Jens
faeb58ef6d
GeoIntel release gates / Compile, test, contracts and builds (push) Successful in 1m49s
GeoIntel release gates / Python and npm vulnerability policy (push) Successful in 21s
GeoIntel release gates / Production AI image, SBOM and container scan (push) Successful in 5m39s
GeoIntel release gates / Deploy exact gated revision to Unraid (push) Failing after 58m43s
117 lines
3.7 KiB
Bash
117 lines
3.7 KiB
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
TARGET_IMAGE="${1:-geointel-ci:local}"
|
|
OUTPUT="${2:-artifacts/geointel-container-vulnerabilities.json}"
|
|
IMAGE_ARCHIVE="${GEOINTEL_IMAGE_ARCHIVE:-artifacts/geointel-image.tar}"
|
|
ARCHIVE_ID_FILE="${IMAGE_ARCHIVE}.image-id"
|
|
KEEP_ARCHIVE="${GEOINTEL_KEEP_IMAGE_ARCHIVE:-false}"
|
|
TRIVY_IMAGE="aquasec/trivy:0.70.0@sha256:be1190afcb28352bfddc4ddeb71470835d16462af68d310f9f4bca710961a41e"
|
|
CACHE_DIR="${GEOINTEL_TRIVY_CACHE:-$ROOT/.cache/trivy}"
|
|
PYTHON_CMD="${PYTHON_BIN:-python3}"
|
|
IGNORE_FILE="$CACHE_DIR/geointel-trivy-ignore.txt"
|
|
ARCHIVE_CREATED=false
|
|
PARTIAL_ARCHIVE=""
|
|
|
|
cleanup() {
|
|
rm -f -- "$IGNORE_FILE"
|
|
if [ -n "$PARTIAL_ARCHIVE" ]; then
|
|
rm -f -- "$PARTIAL_ARCHIVE"
|
|
fi
|
|
if [ "$ARCHIVE_CREATED" = true ] && [ "$KEEP_ARCHIVE" != true ]; then
|
|
rm -f -- "$ROOT/$IMAGE_ARCHIVE" "$ROOT/$ARCHIVE_ID_FILE"
|
|
fi
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
for candidate in "$OUTPUT" "$IMAGE_ARCHIVE"; do
|
|
case "$candidate" in
|
|
/*|*..*)
|
|
echo "Scan paths must be repository-relative and may not contain '..'." >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
done
|
|
|
|
IMAGE_ID="$(docker image inspect --format '{{.Id}}' "$TARGET_IMAGE")"
|
|
test -n "$IMAGE_ID"
|
|
case "$CACHE_DIR" in
|
|
"$ROOT"/*) CACHE_RELATIVE="${CACHE_DIR#"$ROOT/"}" ;;
|
|
*)
|
|
echo "Trivy cache must remain inside the repository workspace." >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
case "$CACHE_RELATIVE" in
|
|
*..*)
|
|
echo "Trivy cache may not contain '..'." >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
mkdir -p "$ROOT/$(dirname "$OUTPUT")" "$ROOT/$(dirname "$IMAGE_ARCHIVE")" "$CACHE_DIR"
|
|
|
|
ARCHIVE_ID=""
|
|
if [ -s "$ROOT/$ARCHIVE_ID_FILE" ]; then
|
|
ARCHIVE_ID="$(tr -d '[:space:]' < "$ROOT/$ARCHIVE_ID_FILE")"
|
|
fi
|
|
if [ ! -s "$ROOT/$IMAGE_ARCHIVE" ] || [ "$ARCHIVE_ID" != "$IMAGE_ID" ]; then
|
|
rm -f -- "$ROOT/$IMAGE_ARCHIVE" "$ROOT/$ARCHIVE_ID_FILE"
|
|
PARTIAL_ARCHIVE="$ROOT/${IMAGE_ARCHIVE}.partial.$$"
|
|
docker save "$IMAGE_ID" --output "$PARTIAL_ARCHIVE"
|
|
mv "$PARTIAL_ARCHIVE" "$ROOT/$IMAGE_ARCHIVE"
|
|
PARTIAL_ARCHIVE=""
|
|
printf '%s\n' "$IMAGE_ID" > "$ROOT/$ARCHIVE_ID_FILE"
|
|
ARCHIVE_CREATED=true
|
|
fi
|
|
|
|
WORKDIR="/workspace"
|
|
WORKSPACE_ARGS=(-v "$ROOT:/workspace")
|
|
if [[ -n "${HOSTNAME:-}" ]] && docker inspect --type container "$HOSTNAME" >/dev/null 2>&1; then
|
|
WORKDIR="$ROOT"
|
|
WORKSPACE_ARGS=(--volumes-from "$HOSTNAME")
|
|
fi
|
|
CONTAINER_CACHE_DIR="$WORKDIR/$CACHE_RELATIVE"
|
|
CONTAINER_IGNORE_FILE="$CONTAINER_CACHE_DIR/geointel-trivy-ignore.txt"
|
|
|
|
"$PYTHON_CMD" "$ROOT/scripts/verify_security_exceptions.py"
|
|
"$PYTHON_CMD" "$ROOT/scripts/verify_security_exceptions.py" \
|
|
--print-container-ids | tr -d '\r' > "$IGNORE_FILE"
|
|
|
|
# Keep the complete report, including vulnerabilities without an available fix.
|
|
docker run --rm \
|
|
--user 0:0 \
|
|
"${WORKSPACE_ARGS[@]}" \
|
|
"$TRIVY_IMAGE" \
|
|
image \
|
|
--input "$WORKDIR/$IMAGE_ARCHIVE" \
|
|
--scanners vuln \
|
|
--timeout 20m \
|
|
--skip-version-check \
|
|
--format json \
|
|
--cache-dir "$CONTAINER_CACHE_DIR" \
|
|
--output "$WORKDIR/$OUTPUT"
|
|
|
|
# Release policy: fixed HIGH/CRITICAL findings block the build. Unfixed findings
|
|
# remain visible in the full report and must be reviewed before release. The
|
|
# postgres base image's Go gosu binary remains discoverable in a lower layer,
|
|
# but the final filesystem replaces it with the audited setpriv shell wrapper.
|
|
docker run --rm \
|
|
--user 0:0 \
|
|
"${WORKSPACE_ARGS[@]}" \
|
|
"$TRIVY_IMAGE" \
|
|
image \
|
|
--input "$WORKDIR/$IMAGE_ARCHIVE" \
|
|
--scanners vuln \
|
|
--timeout 20m \
|
|
--skip-version-check \
|
|
--ignore-unfixed \
|
|
--cache-dir "$CONTAINER_CACHE_DIR" \
|
|
--ignorefile "$CONTAINER_IGNORE_FILE" \
|
|
--skip-files /usr/local/bin/gosu \
|
|
--severity HIGH,CRITICAL \
|
|
--exit-code 1
|
|
|
|
test -s "$ROOT/$OUTPUT"
|
|
echo "Container vulnerability report written to $OUTPUT for $IMAGE_ID"
|