feat(misconf): improve AVD-DS-0017 rule

[nikpivkin]

The list of package managers should be specified in the rule

Discussed in #5641

^{Originally posted by magnusja November 23, 2023}

Description

Having sbt update in a dockerfile results in

HIGH: The instruction 'RUN <package-manager> update' should always be followed by '<package-manager> install' in the same RUN statement.

It is an odd thing to assume that. I feel like that this is true for apt, but other than that? Maybe you should be explicit about the actual package manager which follow this approach.

Desired Behavior

This error should not happen. Especially because the only thing I can do is to ignore the whole Dockerfile and not only that particular command. Or is there a way to do so?

Actual Behavior

See description

Reproduction Steps

1. Have a scala project
2. Use sbt
3. Call sbt update

Target

None

Scanner

None

Output Format

None

Mode

None

Debug Output

I dont know man is this really necessary??

Operating System

CI

Version

Not sure runs somewhere in our CI

Checklist

• Run trivy image --reset
• Read the troubleshooting

[nikpivkin]

@simar7 PR in trivy-policies has been merged