-
Notifications
You must be signed in to change notification settings - Fork 249
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Signed-off-by: knqyf263 <[email protected]>
- Loading branch information
Showing
4 changed files
with
96 additions
and
228 deletions.
There are no files selected for viewing
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,216 +1,57 @@ | ||
| #!/bin/bash | ||
| set -e | ||
| while getopts "a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:r:s:t:u:v:x:y:z:" o; do | ||
| case "${o}" in | ||
| a) | ||
| export scanType=${OPTARG} | ||
| ;; | ||
| b) | ||
| export format=${OPTARG} | ||
| ;; | ||
| c) | ||
| export template=${OPTARG} | ||
| ;; | ||
| d) | ||
| export exitCode=${OPTARG} | ||
| ;; | ||
| e) | ||
| export ignoreUnfixed=${OPTARG} | ||
| ;; | ||
| f) | ||
| export vulnType=${OPTARG} | ||
| ;; | ||
| g) | ||
| export severity=${OPTARG} | ||
| ;; | ||
| h) | ||
| export output=${OPTARG} | ||
| ;; | ||
| i) | ||
| export imageRef=${OPTARG} | ||
| ;; | ||
| j) | ||
| export scanRef=${OPTARG} | ||
| ;; | ||
| k) | ||
| export skipDirs=${OPTARG} | ||
| ;; | ||
| l) | ||
| export input=${OPTARG} | ||
| ;; | ||
| m) | ||
| export cacheDir=${OPTARG} | ||
| ;; | ||
| n) | ||
| export timeout=${OPTARG} | ||
| ;; | ||
| o) | ||
| export ignorePolicy=${OPTARG} | ||
| ;; | ||
| p) | ||
| export hideProgress=${OPTARG} | ||
| ;; | ||
| q) | ||
| export skipFiles=${OPTARG} | ||
| ;; | ||
| r) | ||
| export listAllPkgs=${OPTARG} | ||
| ;; | ||
| s) | ||
| export scanners=${OPTARG} | ||
| ;; | ||
| t) | ||
| export trivyIgnores=${OPTARG} | ||
| ;; | ||
| u) | ||
| export githubPAT=${OPTARG} | ||
| ;; | ||
| v) | ||
| export trivyConfig=${OPTARG} | ||
| ;; | ||
| x) | ||
| export tfVars=${OPTARG} | ||
| ;; | ||
| y) | ||
| export dockerHost=${OPTARG} | ||
| ;; | ||
| z) | ||
| export limitSeveritiesForSARIF=${OPTARG} | ||
| ;; | ||
| esac | ||
| done | ||
| set -euo pipefail | ||
|
|
||
|
|
||
| scanType=$(echo $scanType | tr -d '\r') | ||
| export artifactRef="${imageRef}" | ||
| if [ "${scanType}" = "repo" ] || [ "${scanType}" = "fs" ] || [ "${scanType}" = "filesystem" ] || [ "${scanType}" = "config" ] || [ "${scanType}" = "rootfs" ] || [ "${scanType}" = "sbom" ];then | ||
| artifactRef=$(echo $scanRef | tr -d '\r') | ||
| fi | ||
| input=$(echo $input | tr -d '\r') | ||
| if [ $input ]; then | ||
| artifactRef="--input $input" | ||
| # Set artifact reference | ||
| scanType="${INPUT_SCAN_TYPE:-image}" | ||
| scanRef="${INPUT_SCAN_REF:-.}" | ||
| if [ -n "${INPUT_IMAGE_REF:-}" ]; then | ||
| scanRef="${INPUT_IMAGE_REF}" # backwards compatibility | ||
| fi | ||
| #trim leading spaces for boolean params | ||
| ignoreUnfixed=$(echo $ignoreUnfixed | tr -d '\r') | ||
| hideProgress=$(echo $hideProgress | tr -d '\r') | ||
| limitSeveritiesForSARIF=$(echo $limitSeveritiesForSARIF | tr -d '\r') | ||
|
|
||
| GLOBAL_ARGS="" | ||
| if [ $cacheDir ];then | ||
| GLOBAL_ARGS="$GLOBAL_ARGS --cache-dir $cacheDir" | ||
| fi | ||
| # Handle trivy ignores | ||
| if [ -n "${INPUT_TRIVYIGNORES:-}" ]; then | ||
| ignorefile="./trivyignores" | ||
|
|
||
| SARIF_ARGS="" | ||
| ARGS="" | ||
| format=$(echo $format | xargs) | ||
| if [ $format ];then | ||
| ARGS="$ARGS --format $format" | ||
| fi | ||
| if [ $template ] ;then | ||
| ARGS="$ARGS --template $template" | ||
| fi | ||
| if [ $exitCode ];then | ||
| ARGS="$ARGS --exit-code $exitCode" | ||
| SARIF_ARGS="$SARIF_ARGS --exit-code $exitCode" | ||
| fi | ||
| if [ "$ignoreUnfixed" == "true" ] && [ "$scanType" != "config" ];then | ||
| ARGS="$ARGS --ignore-unfixed" | ||
| SARIF_ARGS="$SARIF_ARGS --ignore-unfixed" | ||
| fi | ||
| if [ $vulnType ] && [ "$scanType" != "config" ] && [ "$scanType" != "sbom" ];then | ||
| ARGS="$ARGS --vuln-type $vulnType" | ||
| SARIF_ARGS="$SARIF_ARGS --vuln-type $vulnType" | ||
| fi | ||
| if [ $scanners ];then | ||
| ARGS="$ARGS --scanners $scanners" | ||
| SARIF_ARGS="$SARIF_ARGS --scanners $scanners" | ||
| fi | ||
| if [ $severity ];then | ||
| ARGS="$ARGS --severity $severity" | ||
| fi | ||
| if [ $output ];then | ||
| ARGS="$ARGS --output $output" | ||
| fi | ||
| if [ $skipDirs ];then | ||
| for i in $(echo $skipDirs | tr "," "\n") | ||
| do | ||
| ARGS="$ARGS --skip-dirs $i" | ||
| SARIF_ARGS="$SARIF_ARGS --skip-dirs $i" | ||
| done | ||
| fi | ||
| if [ $tfVars ] && [ "$scanType" == "config" ];then | ||
| ARGS="$ARGS --tf-vars $tfVars" | ||
| fi | ||
| # Clear the ignore file if it exists, or create a new empty file | ||
| : > "$ignorefile" | ||
|
|
||
| if [ $trivyIgnores ];then | ||
| for f in $(echo $trivyIgnores | tr "," "\n") | ||
| do | ||
| for f in ${INPUT_TRIVYIGNORES//,/ }; do | ||
| if [ -f "$f" ]; then | ||
| echo "Found ignorefile '${f}':" | ||
| cat "${f}" | ||
| cat "${f}" >> ./trivyignores | ||
| cat "${f}" >> "$ignorefile" | ||
| else | ||
| echo "ERROR: cannot find ignorefile '${f}'." | ||
| echo "ERROR: cannot find ignorefile '${f}'." >&2 | ||
| exit 1 | ||
| fi | ||
| done | ||
| ARGS="$ARGS --ignorefile ./trivyignores" | ||
| fi | ||
| if [ $timeout ];then | ||
| ARGS="$ARGS --timeout $timeout" | ||
| SARIF_ARGS="$SARIF_ARGS --timeout $timeout" | ||
| fi | ||
| if [ $ignorePolicy ];then | ||
| ARGS="$ARGS --ignore-policy $ignorePolicy" | ||
| SARIF_ARGS="$SARIF_ARGS --ignore-policy $ignorePolicy" | ||
| fi | ||
| if [ "$hideProgress" == "true" ];then | ||
| ARGS="$ARGS --quiet" | ||
| SARIF_ARGS="$SARIF_ARGS --quiet" | ||
| fi | ||
| if [ $dockerHost ];then | ||
| ARGS="$ARGS --docker-host $dockerHost" | ||
| export TRIVY_IGNOREFILE="$ignorefile" | ||
| fi | ||
|
|
||
| listAllPkgs=$(echo $listAllPkgs | tr -d '\r') | ||
| if [ "$listAllPkgs" == "true" ];then | ||
| ARGS="$ARGS --list-all-pkgs" | ||
| fi | ||
| if [ "$skipFiles" ];then | ||
| for i in $(echo $skipFiles | tr "," "\n") | ||
| do | ||
| ARGS="$ARGS --skip-files $i" | ||
| SARIF_ARGS="$SARIF_ARGS --skip-files $i" | ||
| done | ||
| # Handle SARIF | ||
| if [ "${TRIVY_FORMAT:-}" = "sarif" ]; then | ||
| if [ "${INPUT_LIMIT_SEVERITIES_FOR_SARIF:-false,,}" != "true" ]; then | ||
| echo "Building SARIF report with all severities" | ||
| unset TRIVY_SEVERITY | ||
| else | ||
| echo "Building SARIF report" | ||
| fi | ||
| fi | ||
|
|
||
| trivyConfig=$(echo $trivyConfig | tr -d '\r') | ||
| # To make sure that uploda GitHub Dependency Snapshot succeeds, disable the script that fails first. | ||
| set +e | ||
| if [ "${format}" == "sarif" ] && [ "${limitSeveritiesForSARIF}" != "true" ]; then | ||
| # SARIF is special. We output all vulnerabilities, | ||
| # regardless of severity level specified in this report. | ||
| # This is a feature, not a bug :) | ||
| echo "Building SARIF report with options: ${SARIF_ARGS}" "${artifactRef}" | ||
| trivy --quiet ${scanType} --format sarif --output ${output} $SARIF_ARGS ${artifactRef} | ||
| elif [ $trivyConfig ]; then | ||
| echo "Running Trivy with trivy.yaml config from: " $trivyConfig | ||
| trivy --config $trivyConfig ${scanType} ${artifactRef} | ||
| else | ||
| echo "Running trivy with options: trivy ${scanType} ${ARGS}" "${artifactRef}" | ||
| echo "Global options: " "${GLOBAL_ARGS}" | ||
| trivy $GLOBAL_ARGS ${scanType} ${ARGS} ${artifactRef} | ||
| fi | ||
| # Run Trivy | ||
| cmd=(trivy "$scanType" "$scanRef") | ||
| echo "Running Trivy with options: ${cmd[*]}" | ||
| "${cmd[@]}" | ||
| returnCode=$? | ||
|
|
||
| set -e | ||
| if [[ "${format}" == "github" ]]; then | ||
| if [[ "$(echo $githubPAT | xargs)" != "" ]]; then | ||
| if [ "${TRIVY_FORMAT:-}" = "github" ]; then | ||
| if [ -n "${INPUT_GITHUB_PAT:-}" ]; then | ||
| printf "\n Uploading GitHub Dependency Snapshot" | ||
| curl -H 'Accept: application/vnd.github+json' -H "Authorization: token $githubPAT" 'https://api.github.com/repos/'$GITHUB_REPOSITORY'/dependency-graph/snapshots' -d @./$(echo $output | xargs) | ||
| curl -H 'Accept: application/vnd.github+json' -H "Authorization: token ${INPUT_GITHUB_PAT}" \ | ||
| "https://api.github.com/repos/$GITHUB_REPOSITORY/dependency-graph/snapshots" -d @"${TRIVY_OUTPUT:-}" | ||
| else | ||
| printf "\n Failing GitHub Dependency Snapshot. Missing github-pat" | ||
| printf "\n Failing GitHub Dependency Snapshot. Missing github-pat" >&2 | ||
| fi | ||
| fi | ||
|
|
||
| exit $returnCode | ||
| exit $returnCode |