72 lines
2.3 KiB
Bash
72 lines
2.3 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
TARGET_IMAGE="${1:-geointel-ci:local}"
|
|
OUTPUT="${2:-artifacts/geointel-container-vulnerabilities.json}"
|
|
TRIVY_IMAGE="aquasec/trivy:0.70.0@sha256:be1190afcb28352bfddc4ddeb71470835d16462af68d310f9f4bca710961a41e"
|
|
CACHE_DIR="${GEOINTEL_TRIVY_CACHE:-$ROOT/.cache/trivy}"
|
|
PYTHON_CMD="${PYTHON_BIN:-python3}"
|
|
IGNORE_FILE="$(mktemp)"
|
|
CONTAINER_IGNORE_FILE="/tmp/geointel-trivy-ignore.txt"
|
|
trap 'rm -f "$IGNORE_FILE"' EXIT
|
|
|
|
case "$OUTPUT" in
|
|
/*|*..*)
|
|
echo "Scan output must be a repository-relative path without '..'." >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
docker image inspect "$TARGET_IMAGE" >/dev/null
|
|
mkdir -p "$ROOT/$(dirname "$OUTPUT")" "$CACHE_DIR"
|
|
"$PYTHON_CMD" "$ROOT/scripts/verify_security_exceptions.py"
|
|
mapfile -t ignored_container_ids < <(
|
|
"$PYTHON_CMD" "$ROOT/scripts/verify_security_exceptions.py" \
|
|
--print-container-ids | tr -d '\r'
|
|
)
|
|
ignore_args=()
|
|
trivy_ignore_args=()
|
|
if [ "${#ignored_container_ids[@]}" -gt 0 ]; then
|
|
printf '%s\n' "${ignored_container_ids[@]}" > "$IGNORE_FILE"
|
|
ignore_args=(-v "$IGNORE_FILE:$CONTAINER_IGNORE_FILE:ro")
|
|
trivy_ignore_args=(--ignorefile "$CONTAINER_IGNORE_FILE")
|
|
fi
|
|
|
|
# Keep the complete report, including vulnerabilities without an available fix.
|
|
docker run --rm \
|
|
-v /var/run/docker.sock:/var/run/docker.sock \
|
|
-v "$ROOT:/workspace" \
|
|
-v "$CACHE_DIR:/root/.cache/trivy" \
|
|
"$TRIVY_IMAGE" \
|
|
image \
|
|
--scanners vuln \
|
|
--timeout 20m \
|
|
--skip-version-check \
|
|
--format json \
|
|
--output "/workspace/$OUTPUT" \
|
|
"$TARGET_IMAGE"
|
|
|
|
# Release policy: fixed HIGH/CRITICAL findings block the build. Unfixed findings
|
|
# remain visible in the full report and must be reviewed before release. The
|
|
# postgres base image's Go gosu binary remains discoverable in a lower layer,
|
|
# but the final filesystem replaces it with the audited setpriv shell wrapper.
|
|
docker run --rm \
|
|
-v /var/run/docker.sock:/var/run/docker.sock \
|
|
-v "$CACHE_DIR:/root/.cache/trivy" \
|
|
"${ignore_args[@]}" \
|
|
"$TRIVY_IMAGE" \
|
|
image \
|
|
--scanners vuln \
|
|
--timeout 20m \
|
|
--skip-version-check \
|
|
--ignore-unfixed \
|
|
"${trivy_ignore_args[@]}" \
|
|
--skip-files /usr/local/bin/gosu \
|
|
--severity HIGH,CRITICAL \
|
|
--exit-code 1 \
|
|
"$TARGET_IMAGE"
|
|
|
|
test -s "$ROOT/$OUTPUT"
|
|
echo "Container vulnerability report written to $OUTPUT"
|