-
Notifications
You must be signed in to change notification settings - Fork 113
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Implement vulnerability scanning for container images
- implement vulnerability scanning using trivy - list vulnerabilities in buildrun output
- Loading branch information
Showing
14 changed files
with
508 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,118 @@ | ||
| // Copyright The Shipwright Contributors | ||
| // | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
| package image | ||
|
|
||
| import ( | ||
| "context" | ||
| "encoding/json" | ||
| "fmt" | ||
| "log" | ||
| "os" | ||
| "os/exec" | ||
| "sort" | ||
| "strconv" | ||
| "strings" | ||
|
|
||
| shipwrightv1alpha1 "github.com/shipwright-io/build/pkg/apis/build/v1alpha1" | ||
| ) | ||
|
|
||
| const ( | ||
| VulnerabilityCountLimit = 50 // Number of vulnerabilities to be added to buildrun output. | ||
| ) | ||
|
|
||
| func RunVulnerabilityScan(ctx context.Context, imagePath string, settings shipwrightv1alpha1.VulnerabilityScanOptions) ([]shipwrightv1alpha1.Vulnerability, error) { | ||
|
|
||
| trivyArgs := []string{"image", "--quiet", "--format", "json", "--input", imagePath} | ||
|
|
||
| if settings.IgnoreOptions != nil { | ||
| if settings.IgnoreOptions.Severity != "" { | ||
| severity := getSeverity(settings.IgnoreOptions.Severity) | ||
| trivyArgs = append(trivyArgs, "--severity", severity) | ||
| } | ||
| if len(settings.IgnoreOptions.Issues) > 0 { | ||
| // Create a file with vulnerabilities to be ignored. | ||
| ignoreFile, err := os.CreateTemp("", "ignore") | ||
| if err != nil { | ||
| log.Printf("Could not create file for ignored vulnerabilities: %v\n", err) | ||
| return nil, err | ||
| } | ||
| defer os.Remove(ignoreFile.Name()) | ||
| for _, vul := range settings.IgnoreOptions.Issues { | ||
| _, err := ignoreFile.WriteString(vul + "\n") | ||
| if err != nil { | ||
| log.Printf("Error writing to ignore file for vulnerabilities: %v\n", err) | ||
| return nil, err | ||
| } | ||
| } | ||
| ignoreFile.Close() | ||
| trivyArgs = append(trivyArgs, "--ignorefile", ignoreFile.Name()) | ||
| } | ||
| trivyArgs = append(trivyArgs, "--ignore-unfixed", strconv.FormatBool(settings.IgnoreOptions.Unfixed)) | ||
| } | ||
|
|
||
| cmd := exec.CommandContext(ctx, "trivy", trivyArgs...) | ||
|
|
||
| // Print the command to be executed | ||
| log.Println(cmd.String()) | ||
|
|
||
| cmd.Stdin = nil | ||
|
|
||
| result, err := cmd.CombinedOutput() | ||
|
|
||
| if err != nil { | ||
| log.Println("failed to run trivy : ", string(result)) | ||
| return nil, fmt.Errorf("failed to run trivy: %w", err) | ||
| } | ||
|
|
||
| type TrivyResult struct { | ||
| Results []struct { | ||
| Vulnerabilities []shipwrightv1alpha1.Vulnerability `json:"Vulnerabilities"` | ||
| } `json:"Results"` | ||
| } | ||
|
|
||
| var trivyResult TrivyResult | ||
| if err := json.Unmarshal(result, &trivyResult); err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| var vulns []shipwrightv1alpha1.Vulnerability | ||
| for _, result := range trivyResult.Results { | ||
| vulns = append(vulns, result.Vulnerabilities...) | ||
| } | ||
|
|
||
| //Sort the vulnerabilities by severity | ||
| sort.Slice(vulns, func(i, j int) bool { | ||
| severityOrder := map[string]int{"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 3, "UNKNOWN": 4} | ||
| return severityOrder[vulns[i].Severity] < severityOrder[vulns[j].Severity] | ||
| }) | ||
|
|
||
| if len(vulns) > VulnerabilityCountLimit { | ||
| vulns = vulns[:VulnerabilityCountLimit] | ||
| } | ||
|
|
||
| return vulns, nil | ||
| } | ||
|
|
||
| func getSeverity(ignoreSeverities string) string { | ||
| excludeSeverities := strings.Split(ignoreSeverities, ",") | ||
|
|
||
| // Convert all strings to uppercase | ||
| for i, str := range excludeSeverities { | ||
| excludeSeverities[i] = strings.ToUpper(str) | ||
| } | ||
|
|
||
| supportedSeverities := []string{"UNKNOWN", "LOW", "MEDIUM", "HIGH", "CRITICAL"} | ||
| excludeSet := make(map[string]bool, len(excludeSeverities)) | ||
| for _, v := range excludeSeverities { | ||
| excludeSet[v] = true | ||
| } | ||
|
|
||
| var selected []string | ||
| for _, value := range supportedSeverities { | ||
| if !excludeSet[value] { | ||
| selected = append(selected, value) | ||
| } | ||
| } | ||
| return strings.Join(selected, ",") | ||
| } |
Oops, something went wrong.