47 lines
1.3 KiB
Bash
Executable File
47 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Install a pinned Trivy release into a directory, verifying its sha256.
|
|
#
|
|
# Usage: scripts/ci/install_trivy.sh <dest-dir>
|
|
#
|
|
# The binary ends up at <dest-dir>/trivy. To upgrade, bump TRIVY_VERSION and both
|
|
# digests from the release's trivy_<version>_checksums.txt.
|
|
set -euo pipefail
|
|
|
|
TRIVY_VERSION="0.76.0"
|
|
SHA256_X64="e24b1c51293c1b15e4ba8d45bbc7891ba053f90278ec2698f3562c993e145fe7"
|
|
SHA256_ARM64="aab21e677a7b7071fc79f1711480840754c18a1b9d9cefa7ccd06af63a0e8f4c"
|
|
|
|
dest="${1:?usage: install_trivy.sh <dest-dir>}"
|
|
|
|
case "$(uname -m)" in
|
|
x86_64 | amd64)
|
|
arch="64bit"
|
|
expected="${SHA256_X64}"
|
|
;;
|
|
aarch64 | arm64)
|
|
arch="ARM64"
|
|
expected="${SHA256_ARM64}"
|
|
;;
|
|
*)
|
|
echo "unsupported architecture: $(uname -m)" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
archive="trivy_${TRIVY_VERSION}_Linux-${arch}.tar.gz"
|
|
url="https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/${archive}"
|
|
|
|
work="$(mktemp -d)"
|
|
trap 'rm -rf "${work}"' EXIT
|
|
|
|
curl --fail --silent --show-error --location --retry 3 --output "${work}/${archive}" "${url}"
|
|
echo "${expected} ${work}/${archive}" | sha256sum --check --status || {
|
|
echo "sha256 mismatch for ${archive}" >&2
|
|
exit 1
|
|
}
|
|
|
|
mkdir -p "${dest}"
|
|
tar -xzf "${work}/${archive}" -C "${dest}" trivy
|
|
chmod 0755 "${dest}/trivy"
|
|
"${dest}/trivy" version
|