-
Notifications
You must be signed in to change notification settings - Fork 16
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #179 from intelops/sbom-working
sbom-fix
- Loading branch information
Showing
7 changed files
with
246 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,84 @@ | ||
| package main | ||
|
|
||
| import ( | ||
| "bytes" | ||
| "encoding/json" | ||
| "fmt" | ||
| "log" | ||
| "os/exec" | ||
| "sync" | ||
|
|
||
| "github.com/google/uuid" | ||
| "github.com/intelops/kubviz/constants" | ||
| "github.com/intelops/kubviz/model" | ||
| "github.com/nats-io/nats.go" | ||
| "k8s.io/client-go/rest" | ||
| ) | ||
|
|
||
| func publishTrivySbomReport(report model.Sbom, js nats.JetStreamContext, errCh chan error) { | ||
| metrics := model.Reports{ | ||
| ID: uuid.New().String(), | ||
| Report: report, | ||
| } | ||
| metricsJson, _ := json.Marshal(metrics) | ||
| _, err := js.Publish(constants.TRIVY_SBOM_SUBJECT, metricsJson) | ||
| if err != nil { | ||
| errCh <- err | ||
| } | ||
|
|
||
| log.Printf("Trivy report with BomFormat:%v has been published\n", metrics.Report.BomFormat) | ||
| errCh <- nil | ||
| } | ||
|
|
||
| func executeCommandSbom(command string) ([]byte, error) { | ||
| cmd := exec.Command("/bin/sh", "-c", command) | ||
| var outc, errc bytes.Buffer | ||
| cmd.Stdout = &outc | ||
| cmd.Stderr = &errc | ||
|
|
||
| err := cmd.Run() | ||
|
|
||
| if err != nil { | ||
| log.Println("Execute Command Error", err.Error()) | ||
| } | ||
|
|
||
| return outc.Bytes(), err | ||
| } | ||
|
|
||
| func RunTrivySbomScan(config *rest.Config, js nats.JetStreamContext, wg *sync.WaitGroup, errCh chan error) { | ||
| log.Println("trivy sbom run started") | ||
| defer wg.Done() | ||
| images, err := ListImages(config) | ||
|
|
||
| if err != nil { | ||
| log.Printf("failed to list images: %v", err) | ||
| } | ||
| for _, image := range images { | ||
| fmt.Printf("pullable Image %#v\n", image.PullableImage) | ||
|
|
||
| command := fmt.Sprintf("trivy image --format cyclonedx %s %s", image.PullableImage, "--cache-dir /tmp/.cache") | ||
| out, err := executeCommandSbom(command) | ||
|
|
||
| if err != nil { | ||
| log.Printf("Error executing Trivy for image %s: %v", image.PullableImage, err) | ||
| continue // Move on to the next image in case of an error | ||
| } | ||
|
|
||
| // Check if the output is empty or invalid JSON | ||
| if len(out) == 0 { | ||
| log.Printf("Trivy output is empty for image %s", image.PullableImage) | ||
| continue // Move on to the next image | ||
| } | ||
|
|
||
| var report model.Sbom | ||
| err = json.Unmarshal(out, &report) | ||
| if err != nil { | ||
| log.Printf("Error unmarshaling JSON data for image %s: %v", image.PullableImage, err) | ||
| continue // Move on to the next image in case of an error | ||
| } | ||
| log.Println("report", report) | ||
|
|
||
| // Publish the report using the given function | ||
| publishTrivySbomReport(report, js, errCh) | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| package model | ||
|
|
||
| import ( | ||
| "time" | ||
| ) | ||
|
|
||
| type Reports struct { | ||
| ID string | ||
| Report Sbom | ||
| } | ||
|
|
||
| type Sbom struct { | ||
| Schema string `json:"$schema"` | ||
| BomFormat string `json:"bomFormat"` | ||
| SpecVersion string `json:"specVersion"` | ||
| SerialNumber string `json:"serialNumber"` | ||
| Version int `json:"version"` | ||
| Metadata struct { | ||
| Timestamp time.Time `json:"timestamp"` | ||
| Tools []struct { | ||
| Vendor string `json:"vendor"` | ||
| Name string `json:"name"` | ||
| Version string `json:"version"` | ||
| } `json:"tools"` | ||
| Component struct { | ||
| BomRef string `json:"bom-ref"` | ||
| Type string `json:"type"` | ||
| Name string `json:"name"` | ||
| Purl string `json:"purl"` | ||
| Properties []struct { | ||
| Name string `json:"name"` | ||
| Value string `json:"value"` | ||
| } `json:"properties"` | ||
| } `json:"component"` | ||
| } `json:"metadata"` | ||
| Components []struct { | ||
| BomRef string `json:"bom-ref"` | ||
| Type string `json:"type"` | ||
| Name string `json:"name"` | ||
| Version string `json:"version"` | ||
| Properties []struct { | ||
| Name string `json:"name"` | ||
| Value string `json:"value"` | ||
| } `json:"properties"` | ||
| Hashes []struct { | ||
| Alg string `json:"alg"` | ||
| Content string `json:"content"` | ||
| } `json:"hashes,omitempty"` | ||
| Licenses []struct { | ||
| Expression string `json:"expression"` | ||
| } `json:"licenses,omitempty"` | ||
| Purl string `json:"purl,omitempty"` | ||
| } `json:"components"` | ||
| Dependencies []struct { | ||
| Ref string `json:"ref"` | ||
| DependsOn []string `json:"dependsOn"` | ||
| } `json:"dependencies"` | ||
| Vulnerabilities []interface{} `json:"vulnerabilities"` | ||
| } |