Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Circleci: Update nightly trivy scan #930

Merged
merged 15 commits into from
Oct 18, 2023
Merged

Circleci: Update nightly trivy scan #930

Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
0d08f6d
circleci trivy scan
usmansaleem Oct 17, 2023
057f10c
install trivy in home/bin
usmansaleem Oct 17, 2023
20155b4
full docker image name
usmansaleem Oct 17, 2023
0b81224
docker images
usmansaleem Oct 17, 2023
8d8f2a5
setup remote docker
usmansaleem Oct 17, 2023
76dc3ef
docker manifest
usmansaleem Oct 17, 2023
332c7b2
clear cache
usmansaleem Oct 17, 2023
2c173f3
revert clear cache
usmansaleem Oct 17, 2023
cdb799a
use docker tar file
usmansaleem Oct 17, 2023
0492d29
version
usmansaleem Oct 17, 2023
e92c3b9
image reset
usmansaleem Oct 17, 2023
3722004
use image src as docker
usmansaleem Oct 18, 2023
186b548
CircleCI: nightly trivy scan. Scan both amd and arm variants
usmansaleem Oct 18, 2023
e86669f
CircleCI: revert dockerScan for debugging
usmansaleem Oct 18, 2023
6606c3f
Merge remote-tracking branch 'upstream/master' into trivy_scan
usmansaleem Oct 18, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 5 additions & 13 deletions .circleci/config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ executors:

trivy_executor:
docker:
- image: docker:stable-git
- image: cimg/base:current
auth:
<<: *docker-auth
resource_class: small
Expand Down Expand Up @@ -312,24 +312,16 @@ jobs:
executor: trivy_executor
steps:
- prepare
- setup_remote_docker:
docker_layer_caching: false
- run:
name: Install trivy
command: |
apk add --update-cache --upgrade curl bash
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
# remove the test files and only use the folder names
command: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b $HOME/bin
# scan both develop-arm64 and develop-amd64 images using remote src.
- run:
name: Scan with trivy
shell: /bin/sh
command: |
rm -rf docker/test*
for FILE in $(ls docker)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What were the previous values of $FILE?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we used to have docker/jdk17/Dockerfile and docker/jdk11/Dockerfile. Hence we used to create/publish consensys/web3signer:develop-java11 and consensys/web3signer:develop-java17. Since we now default to java17 variant, the develop tag now points to develop-java17. In addition, we further publish platform specific variants as well i.e. develop-amd64 and develop-arm64. Similarly, develop-java17-amd64 and develop-java17-arm64

In summary, we only need to test/scan develop tag unless we introduce java21 tag along with java17 tag. We were also only scanning develop-amd64 variant in past as CircleCI trivy job runs on Linux amd64 environment. Now we make sure to scan both amd64 and arm64 variants (as both of them are built separately).

do
docker pull -q "consensys/web3signer:develop-$FILE"
trivy -q image --exit-code 1 --no-progress --severity HIGH,CRITICAL --ignorefile "gradle/trivyignore.txt" --timeout 10m "consensys/web3signer:develop-$FILE"
done
$HOME/bin/trivy image consensys/web3signer:develop-arm64 --image-src remote --exit-code 1 --quiet --no-progress --severity HIGH,CRITICAL --ignorefile "gradle/trivyignore.txt" --timeout 10m
jframe marked this conversation as resolved.
Show resolved Hide resolved
$HOME/bin/trivy image consensys/web3signer:develop-amd64 --image-src remote --exit-code 1 --quiet --no-progress --severity HIGH,CRITICAL --ignorefile "gradle/trivyignore.txt" --timeout 10m
- notify

publishOpenApiSpec:
Expand Down