mirror of
https://github.com/kasmtech/workspaces-core-images.git
synced 2024-11-25 08:53:12 +01:00
36 lines
974 B
Plaintext
36 lines
974 B
Plaintext
|
#!/bin/bash
|
||
|
|
|
||
|
|
set -eo pipefail
|
||
|
|
|
||
|
|
build_report() {
|
||
|
|
$trivy_cmd --exit-code 0 --format template --template "@/$trivy_dir/contrib/junit.tpl" -o "$source_dir/trivy-report.xml" "$target"
|
||
|
|
#$trivy_cmd --exit-code 0 --format json -o "$source_dir/report.json" "$target"
|
||
|
|
}
|
||
|
|
|
||
|
|
print_report_and_fail_on_vulnerabilities() {
|
||
|
|
$trivy_cmd --exit-code 1 "$target"
|
||
|
|
}
|
||
|
|
|
||
|
|
scan_cmd="$1"
|
||
|
|
target="$2"
|
||
|
|
if [[ -z "$scan_cmd" || -z "$target" ]]; then
|
||
|
|
echo >&2 "Usage: $(basename "$0") <repo|image> <target>"
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
|
||
|
|
case "$scan_cmd" in
|
||
|
|
repo) options="--scanners config,secret,vuln" ;;
|
||
|
|
image) options="--scanners vuln" ;;
|
||
|
|
*) options="--scanners vuln,config,secret" ;;
|
||
|
|
esac
|
||
|
|
|
||
|
|
set -u
|
||
|
|
set -x
|
||
|
|
|
||
|
|
SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
|
||
|
|
trivy_dir="${SCRIPT_DIR}/trivy"
|
||
|
|
trivy_cmd="$trivy_dir/trivy $scan_cmd --no-progress --cache-dir $HOME/.trivycache $options"
|
||
|
|
source_dir="${CI_PROJECT_DIR:-$trivy_dir}"
|
||
|
|
|
||
|
|
build_report
|
||
|
|
#print_report_and_fail_on_vulnerabilities
|