Repository navigation
ci: container image scan gate with Trivy (spec 013 G2) #678
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
13 commits
Select commit
Hold shift + click to select a range
dabfd07
ci: container image scan gate with Trivy (spec 013 G2)
claude 35553b5
Merge remote-tracking branch 'origin/master' into claude/013-trivy
claude 422e6ec
fix(deps): bump golang.org/x/net to v0.60.0 (spec 013 G2, T031)
claude c3618ec
fix(tunnel): build frpc from source with patched x/net and x/crypto (…
claude 62cf341
Merge remote-tracking branch 'origin/master' into claude/013-trivy
claude 00dd29e
chore: merge master into claude/013-trivy
claude bcc029e
chore: merge master into claude/013-trivy
claude 24ddde6
chore: merge master into claude/013-trivy
claude 87c4fca
chore: merge master into claude/013-trivy
claude 4d7729a
docs(specs): close 013 G-02 and tick T031
claude 5c07ace
chore: merge master into claude/013-trivy
claude c6ce64b
Merge master into claude/013-trivy
claude 3dfbd9d
ci: scan both published platforms before signing
claude File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,48 @@ | ||
| #!/usr/bin/env bash | ||
| # check-image-scan_test.sh: Proof for hack/trivy-scan-images.sh (spec 013 G2, | ||
| # contracts/static-gates.md). | ||
| # | ||
| # 1. An end-of-life alpine pinned by digest must FAIL. alpine:3.17.0 | ||
| # (November 2022) ships libssl3/libcrypto3 3.0.7-r0, which has fixed HIGH | ||
| # CVEs CVE-2023-0286, CVE-2022-4450 and CVE-2023-0215. The scan output | ||
| # must name CVE-2023-0286, so a failure for any other reason (a pull | ||
| # error, a DB download error) does not count as proof. | ||
| # 2. gameplane-test/telemetry-receiver:e2e must PASS. | ||
| # | ||
| # Env: CLEAN_IMAGE - override the image expected to pass. | ||
| set -euo pipefail | ||
|
|
||
| SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" | ||
| SCAN="$SCRIPT_DIR/trivy-scan-images.sh" | ||
|
|
||
| # alpine:3.17.0 image index digest. | ||
| EOL_IMAGE="alpine@sha256:8914eb54f968791faf6a8638949e480fef81e697984fba772b3976835194c6d4" | ||
| EXPECTED_CVE="CVE-2023-0286" | ||
| CLEAN_IMAGE="${CLEAN_IMAGE:-gameplane-test/telemetry-receiver:e2e}" | ||
|
|
||
| fail=0 | ||
|
|
||
| rc=0 | ||
| out=$("$SCAN" "$EOL_IMAGE" 2>&1) || rc=$? | ||
| if [[ $rc -eq 0 ]]; then | ||
| echo "✗ ${EOL_IMAGE} accepted; expected the gate to reject it" | ||
| fail=1 | ||
| elif ! grep -q "$EXPECTED_CVE" <<<"$out"; then | ||
| echo "✗ ${EOL_IMAGE} rejected (exit $rc) but ${EXPECTED_CVE} was not reported" | ||
| printf '%s\n' "$out" | tail -n 40 | sed 's/^/ /' | ||
| fail=1 | ||
| else | ||
| echo "✓ ${EOL_IMAGE} rejected (exit $rc, ${EXPECTED_CVE} reported)" | ||
| fi | ||
|
|
||
| rc=0 | ||
| out=$("$SCAN" "$CLEAN_IMAGE" 2>&1) || rc=$? | ||
| if [[ $rc -ne 0 ]]; then | ||
| echo "✗ ${CLEAN_IMAGE} rejected (exit $rc); expected it to pass" | ||
| printf '%s\n' "$out" | tail -n 60 | sed 's/^/ /' | ||
| fail=1 | ||
| else | ||
| echo "✓ ${CLEAN_IMAGE} accepted" | ||
| fi | ||
|
|
||
| exit "$fail" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| #!/usr/bin/env bash | ||
| # trivy-scan-images.sh: Spec 013 G2 (contracts/static-gates.md). Scans each | ||
| # image argument with Trivy and fails if any image has a HIGH or CRITICAL | ||
| # vulnerability that has a fix. Every image is scanned before the exit status | ||
| # is decided, so one run lists every finding. | ||
| # | ||
| # Fix findings with a base-image digest bump or a Go/npm dependency bump in | ||
| # the image's module, never an ignore file (FR-008). | ||
| # | ||
| # Usage: hack/trivy-scan-images.sh IMAGE [IMAGE...] | ||
| # Env: TRIVY - Trivy binary to run (default: trivy) | ||
| # TRIVY_PLATFORMS - comma-separated os/arch list (e.g. | ||
| # linux/amd64,linux/arm64); each image is scanned once per platform. | ||
| # Unset scans Trivy's default platform only, which for a multi-arch | ||
| # index is linux/amd64. | ||
| # | ||
| # Exit codes: 0 = every image clean; 1 = at least one image failed; | ||
| # 2 = no image given | ||
| set -euo pipefail | ||
|
|
||
| if [[ $# -eq 0 ]]; then | ||
| echo "usage: $0 IMAGE [IMAGE...]" >&2 | ||
| exit 2 | ||
| fi | ||
|
|
||
| trivy_bin="${TRIVY:-trivy}" | ||
| platforms=("") | ||
| if [[ -n "${TRIVY_PLATFORMS:-}" ]]; then | ||
| IFS=',' read -r -a platforms <<<"$TRIVY_PLATFORMS" | ||
| fi | ||
| failed=() | ||
| scans=0 | ||
|
|
||
| for img in "$@"; do | ||
| for platform in "${platforms[@]}"; do | ||
| label="$img" | ||
| platform_args=() | ||
| if [[ -n "$platform" ]]; then | ||
| label="${img} (${platform})" | ||
| platform_args=(--platform "$platform") | ||
| fi | ||
| scans=$((scans + 1)) | ||
| echo "::group::trivy ${label}" | ||
| if "$trivy_bin" image "${platform_args[@]}" --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 --no-progress "$img"; then | ||
| echo "✓ ${label}" | ||
| else | ||
| failed+=("$label") | ||
| fi | ||
| echo "::endgroup::" | ||
| done | ||
| done | ||
|
|
||
| if [[ ${#failed[@]} -gt 0 ]]; then | ||
| printf '✗ fixed HIGH/CRITICAL vulnerabilities (or a scan error) in %d of %d scan(s):\n' "${#failed[@]}" "$scans" >&2 | ||
| printf ' %s\n' "${failed[@]}" >&2 | ||
| exit 1 | ||
| fi | ||
| echo "✓ ${scans} scan(s) clean" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.