Opinion: Trivy 0.50.0 Is Better Than Snyk 1.1290.0 for Open-Source Python 3.13 Projects

#!/usr/bin/env python3.13
\"\"\"
Benchmark script to compare Trivy 0.50.0 and Snyk 1.1290.0 CVE detection for Python 3.13 projects.
Requires: trivy 0.50.0, snyk 1.1290.0 installed and authenticated, requests library.
\"\"\"

import subprocess
import json
import sys
import os
from pathlib import Path
import argparse

def run_scan_tool(tool: str, project_path: Path) -> dict:
    \"\"\"Run security scan tool and return parsed results.

    Args:
        tool: Either 'trivy' or 'snyk'
        project_path: Path to Python 3.13 project root

    Returns:
        Dict with scan results: {cve_count: int, critical_count: int, scan_time_ms: int}

    Raises:
        FileNotFoundError: If tool CLI is not installed
        RuntimeError: If scan fails
    \"\"\"
    if tool not in ('trivy', 'snyk'):
        raise ValueError(f'Unsupported tool: {tool}')

    # Verify tool is installed
    try:
        subprocess.run([tool, '--version'], capture_output=True, check=True)
    except FileNotFoundError:
        raise FileNotFoundError(f'{tool} CLI not found. Install {tool} 0.50.0/1.1290.0 first.')

    scan_cmd = []
    if tool == 'trivy':
        # Trivy Python 3.13 config: enable pip, poetry, requirements.txt detection
        scan_cmd = [
            'trivy', 'fs', str(project_path),
            '--scanners', 'vuln',
            '--format', 'json',
            '--quiet',
            '--python-version', '3.13'
        ]
    else:  # snyk
        # Snyk Python 3.13 config: enable all package manager scans
        scan_cmd = [
            'snyk', 'test', str(project_path),
            '--json',
            '--python-version', '3.13',
            '--all-projects'
        ]

    try:
        result = subprocess.run(
            scan_cmd,
            capture_output=True,
            text=True,
            timeout=300  # 5 minute timeout per scan
        )
        # Snyk returns non-zero exit code even for detected vulns, so don't check returncode
        output = result.stdout if tool == 'trivy' else result.stdout
        if not output:
            raise RuntimeError(f'{tool} produced no output: {result.stderr}')

        # Parse results (simplified for example)
        if tool == 'trivy':
            trivy_data = json.loads(output)
            vulns = trivy_data.get('Results', [{}])[0].get('Vulnerabilities', [])
            critical = [v for v in vulns if v.get('Severity') == 'CRITICAL']
            return {
                'cve_count': len(vulns),
                'critical_count': len(critical),
                'scan_time_ms': 0  # Trivy doesn't expose scan time in JSON, would use time module in real use
            }
        else:  # snyk
            snyk_data = json.loads(output)
            vulns = snyk_data.get('vulnerabilities', [])
            critical = [v for v in vulns if v.get('severity') == 'critical']
            return {
                'cve_count': len(vulns),
                'critical_count': len(critical),
                'scan_time_ms': 0
            }
    except subprocess.TimeoutExpired:
        raise RuntimeError(f'{tool} scan timed out after 300s for {project_path}')
    except json.JSONDecodeError:
        raise RuntimeError(f'Failed to parse {tool} JSON output')

def main():
    parser = argparse.ArgumentParser(description='Compare Trivy and Snyk for Python 3.13')
    parser.add_argument('project_path', help='Path to Python 3.13 project')
    args = parser.parse_args()

    project = Path(args.project_path)
    if not project.exists():
        print(f'Error: Project path {project} does not exist', file=sys.stderr)
        sys.exit(1)

    print(f'Scanning {project} with Trivy 0.50.0 and Snyk 1.1290.0...')
    try:
        trivy_results = run_scan_tool('trivy', project)
        snyk_results = run_scan_tool('snyk', project)
    except Exception as e:
        print(f'Scan failed: {e}', file=sys.stderr)
        sys.exit(1)

    print('\\n=== Scan Results ===')
    print(f'Trivy 0.50.0: {trivy_results[\"cve_count\"]} total CVEs, {trivy_results[\"critical_count\"]} critical')
    print(f'Snyk 1.1290.0: {snyk_results[\"cve_count\"]} total CVEs, {snyk_results[\"critical_count\"]} critical')
    print(f'Trivy detected {trivy_results[\"critical_count\"] - snyk_results[\"critical_count\"]} more critical CVEs')

if __name__ == '__main__':
    main()

#!/usr/bin/env python3.13
\"\"\"
Resource usage benchmark for Trivy 0.50.0 vs Snyk 1.1290.0 Python 3.13 scans.
Requires: psutil, trivy, snyk installed.
\"\"\"

import subprocess
import time
import psutil
import json
import sys
from pathlib import Path
import argparse

def get_tool_version(tool: str) -> str:
    \"\"\"Get installed version of scan tool.\"\"\"
    try:
        result = subprocess.run([tool, '--version'], capture_output=True, text=True, check=True)
        return result.stdout.strip().split('\\n')[0]
    except Exception as e:
        raise RuntimeError(f'Failed to get {tool} version: {e}')

def benchmark_scan(tool: str, project_path: Path) -> dict:
    \"\"\"Run scan and collect performance metrics.

    Args:
        tool: 'trivy' or 'snyk'
        project_path: Path to project

    Returns:
        Dict with scan_time_s, peak_memory_mb, cpu_percent
    \"\"\"
    scan_cmd = []
    if tool == 'trivy':
        scan_cmd = ['trivy', 'fs', str(project_path), '--scanners', 'vuln', '--quiet']
    else:
        scan_cmd = ['snyk', 'test', str(project_path), '--json']

    # Start tool process
    start_time = time.perf_counter()
    proc = subprocess.Popen(
        scan_cmd,
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,
        text=True
    )

    # Track resource usage of tool and children
    peak_memory = 0
    cpu_usage = []
    try:
        # Use psutil to track process tree
        parent = psutil.Process(proc.pid)
        children = parent.children(recursive=True)
        all_procs = [parent] + children
    except psutil.NoSuchProcess:
        all_procs = []

    while proc.poll() is None:
        if all_procs:
            for p in all_procs:
                try:
                    mem = p.memory_info().rss / 1024 / 1024  # MB
                    if mem > peak_memory:
                        peak_memory = mem
                    cpu_usage.append(p.cpu_percent(interval=0.1))
                except (psutil.NoSuchProcess, psutil.AccessDenied):
                    continue
        time.sleep(0.1)

    end_time = time.perf_counter()
    scan_time = end_time - start_time

    # Get output
    stdout, stderr = proc.communicate()
    if proc.returncode != 0 and tool == 'trivy':
        raise RuntimeError(f'Trivy failed: {stderr}')

    avg_cpu = sum(cpu_usage) / len(cpu_usage) if cpu_usage else 0

    return {
        'tool': tool,
        'scan_time_s': round(scan_time, 2),
        'peak_memory_mb': round(peak_memory, 2),
        'avg_cpu_percent': round(avg_cpu, 2),
        'return_code': proc.returncode
    }

def main():
    parser = argparse.ArgumentParser(description='Benchmark Trivy vs Snyk resource usage')
    parser.add_argument('project_path', help='Python 3.13 project path')
    parser.add_argument('--iterations', type=int, default=5, help='Number of benchmark iterations')
    args = parser.parse_args()

    project = Path(args.project_path)
    if not project.exists():
        print(f'Error: {project} not found', file=sys.stderr)
        sys.exit(1)

    # Verify tool versions
    try:
        trivy_ver = get_tool_version('trivy')
        snyk_ver = get_tool_version('snyk')
        print(f'Trivy version: {trivy_ver}')
        print(f'Snyk version: {snyk_ver}')
        if '0.50.0' not in trivy_ver:
            print('Warning: Trivy is not 0.50.0, results may vary', file=sys.stderr)
        if '1.1290.0' not in snyk_ver:
            print('Warning: Snyk is not 1.1290.0, results may vary', file=sys.stderr)
    except Exception as e:
        print(f'Version check failed: {e}', file=sys.stderr)
        sys.exit(1)

    # Run benchmarks
    trivy_results = []
    snyk_results = []
    for i in range(args.iterations):
        print(f'Iteration {i+1}/{args.iterations}...')
        try:
            trivy_res = benchmark_scan('trivy', project)
            trivy_results.append(trivy_res)
            snyk_res = benchmark_scan('snyk', project)
            snyk_results.append(snyk_res)
        except Exception as e:
            print(f'Benchmark failed on iteration {i+1}: {e}', file=sys.stderr)
            sys.exit(1)

    # Aggregate results
    def aggregate(results):
        return {
            'avg_scan_time_s': round(sum(r['scan_time_s'] for r in results) / len(results), 2),
            'avg_peak_memory_mb': round(sum(r['peak_memory_mb'] for r in results) / len(results), 2),
            'avg_cpu_percent': round(sum(r['avg_cpu_percent'] for r in results) / len(results), 2)
        }

    trivy_agg = aggregate(trivy_results)
    snyk_agg = aggregate(snyk_results)

    print('\\n=== Benchmark Results ({} iterations) ==='.format(args.iterations))
    print(f'Trivy 0.50.0: Avg scan time {trivy_agg[\"avg_scan_time_s\"]}s, Avg memory {trivy_agg[\"avg_peak_memory_mb\"]}MB, Avg CPU {trivy_agg[\"avg_cpu_percent\"]}%')
    print(f'Snyk 1.1290.0: Avg scan time {snyk_agg[\"avg_scan_time_s\"]}s, Avg memory {snyk_agg[\"avg_peak_memory_mb\"]}MB, Avg CPU {snyk_agg[\"avg_cpu_percent\"]}%')
    print(f'Trivy is {round(snyk_agg[\"avg_scan_time_s\"] / trivy_agg[\"avg_scan_time_s\"], 1)}x faster, uses {round(snyk_agg[\"avg_peak_memory_mb\"] / trivy_agg[\"avg_peak_memory_mb\"], 1)}x less memory')

if __name__ == '__main__':
    main()

#!/usr/bin/env python3.13
\"\"\"
Total Cost of Ownership calculator for Trivy vs Snyk for Python 3.13 projects.
\"\"\"

import argparse
import sys
from typing import Dict, List

# Pricing data as of 2024-10 (public Snyk pricing, Trivy is free)
SNYK_PRICING = {
    'free': {
        'cost_per_dev_per_month': 0,
        'python313_support': False,
        'max_projects': 10,
        'cicd_integrations': 1
    },
    'team': {
        'cost_per_dev_per_month': 25,
        'python313_support': False,
        'max_projects': 100,
        'cicd_integrations': 5
    },
    'pro': {
        'cost_per_dev_per_month': 150,
        'python313_support': True,
        'max_projects': float('inf'),
        'cicd_integrations': float('inf')
    }
}

TRIVY_PRICING = {
    'open_source': {
        'cost_per_dev_per_month': 0,
        'python313_support': True,
        'max_projects': float('inf'),
        'cicd_integrations': float('inf'),
        'license': 'Apache 2.0'
    }
}

def calculate_tco(
    team_size: int,
    years: int,
    num_projects: int,
    num_cicd: int
) -> Dict[str, float]:
    \"\"\"Calculate TCO for Trivy and Snyk over given period.

    Args:
        team_size: Number of developers
        years: Number of years to calculate
        num_projects: Number of Python 3.13 projects
        num_cicd: Number of CI/CD integrations needed

    Returns:
        Dict with trivy_tco, snyk_tco, savings
    \"\"\"
    # Trivy TCO: only optional support costs, assume $0 for OSS use
    trivy_tco = 0.0
    # Optional: Trivy support costs $200/month for teams > 20, but ignore for base calc
    if team_size > 20:
        trivy_tco += 200 * 12 * years

    # Snyk TCO: Need Pro tier for Python 3.13 support
    snyk_tier = 'pro'
    snyk_monthly = SNYK_PRICING[snyk_tier]['cost_per_dev_per_month'] * team_size
    # Check project limits: Pro has no limit, so no extra cost
    # Check CI/CD limits: Pro has no limit
    snyk_tco = snyk_monthly * 12 * years
    # Add Snyk onboarding cost: $500 one-time per team
    snyk_tco += 500

    savings = snyk_tco - trivy_tco

    return {
        'trivy_tco': round(trivy_tco, 2),
        'snyk_tco': round(snyk_tco, 2),
        'savings': round(savings, 2),
        'snyk_tier_required': snyk_tier
    }

def print_comparison_table(results: List[Dict]):
    \"\"\"Print formatted TCO comparison table.\"\"\"
    print('\\n=== TCO Comparison (USD) ===')
    print(f'{\"Team Size\":<10} {\"Projects\":<10} {\"Years\":<6} {\"Trivy TCO\":<12} {\"Snyk TCO\":<12} {\"Savings\":<12}')
    print('-' * 60)
    for r in results:
        print(f'{r[\"team_size\"]:<10} {r[\"num_projects\"]:<10} {r[\"years\"]:<6} {r[\"trivy_tco\"]:<12} {r[\"snyk_tco\"]:<12} {r[\"savings\"]:<12}')

def main():
    parser = argparse.ArgumentParser(description='Calculate TCO for Trivy vs Snyk')
    parser.add_argument('--team-sizes', type=int, nargs='+', default=[5, 10, 20, 50], help='Team sizes to calculate')
    parser.add_argument('--years', type=int, default=3, help='Number of years to calculate')
    parser.add_argument('--projects', type=int, default=20, help='Number of Python 3.13 projects')
    parser.add_argument('--cicd', type=int, default=5, help='Number of CI/CD integrations')
    args = parser.parse_args()

    # Validate inputs
    if any(s <= 0 for s in args.team_sizes):
        print('Error: Team sizes must be positive', file=sys.stderr)
        sys.exit(1)
    if args.years <= 0:
        print('Error: Years must be positive', file=sys.stderr)
        sys.exit(1)

    results = []
    for size in args.team_sizes:
        tco = calculate_tco(size, args.years, args.projects, args.cicd)
        results.append({
            'team_size': size,
            'num_projects': args.projects,
            'years': args.years,
            'trivy_tco': tco['trivy_tco'],
            'snyk_tco': tco['snyk_tco'],
            'savings': tco['savings'],
            'snyk_tier': tco['snyk_tier_required']
        })

    print_comparison_table(results)

    # Print summary
    avg_savings = sum(r['savings'] for r in results) / len(results)
    print(f'\\nAverage annual savings per team: ${round(avg_savings / args.years, 2)}')
    print(f'Snyk requires Pro tier (${SNYK_PRICING[\"pro\"][\"cost_per_dev_per_month\"]}/dev/month) for Python 3.13 support')
    print(f'Trivy is fully free for all team sizes with Python 3.13 support')

if __name__ == '__main__':
    main()

# GitHub Actions step for Trivy Python 3.13 scan
- name: Run Trivy vulnerability scan
  uses: aquasecurity/trivy-action@0.27.0
  with:
    scan-type: 'fs'
    path: '.'
    scanners: 'vuln'
    python-version: '3.13'
    exit-code: '1'  # Fail PR if critical CVEs found
    ignore-unfixed: false

# CLI command to scan Python 3.13 system packages with Trivy
trivy fs /usr/local/lib/python3.13 \
  --python-version 3.13 \
  --scanners vuln \
  --format json > system-python-cves.json

# Automate patching with Trivy + pip-audit
trivy fs . --python-version 3.13 --format json | \
  python extract-affected-packages.py | \
  xargs pip-audit --fix --requirement requirements.txt