen]

LGTM
left small comment

[DmitriyLewen]

LGTM