40 lines
1.2 KiB
Bash
Executable File
40 lines
1.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Scan a locally built image for known vulnerabilities with Trivy.
|
|
#
|
|
# Usage: scripts/ci/scan_image.sh <image-ref>
|
|
#
|
|
# Fails (exit 1) on HIGH or CRITICAL findings that have a fixed version. Findings
|
|
# without a fix are reported by Trivy but do not fail the scan (nothing can be done
|
|
# about them yet). Accepted findings are listed in security/trivyignore.txt, one
|
|
# vulnerability id per line with a reason, and in docs/security.md. The image is
|
|
# exported with `docker save` so Trivy needs no access to the Docker socket.
|
|
#
|
|
# Trivy itself is pinned (scripts/ci/install_trivy.sh); its vulnerability database
|
|
# is fetched fresh on every run, which is the point of scanning.
|
|
set -euo pipefail
|
|
|
|
image="${1:?usage: scan_image.sh <image-ref>}"
|
|
ignore_file="security/trivyignore.txt"
|
|
|
|
work="$(mktemp -d)"
|
|
trap 'rm -rf "${work}"' EXIT
|
|
|
|
docker save --output "${work}/image.tar" "${image}"
|
|
|
|
args=(
|
|
image
|
|
--input "${work}/image.tar"
|
|
--cache-dir "${work}/cache"
|
|
--scanners vuln
|
|
--severity HIGH,CRITICAL
|
|
--ignore-unfixed
|
|
--exit-code 1
|
|
--no-progress
|
|
--db-repository "ghcr.io/aquasecurity/trivy-db:2,public.ecr.aws/aquasecurity/trivy-db:2"
|
|
)
|
|
if [ -f "${ignore_file}" ]; then
|
|
args+=(--ignorefile "${ignore_file}")
|
|
fi
|
|
|
|
trivy "${args[@]}"
|