Swift¶
Trivy supports CocoaPods and Swift package managers.
The following scanners are supported.
| Package manager | SBOM | Vulnerability | License |
|---|---|---|---|
| Swift | ✓ | ✓ | - |
| CocoaPods | ✓ | ✓ | - |
The following table provides an outline of the features Trivy offers.
| Package manager | File | Transitive dependencies | Dev dependencies | Dependency graph | Position |
|---|---|---|---|---|---|
| Swift | Package.resolved | ✓ | Included | - | ✓ |
| CocoaPods | Podfile.lock | ✓ | Included | ✓ | - |
These may be enabled or disabled depending on the target. See here for the detail.
Swift¶
Trivy parses Package.resolved file to find dependencies.
Don't forget to update (swift package update command) this file before scanning.
CocoaPods¶
CocoaPods uses package names in PodFile.lock, but GitHub Advisory Database (GHSA) Trivy relies on uses Git URLs.
We parse the CocoaPods Specs to match package names and links.
Limitation
Since GHSA holds only Git URLs, such as github.com/apple/swift-nio,
Trivy can't identify affected submodules, and detect all submodules maintained by the same URL.
For example, SwiftNIOHTTP1 and SwiftNIOWebSocket both are maintained under github.com/apple/swift-nio,
and Trivy detect CVE-2022-3215 for both of them, even though only SwiftNIOHTTP1 is actually affected.