securityscanutils

Trivy Security Scanning

Trivy is a security scanning tool which we use to scan our images for vulnerabilities. You can run a trivy scan identical to CI on your own command line by installing trivy and running

trivy image --severity HIGH,CRITICAL quay.io/solo-io/<IMAGE>:<VERSION>

Using securityscanutils

Using the utils here is as easy as using the CLI defined in the cli subdirectory. The snippet below shows the output the said CLI's help command.

The GITHUB_TOKEN environment variable must be set for security scanning to work.

go-utils/securityscan/cli % go run ./run_scan.go help                                                                                                                                            
Usage:
   [command]

Available Commands:
  echo-inputs          Prints out all the state of all inputs (including inputted, defaults, and derived) for debugging purposes
  gen-releases         cache github releases for inputted repository. This is its own command to protect against rate-limiting by github by trying to pull releases too much.
  gen-security-scan-md pull down security scan files from gcloud bucket and generate docs markdown file
  help                 Help about any command
  run-security-scan    runs trivy scans on images from repo specified

Flags:
  -c, --CachedReleasesFile string   The name of the file that contains a list of all releases from the given repository. This file is generated by the 'gen-releases' command, and used by the others.
  -i, --CreateIssues                If true, open/update a Github Issue for each version that has images that have vulnerabilities. Defaults to true. (default true)
  -p, --GenerateCachedReleases      If true, then populate the file specified by the CachedReleasesFile flag with all releases from Github. If false, then the command assumes that the file has already been created and populated.  Should be set to false for testing to avoid rate-limiting by Github. Defaults to true. (default true)
  -f, --ImageFile string            Different release versions may have different images to scan.
                                    To deal with this, the run-security-scan command expects a file input that maps version constraints to images
                                    to be scanned if a version matches that constraint. Constraints must be mutually exclusive.
                                    The file is expected to be a csv, where the first element of each line is the constraint, and every subsequent element
                                    in that line is an image to be scanned if that constraint is matched.
                                    Read https://github.com/Masterminds/semver#checking-version-constraints for more about how to use semver constraints.
      --ImageRepo string            The repository where images to scan are located. Defaults to 'quay.io/solo-io' (default "quay.io/solo-io")
  -m, --MinScannedVersion string    The minimum version of images to scan. If set, will scan every image from this to the present, and will scan all images otherwise
      --RepoOwner string            The owner of the repository to scan. Defaults to 'solo-io' (default "solo-io")
  -r, --TargetRepo string           The repository to scan
  -w, --TargetRepoWritten string    Specify the human readable name of the repository to scan for output purposes.
  -u, --UploadToGithub              Setting this to true will upload any generated sarif files to the github repository endpoint, 
                                    e.g. https://github.com/solo-io/gloo/security/code-scanning
                                    read more here: https://docs.github.com/en/rest/reference/code-scanning.
                                    Defaults to false.
  -h, --help                        help for this command

Use " [command] --help" for more information about a command.