Problem with report template "@contrib/html.tpl"

[Joerg-L]

Question

We are using Azure DevOps Pipelines, based on ubuntu-latest, to build a docker image which we want to scan.

In the Pipeline trivy release 0.52.0 is getting installed by apt-get as documented here .

Following the documentation we are trying to scan our docker image with trivy image --format template --template "@contrib/html.tpl" -o report.html svc.0000.sample:1.49.0.

Then scan fails with
FATAL Fatal error report error: unable to write results: failed to initialize template writer: error retrieving template from path: open contrib/html.tpl: no such file or directory

What do I miss?
Thanks for Helping
Joerg

Target

Container Image

Scanner

Vulnerability

Output Format

Template

Mode

Standalone

Operating System

No response

Version

0.52.0

[DmitriyLewen]

Hello @Joerg-L
Thanks for your interest to Trivy!

apt-get installation doesn't include contrib folder.
You need to download html.tpl file (e.g. wget https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/html.tpl) and use --template @<path/to/template>/html.tpl flag.

Regards, Dmitriy

[DmitriyLewen]

that is working and it would be great if that would be also mentioned in the documentation.

Docs contain info about this - https://aquasecurity.github.io/trivy/v0.52/docs/configuration/reporting/#load-templates-from-a-file

FATAL Fatal error report error: unable to write results: failed to create a file: failed to create output file: open /home/vsts/work/1/a/trivy_output/report.html: no such file or directory

This happens because one of directory from output path doesn't exist (trivy_output in your case).
Trivy doesn't create directories. Trivy only creates output file.

@knqyf263 Perhaps we want to fix this - create the required directories?

[knqyf263]

The error message, no such file or directory, is well described. I don't think Trivy need to create a dir.

[Joerg-L]

@DmitriyLewen @knqyf263

I don't think Trivy need to create a dir.

I guess it depends, many other tools does it for more useability and convinience.
But sure, it is not main task of trivy to create an directory.

Thanks for your help

[knqyf263]

We're open to the change if many users hope.

[Potterpurpp]

I got this when I run trivy image --format template --template "@/path/to/html.tpl" --output "${SERVICE_NAME}-trivy-report.html" "$ECR_LOCAL_IMAGE"