feat(flag): add --cacert flag (#9781)

DmitriyLewen · web-flow · commit 604817326683 · 2025-11-12T07:03:44.000Z
diff --git a/docs/docs/references/configuration/cli/trivy.md b/docs/docs/references/configuration/cli/trivy.md
@@ -29,6 +29,7 @@ trivy [global flags] command [flags] target
 ### Options
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_clean.md b/docs/docs/references/configuration/cli/trivy_clean.md
@@ -35,6 +35,7 @@ trivy clean [flags]
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_cloud.md b/docs/docs/references/configuration/cli/trivy_cloud.md
@@ -11,6 +11,7 @@ Control Trivy Cloud platform integration settings
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_cloud_config.md b/docs/docs/references/configuration/cli/trivy_cloud_config.md
@@ -11,6 +11,7 @@ Control Trivy Cloud configuration
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_cloud_config_edit.md b/docs/docs/references/configuration/cli/trivy_cloud_config_edit.md
@@ -19,6 +19,7 @@ trivy cloud config edit [flags]
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_cloud_config_get.md b/docs/docs/references/configuration/cli/trivy_cloud_config_get.md
@@ -28,6 +28,7 @@ trivy cloud config get [setting] [flags]
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_cloud_config_list.md b/docs/docs/references/configuration/cli/trivy_cloud_config_list.md
@@ -19,6 +19,7 @@ trivy cloud config list [flags]
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_cloud_config_set.md b/docs/docs/references/configuration/cli/trivy_cloud_config_set.md
@@ -28,6 +28,7 @@ trivy cloud config set [setting] [value] [flags]
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_cloud_config_unset.md b/docs/docs/references/configuration/cli/trivy_cloud_config_unset.md
@@ -28,6 +28,7 @@ trivy cloud config unset [setting] [flags]
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_config.md b/docs/docs/references/configuration/cli/trivy_config.md
@@ -84,6 +84,7 @@ trivy config [flags] DIR
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_convert.md b/docs/docs/references/configuration/cli/trivy_convert.md
@@ -58,6 +58,7 @@ trivy convert [flags] RESULT_JSON
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_filesystem.md b/docs/docs/references/configuration/cli/trivy_filesystem.md
@@ -178,6 +178,7 @@ trivy filesystem [flags] PATH
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_image.md b/docs/docs/references/configuration/cli/trivy_image.md
@@ -199,6 +199,7 @@ trivy image [flags] IMAGE_NAME
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_kubernetes.md b/docs/docs/references/configuration/cli/trivy_kubernetes.md
@@ -187,6 +187,7 @@ trivy kubernetes [flags] [CONTEXT]
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_login.md b/docs/docs/references/configuration/cli/trivy_login.md
@@ -29,6 +29,7 @@ trivy login [flags]
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_logout.md b/docs/docs/references/configuration/cli/trivy_logout.md
@@ -15,6 +15,7 @@ trivy logout [flags]
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_module.md b/docs/docs/references/configuration/cli/trivy_module.md
@@ -13,6 +13,7 @@ Manage modules
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_module_install.md b/docs/docs/references/configuration/cli/trivy_module_install.md
@@ -15,6 +15,7 @@ trivy module install [flags] REPOSITORY
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_module_uninstall.md b/docs/docs/references/configuration/cli/trivy_module_uninstall.md
@@ -15,6 +15,7 @@ trivy module uninstall [flags] REPOSITORY
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_plugin.md b/docs/docs/references/configuration/cli/trivy_plugin.md
@@ -11,6 +11,7 @@ Manage plugins
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_plugin_info.md b/docs/docs/references/configuration/cli/trivy_plugin_info.md
@@ -15,6 +15,7 @@ trivy plugin info PLUGIN_NAME
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_plugin_install.md b/docs/docs/references/configuration/cli/trivy_plugin_install.md
@@ -28,6 +28,7 @@ trivy plugin install NAME | URL | FILE_PATH
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_plugin_list.md b/docs/docs/references/configuration/cli/trivy_plugin_list.md
@@ -15,6 +15,7 @@ trivy plugin list
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_plugin_run.md b/docs/docs/references/configuration/cli/trivy_plugin_run.md
@@ -15,6 +15,7 @@ trivy plugin run NAME | URL | FILE_PATH
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_plugin_search.md b/docs/docs/references/configuration/cli/trivy_plugin_search.md
@@ -15,6 +15,7 @@ trivy plugin search [KEYWORD]
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_plugin_uninstall.md b/docs/docs/references/configuration/cli/trivy_plugin_uninstall.md
@@ -15,6 +15,7 @@ trivy plugin uninstall PLUGIN_NAME
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_plugin_update.md b/docs/docs/references/configuration/cli/trivy_plugin_update.md
@@ -15,6 +15,7 @@ trivy plugin update
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_plugin_upgrade.md b/docs/docs/references/configuration/cli/trivy_plugin_upgrade.md
@@ -15,6 +15,7 @@ trivy plugin upgrade [PLUGIN_NAMES]
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_registry.md b/docs/docs/references/configuration/cli/trivy_registry.md
@@ -11,6 +11,7 @@ Manage registry authentication
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_registry_login.md b/docs/docs/references/configuration/cli/trivy_registry_login.md
@@ -25,6 +25,7 @@ trivy registry login SERVER [flags]
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_registry_logout.md b/docs/docs/references/configuration/cli/trivy_registry_logout.md
@@ -22,6 +22,7 @@ trivy registry logout SERVER [flags]
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_repository.md b/docs/docs/references/configuration/cli/trivy_repository.md
@@ -177,6 +177,7 @@ trivy repository [flags] (REPO_PATH | REPO_URL)
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_rootfs.md b/docs/docs/references/configuration/cli/trivy_rootfs.md
@@ -179,6 +179,7 @@ trivy rootfs [flags] ROOTDIR
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_sbom.md b/docs/docs/references/configuration/cli/trivy_sbom.md
@@ -147,6 +147,7 @@ trivy sbom [flags] SBOM_PATH
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_server.md b/docs/docs/references/configuration/cli/trivy_server.md
@@ -45,6 +45,7 @@ trivy server [flags]
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_version.md b/docs/docs/references/configuration/cli/trivy_version.md
@@ -16,6 +16,7 @@ trivy version [flags]
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_vex.md b/docs/docs/references/configuration/cli/trivy_vex.md
@@ -11,6 +11,7 @@
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_vex_repo.md b/docs/docs/references/configuration/cli/trivy_vex_repo.md
@@ -25,6 +25,7 @@ Manage VEX repositories
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_vex_repo_download.md b/docs/docs/references/configuration/cli/trivy_vex_repo_download.md
@@ -19,6 +19,7 @@ trivy vex repo download [REPO_NAMES] [flags]
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_vex_repo_init.md b/docs/docs/references/configuration/cli/trivy_vex_repo_init.md
@@ -15,6 +15,7 @@ trivy vex repo init [flags]
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_vex_repo_list.md b/docs/docs/references/configuration/cli/trivy_vex_repo_list.md
@@ -15,6 +15,7 @@ trivy vex repo list [flags]
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/cli/trivy_vm.md b/docs/docs/references/configuration/cli/trivy_vm.md
@@ -163,6 +163,7 @@ trivy vm [flags] VM_IMAGE
 ### Options inherited from parent commands
 
 ```
+      --cacert string             Path to PEM-encoded CA certificate file
       --cache-dir string          cache directory (default "/path/to/cache")
   -c, --config string             config path (default "trivy.yaml")
   -d, --debug                     debug mode
diff --git a/docs/docs/references/configuration/config-file.md b/docs/docs/references/configuration/config-file.md
@@ -9,6 +9,9 @@ These samples contain default values for flags.
 ## Global options
 
 ```yaml
+# Same as '--cacert'
+cacert: ""
+
 cache:
   # Same as '--cache-dir'
   dir: "/path/to/cache"
diff --git a/docs/docs/references/troubleshooting.md b/docs/docs/references/troubleshooting.md
@@ -78,15 +78,27 @@ Common mistakes include the following, depending on where you are pulling images
 $ TRIVY_INSECURE=true trivy image [YOUR_IMAGE]
 ```
 
-On Unix systems other than macOS, you can specify the location of your certificate using `SSL_CERT_FILE` or `SSL_CERT_DIR` environment variables.
+If you need to trust a custom CA certificate, you can provide a PEM-encoded bundle.
 
-```
-$ SSL_CERT_FILE=/path/to/cert trivy image [YOUR_IMAGE]
-```
+=== "Unix (except macOS)"
 
-```
-$ SSL_CERT_DIR=/path/to/certs trivy image [YOUR_IMAGE]
-```
+    You can specify the location of your certificate using the `SSL_CERT_FILE` or `SSL_CERT_DIR` environment variables.
+
+    ```bash
+    $ SSL_CERT_FILE=/path/to/ca.pem trivy image [YOUR_IMAGE]
+    ```
+
+    ```bash
+    $ SSL_CERT_DIR=/path/to/certs trivy image [YOUR_IMAGE]
+    ```
+
+=== "All systems"
+
+    Use the `--cacert` flag to point Trivy to a PEM-encoded CA certificate file, regardless of the operating system.
+
+    ```bash
+    $ trivy image --cacert /path/to/ca.pem [YOUR_IMAGE]
+    ```
 
 ### GitHub Rate limiting
 Trivy uses GitHub API for [VEX repositories](../supply-chain/vex/repo.md).
diff --git a/pkg/commands/artifact/run.go b/pkg/commands/artifact/run.go
@@ -131,6 +131,7 @@ func NewRunner(ctx context.Context, cliOptions flag.Options, targetKind TargetKi
 	// Set the default HTTP transport
 	xhttp.SetDefaultTransport(xhttp.NewTransport(xhttp.Options{
 		Insecure:  cliOptions.Insecure,
+		CACerts:   cliOptions.CACerts,
 		Timeout:   cliOptions.Timeout,
 		TraceHTTP: cliOptions.TraceHTTP,
 	}))
diff --git a/pkg/commands/server/run.go b/pkg/commands/server/run.go
@@ -22,6 +22,7 @@ func Run(ctx context.Context, opts flag.Options) (err error) {
 	// Set the default HTTP transport
 	xhttp.SetDefaultTransport(xhttp.NewTransport(xhttp.Options{
 		Insecure: opts.Insecure,
+		CACerts:  opts.CACerts,
 		Timeout:  opts.Timeout,
 	}))
 
diff --git a/pkg/fanal/image/registry/ecr/ecr.go b/pkg/fanal/image/registry/ecr/ecr.go
diff --git a/pkg/fanal/types/image.go b/pkg/fanal/types/image.go
diff --git a/pkg/flag/global_flags.go b/pkg/flag/global_flags.go
diff --git a/pkg/flag/options.go b/pkg/flag/options.go
diff --git a/pkg/x/http/transport.go b/pkg/x/http/transport.go
