Script for checking if there are updates available for keycloak container image

Signed-off-by: stianst <stianst@gmail.com>

Author: stianst

scripts/check-cve-updates-for-keycloak-image.sh

@@ -0,0 +1,61 @@
+#!/bin/bash -e
+
+CONTAINER_TOOL=$( which podman &>/dev/null && echo "podman" || echo "docker" ) 
+ORIGINAL_IMAGE="quay.io/keycloak/keycloak:latest"
+
+cd $(mktemp -d -t kc-container-scan-XXXX)
+
+#cp ~/dev/keycloak/quarkus/container/* .
+
+#mkdir keycloak-empty
+#tar cfvz keycloak-empty.tar.gz keycloak-empty
+
+echo -n "Pulling image: "
+$CONTAINER_TOOL pull -q $ORIGINAL_IMAGE
+
+CONTAINER_VERSION=$($CONTAINER_TOOL image inspect quay.io/keycloak/keycloak:latest | jq -r '.[].Config.Labels.version')
+RELEASE_BRANCH=$(echo $CONTAINER_VERSION | awk -F '.' '{ print "release/"$1"."$2 }')
+
+echo "Container version: $CONTAINER_VERSION"
+echo "Release branch: $RELEASE_BRANCH"
+
+echo ""
+echo -n "Building mock image: "
+
+curl -s -o Dockerfile https://raw.githubusercontent.com/keycloak/keycloak/refs/heads/$RELEASE_BRANCH/quarkus/container/Dockerfile
+curl -s -o ubi-null.sh https://raw.githubusercontent.com/keycloak/keycloak/refs/heads/$RELEASE_BRANCH/quarkus/container/ubi-null.sh
+
+mkdir keycloak-empty
+tar cfz keycloak-empty.tar.gz keycloak-empty
+
+$CONTAINER_TOOL build -q --build-arg KEYCLOAK_DIST=keycloak-empty.tar.gz -t keycloak-scan-tmp .
+
+echo ""
+
+echo -n "Scanning $ORIGINAL_IMAGE: "
+trivy image -q --scanners vuln $ORIGINAL_IMAGE -s MEDIUM,HIGH,CRITICAL --skip-dirs /opt/keycloak --format json > report-current.json
+echo "report-current.json"
+
+echo -n "Scanning mock image: "
+trivy image -q --scanners vuln keycloak-scan-tmp -s MEDIUM,HIGH,CRITICAL --skip-dirs /opt/keycloak --format json > report-updated.json
+echo "report-updated.json"
+
+list_resolved_cves() {
+    for CVE in $(jq -r '.Results[].Vulnerabilities[] | .VulnerabilityID' report-current.json); do
+        jq -e '.Results[].Vulnerabilities[] | select(.VulnerabilityID == "'$CVE'")' report-updated.json &>/dev/null || echo $CVE
+    done
+}
+
+echo ""
+
+RESOLVED_CVES=$(list_resolved_cves)
+
+if [ "$RESOLVED_CVES" == "" ]; then
+    echo "NO FIXES AVAILABLE!"
+else
+    echo "RESOLVED CVEs:"
+    echo "--------------"
+    for CVE in $RESOLVED_CVES; do
+        jq -r '.Results[].Vulnerabilities[] | select(.VulnerabilityID == "'$CVE'") | "\(.VulnerabilityID) (\(.Severity) \(.PkgName))"' report-current.json
+    done
+fi