69 lines
3.3 KiB
Bash
69 lines
3.3 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
repo="$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)"
|
|
output="$repo/deploy/security"
|
|
mkdir -p "$output"
|
|
|
|
application_image="${1:-${LUDARIUM_IMAGE:-ludarium/ludarium:0.4.1}}"
|
|
release_version="${LUDARIUM_RELEASE_VERSION:-${application_image##*:}}"
|
|
cache="${LUDARIUM_RELEASE_TOOL_CACHE:-/mnt/user/appdata/ludarium/release-tools}"
|
|
mkdir -p "$cache/bin" "$cache/downloads" "$cache/grype-db" "$cache/tmp"
|
|
TMPDIR="$cache/tmp"
|
|
export TMPDIR
|
|
|
|
scan_source="docker:$application_image"
|
|
image_archive=""
|
|
if [ -n "${WSL_INTEROP:-}" ] \
|
|
&& command -v docker.exe >/dev/null 2>&1 \
|
|
&& docker.exe image inspect "$application_image" >/dev/null 2>&1 \
|
|
&& ! docker image inspect "$application_image" >/dev/null 2>&1; then
|
|
image_archive="$(mktemp "$cache/tmp/ludarium-image.XXXXXX.tar")"
|
|
trap 'rm -f "$image_archive"' EXIT HUP INT TERM
|
|
docker.exe save --output "$(wslpath -w "$image_archive")" "$application_image"
|
|
scan_source="docker-archive:$image_archive"
|
|
fi
|
|
|
|
download_tool() {
|
|
name="$1" version="$2" archive="$3" checksum="$4" url="$5"
|
|
binary="$cache/bin/$name-$version"
|
|
[ -x "$binary" ] && { printf '%s\n' "$binary"; return; }
|
|
package="$cache/downloads/$archive"
|
|
if [ ! -f "$package" ] || ! printf '%s %s\n' "$checksum" "$package" | sha256sum -c - >/dev/null 2>&1; then
|
|
rm -f "$package.part"
|
|
curl --fail --location --silent --show-error --retry 5 --retry-all-errors \
|
|
--connect-timeout 15 --max-time 300 "$url" -o "$package.part"
|
|
printf '%s %s\n' "$checksum" "$package.part" | sha256sum -c - >/dev/null
|
|
mv "$package.part" "$package"
|
|
fi
|
|
work="$(mktemp -d)"
|
|
tar -xzf "$package" -C "$work" "$name"
|
|
install -m 0755 "$work/$name" "$binary"
|
|
rm -rf "$work"
|
|
printf '%s\n' "$binary"
|
|
}
|
|
|
|
gitleaks="$(download_tool gitleaks 8.30.1 gitleaks_8.30.1_linux_x64.tar.gz \
|
|
551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb \
|
|
https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz)"
|
|
syft="$(download_tool syft 1.50.0 syft_1.50.0_linux_amd64.tar.gz \
|
|
bf7b29ff57f06da30918266a0e1c2885a8f99784798d1bdb1628886aa015d788 \
|
|
https://github.com/anchore/syft/releases/download/v1.50.0/syft_1.50.0_linux_amd64.tar.gz)"
|
|
grype="$(download_tool grype 0.116.1 grype_0.116.1_linux_amd64.tar.gz \
|
|
0122df7b655981abe547ad3d2190d65551dac6a2bfc80b4dc2a989b5d0587458 \
|
|
https://github.com/anchore/grype/releases/download/v0.116.1/grype_0.116.1_linux_amd64.tar.gz)"
|
|
|
|
# Scan the materialized candidate tree. A linked Git worktree can reference metadata
|
|
# outside /repo, which would otherwise make a containerized history scan inspect zero commits.
|
|
"$gitleaks" dir "$repo" --config "$repo/.gitleaks.toml" --redact --report-format json --report-path "$output/gitleaks.json"
|
|
"$syft" "$scan_source" -o "cyclonedx-json=$output/ludarium-$release_version.cdx.json"
|
|
if command -v timeout >/dev/null; then
|
|
timeout 600 env GRYPE_DB_CACHE_DIR="$cache/grype-db" "$grype" db update
|
|
timeout 600 env GRYPE_DB_CACHE_DIR="$cache/grype-db" "$grype" "$scan_source" -o json --file "$output/grype.json" --fail-on high
|
|
else
|
|
GRYPE_DB_CACHE_DIR="$cache/grype-db" "$grype" db update
|
|
GRYPE_DB_CACHE_DIR="$cache/grype-db" "$grype" "$scan_source" -o json --file "$output/grype.json" --fail-on high
|
|
fi
|
|
|
|
printf 'security gates passed for %s\n' "$application_image"
|