chore(docker-jans): add support for extra build/scan args (#4834)

Former-commit-id: f5eed0a
JanssenProject · May 8, 2023 · 982921f · 982921f
1 parent 328cb3f
commit 982921f
Show file tree

Hide file tree

Showing 10 changed files with 136 additions and 51 deletions.
diff --git a/.gitignore b/.gitignore
@@ -159,3 +159,7 @@ data-sources.json
 .settings
 .classpath
 .project
+
+# scanner reports
+trivy.json
+grype.json
diff --git a/demos/benchmarking/docker-jans-loadtesting-jmeter/Makefile b/demos/benchmarking/docker-jans-loadtesting-jmeter/Makefile
@@ -2,17 +2,26 @@ CN_VERSION?=1.0.13-SNAPSHOT
 IMAGE_NAME=ghcr.io/janssenproject/jans/demo_loadtesting
 DEV_VERSION?=$(shell echo ${CN_VERSION} | cut -d '-' -f 1)_dev
 
+# pass extra build args, i.e. `make build-dev BUILD_ARGS="--no-cache"`
+BUILD_ARGS?=
+
+# pass extra trivy args, i.e. `make trivy-scan TRIVY_ARGS="-f json"`
+TRIVY_ARGS?=
+
+# pass extra grype args, i.e. `make grype-scan GRYPE_ARGS="-o json"`
+GRYPE_ARGS?=
+
 .PHONY: test clean all build-dev trivy-scan grype-scan
 .DEFAULT_GOAL := build-dev
 
 build-dev:
-	@echo "[I] Building Docker image ${IMAGE_NAME}:${DEV_VERSION}"
-	@docker build --rm --force-rm -t ${IMAGE_NAME}:${DEV_VERSION} .
+	@echo "[I] Building OCI image ${IMAGE_NAME}:${DEV_VERSION}"
+	@docker build --rm --force-rm ${BUILD_ARGS} -t ${IMAGE_NAME}:${DEV_VERSION} .
 
 trivy-scan:
-	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${DEV_VERSION} using trivy"
-	@trivy image --security-checks vuln ${IMAGE_NAME}:${DEV_VERSION}
+	@echo "[I] Scanning OCI image ${IMAGE_NAME}:${DEV_VERSION} using trivy"
+	@trivy image --security-checks vuln ${TRIVY_ARGS} ${IMAGE_NAME}:${DEV_VERSION}
 
 grype-scan:
-	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${DEV_VERSION} using grype"
-	@grype -v ${IMAGE_NAME}:${DEV_VERSION}
+	@echo "[I] Scanning OCI image ${IMAGE_NAME}:${DEV_VERSION} using grype"
+	@grype -v ${GRYPE_ARGS} ${IMAGE_NAME}:${DEV_VERSION}
diff --git a/docker-jans-auth-server/Makefile b/docker-jans-auth-server/Makefile
@@ -2,17 +2,26 @@ CN_VERSION?=1.0.13-SNAPSHOT
 IMAGE_NAME=ghcr.io/janssenproject/jans/auth-server
 DEV_VERSION?=$(shell echo ${CN_VERSION} | cut -d '-' -f 1)_dev
 
+# pass extra build args, i.e. `make build-dev BUILD_ARGS="--no-cache"`
+BUILD_ARGS?=
+
+# pass extra trivy args, i.e. `make trivy-scan TRIVY_ARGS="-f json"`
+TRIVY_ARGS?=
+
+# pass extra grype args, i.e. `make grype-scan GRYPE_ARGS="-o json"`
+GRYPE_ARGS?=
+
 .PHONY: test clean all build-dev trivy-scan grype-scan
 .DEFAULT_GOAL := build-dev
 
 build-dev:
-	@echo "[I] Building Docker image ${IMAGE_NAME}:${DEV_VERSION}"
-	@docker build --rm --force-rm -t ${IMAGE_NAME}:${DEV_VERSION} .
+	@echo "[I] Building OCI image ${IMAGE_NAME}:${DEV_VERSION}"
+	@docker build --rm --force-rm ${BUILD_ARGS} -t ${IMAGE_NAME}:${DEV_VERSION} .
 
 trivy-scan:
-	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${DEV_VERSION} using trivy"
-	@trivy image --security-checks vuln ${IMAGE_NAME}:${DEV_VERSION}
+	@echo "[I] Scanning OCI image ${IMAGE_NAME}:${DEV_VERSION} using trivy"
+	@trivy image --security-checks vuln ${TRIVY_ARGS} ${IMAGE_NAME}:${DEV_VERSION}
 
 grype-scan:
-	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${DEV_VERSION} using grype"
-	@grype -v ${IMAGE_NAME}:${DEV_VERSION}
+	@echo "[I] Scanning OCI image ${IMAGE_NAME}:${DEV_VERSION} using grype"
+	@grype -v ${GRYPE_ARGS} ${IMAGE_NAME}:${DEV_VERSION}
diff --git a/docker-jans-certmanager/Makefile b/docker-jans-certmanager/Makefile
@@ -2,17 +2,26 @@ CN_VERSION?=1.0.13-SNAPSHOT
 IMAGE_NAME=ghcr.io/janssenproject/jans/certmanager
 DEV_VERSION?=$(shell echo ${CN_VERSION} | cut -d '-' -f 1)_dev
 
+# pass extra build args, i.e. `make build-dev BUILD_ARGS="--no-cache"`
+BUILD_ARGS?=
+
+# pass extra trivy args, i.e. `make trivy-scan TRIVY_ARGS="-f json"`
+TRIVY_ARGS?=
+
+# pass extra grype args, i.e. `make grype-scan GRYPE_ARGS="-o json"`
+GRYPE_ARGS?=
+
 .PHONY: test clean all build-dev trivy-scan grype-scan
 .DEFAULT_GOAL := build-dev
 
 build-dev:
-	@echo "[I] Building Docker image ${IMAGE_NAME}:${DEV_VERSION}"
-	@docker build --rm --force-rm -t ${IMAGE_NAME}:${DEV_VERSION} .
+	@echo "[I] Building OCI image ${IMAGE_NAME}:${DEV_VERSION}"
+	@docker build --rm --force-rm ${BUILD_ARGS} -t ${IMAGE_NAME}:${DEV_VERSION} .
 
 trivy-scan:
-	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${DEV_VERSION} using trivy"
-	@trivy image --security-checks vuln ${IMAGE_NAME}:${DEV_VERSION}
+	@echo "[I] Scanning OCI image ${IMAGE_NAME}:${DEV_VERSION} using trivy"
+	@trivy image --security-checks vuln ${TRIVY_ARGS} ${IMAGE_NAME}:${DEV_VERSION}
 
 grype-scan:
-	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${DEV_VERSION} using grype"
-	@grype -v ${IMAGE_NAME}:${DEV_VERSION}
+	@echo "[I] Scanning OCI image ${IMAGE_NAME}:${DEV_VERSION} using grype"
+	@grype -v ${GRYPE_ARGS} ${IMAGE_NAME}:${DEV_VERSION}
diff --git a/docker-jans-config-api/Makefile b/docker-jans-config-api/Makefile
@@ -2,17 +2,26 @@ CN_VERSION?=1.0.13-SNAPSHOT
 IMAGE_NAME=ghcr.io/janssenproject/jans/config-api
 DEV_VERSION?=$(shell echo ${CN_VERSION} | cut -d '-' -f 1)_dev
 
+# pass extra build args, i.e. `make build-dev BUILD_ARGS="--no-cache"`
+BUILD_ARGS?=
+
+# pass extra trivy args, i.e. `make trivy-scan TRIVY_ARGS="-f json"`
+TRIVY_ARGS?=
+
+# pass extra grype args, i.e. `make grype-scan GRYPE_ARGS="-o json"`
+GRYPE_ARGS?=
+
 .PHONY: test clean all build-dev trivy-scan grype-scan
 .DEFAULT_GOAL := build-dev
 
 build-dev:
-	@echo "[I] Building Docker image ${IMAGE_NAME}:${DEV_VERSION}"
-	@docker build --rm --force-rm -t ${IMAGE_NAME}:${DEV_VERSION} .
+	@echo "[I] Building OCI image ${IMAGE_NAME}:${DEV_VERSION}"
+	@docker build --rm --force-rm ${BUILD_ARGS} -t ${IMAGE_NAME}:${DEV_VERSION} .
 
 trivy-scan:
-	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${DEV_VERSION} using trivy"
-	@trivy image --security-checks vuln ${IMAGE_NAME}:${DEV_VERSION}
+	@echo "[I] Scanning OCI image ${IMAGE_NAME}:${DEV_VERSION} using trivy"
+	@trivy image --security-checks vuln ${TRIVY_ARGS} ${IMAGE_NAME}:${DEV_VERSION}
 
 grype-scan:
-	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${DEV_VERSION} using grype"
-	@grype -v ${IMAGE_NAME}:${DEV_VERSION}
+	@echo "[I] Scanning OCI image ${IMAGE_NAME}:${DEV_VERSION} using grype"
+	@grype -v ${GRYPE_ARGS} ${IMAGE_NAME}:${DEV_VERSION}
diff --git a/docker-jans-configurator/Makefile b/docker-jans-configurator/Makefile
@@ -2,17 +2,26 @@ CN_VERSION?=1.0.13-SNAPSHOT
 IMAGE_NAME=ghcr.io/janssenproject/jans/configurator
 DEV_VERSION?=$(shell echo ${CN_VERSION} | cut -d '-' -f 1)_dev
 
+# pass extra build args, i.e. `make build-dev BUILD_ARGS="--no-cache"`
+BUILD_ARGS?=
+
+# pass extra trivy args, i.e. `make trivy-scan TRIVY_ARGS="-f json"`
+TRIVY_ARGS?=
+
+# pass extra grype args, i.e. `make grype-scan GRYPE_ARGS="-o json"`
+GRYPE_ARGS?=
+
 .PHONY: test clean all build-dev trivy-scan grype-scan
 .DEFAULT_GOAL := build-dev
 
 build-dev:
-	@echo "[I] Building Docker image ${IMAGE_NAME}:${DEV_VERSION}"
-	@docker build --rm --force-rm -t ${IMAGE_NAME}:${DEV_VERSION} .
+	@echo "[I] Building OCI image ${IMAGE_NAME}:${DEV_VERSION}"
+	@docker build --rm --force-rm ${BUILD_ARGS} -t ${IMAGE_NAME}:${DEV_VERSION} .
 
 trivy-scan:
-	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${DEV_VERSION} using trivy"
-	@trivy image --security-checks vuln ${IMAGE_NAME}:${DEV_VERSION}
+	@echo "[I] Scanning OCI image ${IMAGE_NAME}:${DEV_VERSION} using trivy"
+	@trivy image --security-checks vuln ${TRIVY_ARGS} ${IMAGE_NAME}:${DEV_VERSION}
 
 grype-scan:
-	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${DEV_VERSION} using grype"
-	@grype -v ${IMAGE_NAME}:${DEV_VERSION}
+	@echo "[I] Scanning OCI image ${IMAGE_NAME}:${DEV_VERSION} using grype"
+	@grype -v ${GRYPE_ARGS} ${IMAGE_NAME}:${DEV_VERSION}
diff --git a/docker-jans-fido2/Makefile b/docker-jans-fido2/Makefile
@@ -2,17 +2,26 @@ CN_VERSION?=1.0.13-SNAPSHOT
 IMAGE_NAME=ghcr.io/janssenproject/jans/fido2
 DEV_VERSION?=$(shell echo ${CN_VERSION} | cut -d '-' -f 1)_dev
 
+# pass extra build args, i.e. `make build-dev BUILD_ARGS="--no-cache"`
+BUILD_ARGS?=
+
+# pass extra trivy args, i.e. `make trivy-scan TRIVY_ARGS="-f json"`
+TRIVY_ARGS?=
+
+# pass extra grype args, i.e. `make grype-scan GRYPE_ARGS="-o json"`
+GRYPE_ARGS?=
+
 .PHONY: test clean all build-dev trivy-scan grype-scan
 .DEFAULT_GOAL := build-dev
 
 build-dev:
-	@echo "[I] Building Docker image ${IMAGE_NAME}:${DEV_VERSION}"
-	@docker build --rm --force-rm -t ${IMAGE_NAME}:${DEV_VERSION} .
+	@echo "[I] Building OCI image ${IMAGE_NAME}:${DEV_VERSION}"
+	@docker build --rm --force-rm ${BUILD_ARGS} -t ${IMAGE_NAME}:${DEV_VERSION} .
 
 trivy-scan:
-	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${DEV_VERSION} using trivy"
-	@trivy image --security-checks vuln ${IMAGE_NAME}:${DEV_VERSION}
+	@echo "[I] Scanning OCI image ${IMAGE_NAME}:${DEV_VERSION} using trivy"
+	@trivy image --security-checks vuln ${TRIVY_ARGS} ${IMAGE_NAME}:${DEV_VERSION}
 
 grype-scan:
-	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${DEV_VERSION} using grype"
-	@grype -v ${IMAGE_NAME}:${DEV_VERSION}
+	@echo "[I] Scanning OCI image ${IMAGE_NAME}:${DEV_VERSION} using grype"
+	@grype -v ${GRYPE_ARGS} ${IMAGE_NAME}:${DEV_VERSION}
diff --git a/docker-jans-monolith/Makefile b/docker-jans-monolith/Makefile
@@ -2,17 +2,26 @@ CN_VERSION?=1.0.13-SNAPSHOT
 IMAGE_NAME=ghcr.io/janssenproject/jans/monolith
 DEV_VERSION?=$(shell echo ${CN_VERSION} | cut -d '-' -f 1)_dev
 
+# pass extra build args, i.e. `make build-dev BUILD_ARGS="--no-cache"`
+BUILD_ARGS?=
+
+# pass extra trivy args, i.e. `make trivy-scan TRIVY_ARGS="-f json"`
+TRIVY_ARGS?=
+
+# pass extra grype args, i.e. `make grype-scan GRYPE_ARGS="-o json"`
+GRYPE_ARGS?=
+
 .PHONY: test clean all build-dev trivy-scan grype-scan
 .DEFAULT_GOAL := build-dev
 
 build-dev:
-	@echo "[I] Building Docker image ${IMAGE_NAME}:${DEV_VERSION}"
-	@docker build --rm --force-rm -t ${IMAGE_NAME}:${DEV_VERSION} .
+	@echo "[I] Building OCI image ${IMAGE_NAME}:${DEV_VERSION}"
+	@docker build --rm --force-rm ${BUILD_ARGS} -t ${IMAGE_NAME}:${DEV_VERSION} .
 
 trivy-scan:
-	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${DEV_VERSION} using trivy"
-	@trivy image --security-checks vuln ${IMAGE_NAME}:${DEV_VERSION}
+	@echo "[I] Scanning OCI image ${IMAGE_NAME}:${DEV_VERSION} using trivy"
+	@trivy image --security-checks vuln ${TRIVY_ARGS} ${IMAGE_NAME}:${DEV_VERSION}
 
 grype-scan:
-	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${DEV_VERSION} using grype"
-	@grype -v ${IMAGE_NAME}:${DEV_VERSION}
+	@echo "[I] Scanning OCI image ${IMAGE_NAME}:${DEV_VERSION} using grype"
+	@grype -v ${GRYPE_ARGS} ${IMAGE_NAME}:${DEV_VERSION}
diff --git a/docker-jans-persistence-loader/Makefile b/docker-jans-persistence-loader/Makefile
@@ -2,17 +2,26 @@ CN_VERSION?=1.0.13-SNAPSHOT
 IMAGE_NAME=ghcr.io/janssenproject/jans/persistence-loader
 DEV_VERSION?=$(shell echo ${CN_VERSION} | cut -d '-' -f 1)_dev
 
+# pass extra build args, i.e. `make build-dev BUILD_ARGS="--no-cache"`
+BUILD_ARGS?=
+
+# pass extra trivy args, i.e. `make trivy-scan TRIVY_ARGS="-f json"`
+TRIVY_ARGS?=
+
+# pass extra grype args, i.e. `make grype-scan GRYPE_ARGS="-o json"`
+GRYPE_ARGS?=
+
 .PHONY: test clean all build-dev trivy-scan grype-scan
 .DEFAULT_GOAL := build-dev
 
 build-dev:
-	@echo "[I] Building Docker image ${IMAGE_NAME}:${DEV_VERSION}"
-	@docker build --rm --force-rm -t ${IMAGE_NAME}:${DEV_VERSION} .
+	@echo "[I] Building OCI image ${IMAGE_NAME}:${DEV_VERSION}"
+	@docker build --rm --force-rm ${BUILD_ARGS} -t ${IMAGE_NAME}:${DEV_VERSION} .
 
 trivy-scan:
-	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${DEV_VERSION} using trivy"
-	@trivy image --security-checks vuln ${IMAGE_NAME}:${DEV_VERSION}
+	@echo "[I] Scanning OCI image ${IMAGE_NAME}:${DEV_VERSION} using trivy"
+	@trivy image --security-checks vuln ${TRIVY_ARGS} ${IMAGE_NAME}:${DEV_VERSION}
 
 grype-scan:
-	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${DEV_VERSION} using grype"
-	@grype -v ${IMAGE_NAME}:${DEV_VERSION}
+	@echo "[I] Scanning OCI image ${IMAGE_NAME}:${DEV_VERSION} using grype"
+	@grype -v ${GRYPE_ARGS} ${IMAGE_NAME}:${DEV_VERSION}
diff --git a/docker-jans-scim/Makefile b/docker-jans-scim/Makefile
@@ -2,17 +2,26 @@ CN_VERSION?=1.0.13-SNAPSHOT
 IMAGE_NAME=ghcr.io/janssenproject/jans/scim
 DEV_VERSION?=$(shell echo ${CN_VERSION} | cut -d '-' -f 1)_dev
 
+# pass extra build args, i.e. `make build-dev BUILD_ARGS="--no-cache"`
+BUILD_ARGS?=
+
+# pass extra trivy args, i.e. `make trivy-scan TRIVY_ARGS="-f json"`
+TRIVY_ARGS?=
+
+# pass extra grype args, i.e. `make grype-scan GRYPE_ARGS="-o json"`
+GRYPE_ARGS?=
+
 .PHONY: test clean all build-dev trivy-scan grype-scan
 .DEFAULT_GOAL := build-dev
 
 build-dev:
 	@echo "[I] Building Docker image ${IMAGE_NAME}:${DEV_VERSION}"
-	@docker build --rm --force-rm -t ${IMAGE_NAME}:${DEV_VERSION} .
+	@docker build --rm --force-rm ${BUILD_ARGS} -t ${IMAGE_NAME}:${DEV_VERSION} .
 
 trivy-scan:
 	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${DEV_VERSION} using trivy"
-	@trivy image --security-checks vuln ${IMAGE_NAME}:${DEV_VERSION}
+	@trivy image --security-checks vuln ${TRIVY_ARGS} ${IMAGE_NAME}:${DEV_VERSION}
 
 grype-scan:
 	@echo "[I] Scanning Docker image ${IMAGE_NAME}:${DEV_VERSION} using grype"
-	@grype -v ${IMAGE_NAME}:${DEV_VERSION}
+	@grype -v ${GRYPE_ARGS} ${IMAGE_NAME}:${DEV_VERSION}