Skip to content

Commit 68e2141

Browse files
fabriziosestitofabriziosestito
authored
Merge pull request #411 from fabriziosestito/test/pin-vuln-db
test: use fixed vulnerability databases from our registry
2 parents 778dda2 + ee0d204 commit 68e2141

10 files changed

Lines changed: 49 additions & 48 deletions

‎cmd/worker/main.go‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -28,14 +28,18 @@ func main() { //nolint:funlen // This function is intentionally long to keep the
2828
var natsKey string
2929
var natsCA string
3030
var logLevel string
31+
var trivyDBRepository string
32+
var trivyJavaDBRepository string
3133
var runDir string
3234

33-
flag.StringVar(&natsURL, "nats-url", "localhost:4222", "The URL of the NATS server")
35+
flag.StringVar(&natsURL, "nats-url", "localhost:4222", "The URL of the NATS server.")
3436
flag.StringVar(&natsCert, "nats-cert", "/nats/tls/tls.crt", "The path to the NATS client certificate.")
3537
flag.StringVar(&natsKey, "nats-key", "/nats/tls/tls.key", "The path to the NATS client key.")
3638
flag.StringVar(&natsCA, "nats-ca", "/nats/tls/ca.crt", "The path to the NATS CA certificate.")
37-
flag.StringVar(&runDir, "run-dir", "/var/run/worker", "Directory to store temporary files")
38-
flag.StringVar(&logLevel, "log-level", slog.LevelInfo.String(), "Log level")
39+
flag.StringVar(&runDir, "run-dir", "/var/run/worker", "Directory to store temporary files.")
40+
flag.StringVar(&trivyDBRepository, "trivy-db-repository", "public.ecr.aws/aquasecurity/trivy-db", "OCI repository to retrieve trivy-db.")
41+
flag.StringVar(&trivyJavaDBRepository, "trivy-java-db-repository", "public.ecr.aws/aquasecurity/trivy-java-db", "OCI repository to retrieve trivy-java-db.")
42+
flag.StringVar(&logLevel, "log-level", slog.LevelInfo.String(), "Log level.")
3943
flag.Parse()
4044

4145
slogLevel, err := cmdutil.ParseLogLevel(logLevel)
@@ -101,7 +105,7 @@ func main() { //nolint:funlen // This function is intentionally long to keep the
101105
registry := messaging.HandlerRegistry{
102106
handlers.CreateCatalogSubject: handlers.NewCreateCatalogHandler(registryClientFactory, k8sClient, scheme, publisher, logger),
103107
handlers.GenerateSBOMSubject: handlers.NewGenerateSBOMHandler(k8sClient, scheme, runDir, publisher, logger),
104-
handlers.ScanSBOMSubject: handlers.NewScanSBOMHandler(k8sClient, scheme, runDir, logger),
108+
handlers.ScanSBOMSubject: handlers.NewScanSBOMHandler(k8sClient, scheme, runDir, trivyDBRepository, trivyJavaDBRepository, logger),
105109
}
106110
failureHandler := handlers.NewScanJobFailureHandler(k8sClient, logger)
107111

‎internal/handlers/scan_sbom.go‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -37,24 +37,30 @@ const (
3737

3838
// ScanSBOMHandler is responsible for handling SBOM scan requests.
3939
type ScanSBOMHandler struct {
40-
k8sClient client.Client
41-
scheme *runtime.Scheme
42-
workDir string
43-
logger *slog.Logger
40+
k8sClient client.Client
41+
scheme *runtime.Scheme
42+
workDir string
43+
trivyDBRepository string
44+
trivyJavaDBRepository string
45+
logger *slog.Logger
4446
}
4547

4648
// NewScanSBOMHandler creates a new instance of ScanSBOMHandler.
4749
func NewScanSBOMHandler(
4850
k8sClient client.Client,
4951
scheme *runtime.Scheme,
5052
workDir string,
53+
trivyDBRepository string,
54+
trivyJavaDBRepository string,
5155
logger *slog.Logger,
5256
) *ScanSBOMHandler {
5357
return &ScanSBOMHandler{
54-
k8sClient: k8sClient,
55-
scheme: scheme,
56-
workDir: workDir,
57-
logger: logger.With("handler", "scan_sbom_handler"),
58+
k8sClient: k8sClient,
59+
scheme: scheme,
60+
workDir: workDir,
61+
trivyDBRepository: trivyDBRepository,
62+
trivyJavaDBRepository: trivyJavaDBRepository,
63+
logger: logger.With("handler", "scan_sbom_handler"),
5864
}
5965
}
6066

@@ -138,8 +144,8 @@ func (h *ScanSBOMHandler) Handle(ctx context.Context, message []byte) error { //
138144
"--format", "json",
139145
// Use the public ECR repository to bypass GitHub's rate limits.
140146
// Refer to https://github.com/orgs/community/discussions/139074 for details.
141-
"--db-repository", "public.ecr.aws/aquasecurity/trivy-db",
142-
"--java-db-repository", "public.ecr.aws/aquasecurity/trivy-java-db",
147+
"--db-repository", h.trivyDBRepository,
148+
"--java-db-repository", h.trivyJavaDBRepository,
143149
"--output", reportFile.Name(),
144150
}
145151
// Set XDG_DATA_HOME environment variable to /tmp because trivy expects

‎internal/handlers/scan_sbom_test.go‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,11 @@ import (
2222
"sigs.k8s.io/controller-runtime/pkg/client/fake"
2323
)
2424

25+
const (
26+
testTrivyDBRepository = "ghcr.io/rancher-sandbox/sbombastic/test-assets/trivy-db:2"
27+
testTrivyJavaDBRepository = "ghcr.io/rancher-sandbox/sbombastic/test-assets/trivy-java-db:2"
28+
)
29+
2530
func TestScanSBOMHandler_Handle(t *testing.T) {
2631
vexHubServer := fakeVEXHubRepository(t)
2732
vexHubServer.Start()
@@ -163,7 +168,7 @@ func testScanSBOM(t *testing.T, cacheDir, platform, sourceSBOMJSON, expectedRepo
163168
err = json.Unmarshal(reportData, expectedReport)
164169
require.NoError(t, err, "failed to unmarshal expected report file %s", expectedReportJSON)
165170

166-
handler := NewScanSBOMHandler(k8sClient, scheme, cacheDir, slog.Default())
171+
handler := NewScanSBOMHandler(k8sClient, scheme, cacheDir, testTrivyDBRepository, testTrivyJavaDBRepository, slog.Default())
167172

168173
message, err := json.Marshal(&ScanSBOMMessage{
169174
BaseMessage: BaseMessage{

‎test/fixtures/golang-1.12-alpine-386.sbombastic.json‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2105,13 +2105,11 @@
21052105
"https://access.redhat.com/errata/RHSA-2022:8291",
21062106
"https://access.redhat.com/security/cve/CVE-2022-37434",
21072107
"https://bugzilla.redhat.com/2116639",
2108-
"https://bugzilla.redhat.com/show_bug.cgi?id=2053198",
2109-
"https://bugzilla.redhat.com/show_bug.cgi?id=2077431",
2110-
"https://bugzilla.redhat.com/show_bug.cgi?id=2081296",
2108+
"https://bugzilla.redhat.com/show_bug.cgi?id=2043753",
21112109
"https://bugzilla.redhat.com/show_bug.cgi?id=2116639",
21122110
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37434",
21132111
"https://errata.almalinux.org/9/ALSA-2022-8291.html",
2114-
"https://errata.rockylinux.org/RLSA-2022:8291",
2112+
"https://errata.rockylinux.org/RLSA-2022:7793",
21152113
"https://github.com/curl/curl/issues/9271",
21162114
"https://github.com/ivd38/zlib_overflow",
21172115
"https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063",
@@ -2158,4 +2156,4 @@
21582156
]
21592157
}
21602158
]
2161-
}
2159+
}

‎test/fixtures/golang-1.12-alpine-amd64.sbombastic.json‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2105,13 +2105,11 @@
21052105
"https://access.redhat.com/errata/RHSA-2022:8291",
21062106
"https://access.redhat.com/security/cve/CVE-2022-37434",
21072107
"https://bugzilla.redhat.com/2116639",
2108-
"https://bugzilla.redhat.com/show_bug.cgi?id=2053198",
2109-
"https://bugzilla.redhat.com/show_bug.cgi?id=2077431",
2110-
"https://bugzilla.redhat.com/show_bug.cgi?id=2081296",
2108+
"https://bugzilla.redhat.com/show_bug.cgi?id=2043753",
21112109
"https://bugzilla.redhat.com/show_bug.cgi?id=2116639",
21122110
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37434",
21132111
"https://errata.almalinux.org/9/ALSA-2022-8291.html",
2114-
"https://errata.rockylinux.org/RLSA-2022:8291",
2112+
"https://errata.rockylinux.org/RLSA-2022:7793",
21152113
"https://github.com/curl/curl/issues/9271",
21162114
"https://github.com/ivd38/zlib_overflow",
21172115
"https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063",

‎test/fixtures/golang-1.12-alpine-arm-v6.sbombastic.json‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2105,13 +2105,11 @@
21052105
"https://access.redhat.com/errata/RHSA-2022:8291",
21062106
"https://access.redhat.com/security/cve/CVE-2022-37434",
21072107
"https://bugzilla.redhat.com/2116639",
2108-
"https://bugzilla.redhat.com/show_bug.cgi?id=2053198",
2109-
"https://bugzilla.redhat.com/show_bug.cgi?id=2077431",
2110-
"https://bugzilla.redhat.com/show_bug.cgi?id=2081296",
2108+
"https://bugzilla.redhat.com/show_bug.cgi?id=2043753",
21112109
"https://bugzilla.redhat.com/show_bug.cgi?id=2116639",
21122110
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37434",
21132111
"https://errata.almalinux.org/9/ALSA-2022-8291.html",
2114-
"https://errata.rockylinux.org/RLSA-2022:8291",
2112+
"https://errata.rockylinux.org/RLSA-2022:7793",
21152113
"https://github.com/curl/curl/issues/9271",
21162114
"https://github.com/ivd38/zlib_overflow",
21172115
"https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063",
@@ -2158,4 +2156,4 @@
21582156
]
21592157
}
21602158
]
2161-
}
2159+
}

‎test/fixtures/golang-1.12-alpine-arm-v7.sbombastic.json‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2105,13 +2105,11 @@
21052105
"https://access.redhat.com/errata/RHSA-2022:8291",
21062106
"https://access.redhat.com/security/cve/CVE-2022-37434",
21072107
"https://bugzilla.redhat.com/2116639",
2108-
"https://bugzilla.redhat.com/show_bug.cgi?id=2053198",
2109-
"https://bugzilla.redhat.com/show_bug.cgi?id=2077431",
2110-
"https://bugzilla.redhat.com/show_bug.cgi?id=2081296",
2108+
"https://bugzilla.redhat.com/show_bug.cgi?id=2043753",
21112109
"https://bugzilla.redhat.com/show_bug.cgi?id=2116639",
21122110
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37434",
21132111
"https://errata.almalinux.org/9/ALSA-2022-8291.html",
2114-
"https://errata.rockylinux.org/RLSA-2022:8291",
2112+
"https://errata.rockylinux.org/RLSA-2022:7793",
21152113
"https://github.com/curl/curl/issues/9271",
21162114
"https://github.com/ivd38/zlib_overflow",
21172115
"https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063",
@@ -2158,4 +2156,4 @@
21582156
]
21592157
}
21602158
]
2161-
}
2159+
}

‎test/fixtures/golang-1.12-alpine-arm64-v8.sbombastic.json‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2105,13 +2105,11 @@
21052105
"https://access.redhat.com/errata/RHSA-2022:8291",
21062106
"https://access.redhat.com/security/cve/CVE-2022-37434",
21072107
"https://bugzilla.redhat.com/2116639",
2108-
"https://bugzilla.redhat.com/show_bug.cgi?id=2053198",
2109-
"https://bugzilla.redhat.com/show_bug.cgi?id=2077431",
2110-
"https://bugzilla.redhat.com/show_bug.cgi?id=2081296",
2108+
"https://bugzilla.redhat.com/show_bug.cgi?id=2043753",
21112109
"https://bugzilla.redhat.com/show_bug.cgi?id=2116639",
21122110
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37434",
21132111
"https://errata.almalinux.org/9/ALSA-2022-8291.html",
2114-
"https://errata.rockylinux.org/RLSA-2022:8291",
2112+
"https://errata.rockylinux.org/RLSA-2022:7793",
21152113
"https://github.com/curl/curl/issues/9271",
21162114
"https://github.com/ivd38/zlib_overflow",
21172115
"https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063",
@@ -2158,4 +2156,4 @@
21582156
]
21592157
}
21602158
]
2161-
}
2159+
}

‎test/fixtures/golang-1.12-alpine-ppc64le.sbombastic.json‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2105,13 +2105,11 @@
21052105
"https://access.redhat.com/errata/RHSA-2022:8291",
21062106
"https://access.redhat.com/security/cve/CVE-2022-37434",
21072107
"https://bugzilla.redhat.com/2116639",
2108-
"https://bugzilla.redhat.com/show_bug.cgi?id=2053198",
2109-
"https://bugzilla.redhat.com/show_bug.cgi?id=2077431",
2110-
"https://bugzilla.redhat.com/show_bug.cgi?id=2081296",
2108+
"https://bugzilla.redhat.com/show_bug.cgi?id=2043753",
21112109
"https://bugzilla.redhat.com/show_bug.cgi?id=2116639",
21122110
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37434",
21132111
"https://errata.almalinux.org/9/ALSA-2022-8291.html",
2114-
"https://errata.rockylinux.org/RLSA-2022:8291",
2112+
"https://errata.rockylinux.org/RLSA-2022:7793",
21152113
"https://github.com/curl/curl/issues/9271",
21162114
"https://github.com/ivd38/zlib_overflow",
21172115
"https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063",
@@ -2158,4 +2156,4 @@
21582156
]
21592157
}
21602158
]
2161-
}
2159+
}

‎test/fixtures/golang-1.12-alpine-s390x.sbombastic.json‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2105,13 +2105,11 @@
21052105
"https://access.redhat.com/errata/RHSA-2022:8291",
21062106
"https://access.redhat.com/security/cve/CVE-2022-37434",
21072107
"https://bugzilla.redhat.com/2116639",
2108-
"https://bugzilla.redhat.com/show_bug.cgi?id=2053198",
2109-
"https://bugzilla.redhat.com/show_bug.cgi?id=2077431",
2110-
"https://bugzilla.redhat.com/show_bug.cgi?id=2081296",
2108+
"https://bugzilla.redhat.com/show_bug.cgi?id=2043753",
21112109
"https://bugzilla.redhat.com/show_bug.cgi?id=2116639",
21122110
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37434",
21132111
"https://errata.almalinux.org/9/ALSA-2022-8291.html",
2114-
"https://errata.rockylinux.org/RLSA-2022:8291",
2112+
"https://errata.rockylinux.org/RLSA-2022:7793",
21152113
"https://github.com/curl/curl/issues/9271",
21162114
"https://github.com/ivd38/zlib_overflow",
21172115
"https://github.com/madler/zlib/blob/21767c654d31d2dccdde4330529775c6c5fd5389/zlib.h#L1062-L1063",

0 commit comments

Comments
 (0)