feat: add modular scanners #261

anubhav06 · 2023-08-21T13:29:16Z

Added support for modular scanners.

Closes #59

Overview

Trivy remains the default scanner.
If someone wants to use vulnerability data from other scanners, they can utilize plugins.
Plugins can be written and used for using vulnerability data of other scanners. The plugin is an executable binary and must be available on the $PATH for copa to execute.
The command which can be used to invoke a plugin is as follows:

copa patch --scanner copa-grype -i docker.io/library/nginx:1.21.6 -r nginx.1.21.6.json -t nginx.1.21.6-patched

I've written the Grype plugin, which can be used for patching grype produced results:
copa-grype plugin: https://github.com/anubhav06/copa-grype

How does it Work?

The plugin takes the image vuln report path as an argument.
The plugin then parses the report and outputs in a format supported by copa (Update Manifest struct)
Copa executes the plugin specified by the user, and captures the output of the plugin, thereby having access to the required updates. It then simply passes this info further to the copa patching process.

How to Test?

Build the copa-grype plugin to produce a binary called copa-grype
Then execute copa(this version of PR) with the following command:

copa patch --scanner /path/to/copa-grype -i <image> -r <grype-results>

After adding the copa-grype binary to PATH:

codecov · 2023-08-21T13:32:06Z

Codecov Report

Attention: 52 lines in your changes are missing coverage. Please review.

Comparison is base (d514256) 32.50% compared to head (bdcacab) 33.02%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #261      +/-   ##
==========================================
+ Coverage   32.50%   33.02%   +0.51%     
==========================================
  Files          17       17              
  Lines        1572     1626      +54     
==========================================
+ Hits          511      537      +26     
- Misses       1032     1060      +28     
  Partials       29       29

Files	Coverage Δ
pkg/vex/openvex.go	`88.88% <100.00%> (ø)`
pkg/vex/vex.go	`78.57% <100.00%> (ø)`
pkg/patch/cmd.go	`48.88% <50.00%> (+0.05%)`	⬆️
pkg/buildkit/buildkit.go	`0.00% <0.00%> (ø)`
pkg/pkgmgr/apk.go	`51.49% <33.33%> (ø)`
pkg/report/trivy.go	`78.43% <89.47%> (+2.11%)`	⬆️
pkg/pkgmgr/dpkg.go	`33.21% <70.00%> (ø)`
pkg/pkgmgr/rpm.go	`33.76% <57.14%> (ø)`
pkg/pkgmgr/pkgmgr.go	`12.98% <0.00%> (ø)`
pkg/patch/patch.go	`6.03% <0.00%> (-0.33%)`	⬇️
... and 1 more

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Signed-off-by: Anubhav Gupta <mail.anubhav06@gmail.com>

anubhav06 · 2023-10-03T11:03:07Z

The owner in https://github.com/anubhav06/copa-grype will need to be changed from anubhav06 to project-copacetic

sozercan · 2023-10-03T21:02:22Z

The owner in anubhav06/copa-grype will need to be changed from anubhav06 to project-copacetic

@anubhav06 This is the motivation of the modular scanners so we don't have to (unless we want to officially support an integration). However, we should add a doc to document existing integrations (example: https://open-policy-agent.github.io/gatekeeper/website/docs/externaldata#providers-maintained-by-the-community)

Looks like there are a few conflicts now, can you please resolve them?

sozercan · 2023-10-03T21:37:38Z

pkg/report/report.go

@@ -21,7 +23,36 @@ type ScanReportParser interface {
 	Parse(string) (*types.UpdateManifest, error)
 }

-func TryParseScanReport(file string) (*types.UpdateManifest, error) {
+func TryParseScanReport(file, scanner string) (*types.UpdateManifest, error) {


can you add a test provider (you can use/reference existing trivy code) and make sure to add e2e tests for testing this integration

example concept: https://github.com/open-policy-agent/gatekeeper/tree/master/test/externaldata/dummy-provider

just to confirm, I should add a provider file similar to https://github.com/open-policy-agent/gatekeeper/blob/master/test/externaldata/dummy-provider/provider.go right? sorry if this is a silly question as I'm new to test providers

no worries! we don't need the same or similar code (just the concept). if we can turn trivy into a test provider without duplicating code, i think that would be ideal so we can make sure to test the provider call flow.

can you please check my new commits regarding tests, is it what is expected?

yes! this is great for now. we can do a follow up to integrate https://github.com/project-copacetic/scanner-parser-template/ to test success cases into e2e

as a follow up, we'll need:

go install https://github.com/project-copacetic/scanner-parser-template in github actions e2e

run with a fake report

make sure copa can call and receive results from the plugin

@sozercan in order to go install, we will need a release of the scanner-plugin-template, right?
We can also install using something like:

curl -sfL https://github.com/project-copacetic/scanner-plugin-template/releases/download/v${SCANNER_PLUGIN_TEMPLATE_VERSION}/scanner-plugin-template_${SCANNER_PLUGIN_TEMPLATE_VERSION}_Linux-64bit.tar.gz -o scanner-plugin-template.tar.gz sudo tar -zxvf scanner-plugin-template.tar.gz -C /usr/local/bin/ rm scanner-plugin-template.tar.gz

similar to how other tools are installed in the copa CI, however even that would require a release of the fake-plugin.

sozercan · 2023-10-04T00:24:41Z

@anubhav06 looks like this is not working for me

export IMAGE=docker.io/library/nginx:1.21.6
copa patch -i $IMAGE -r grype.json --scanner copa-grype
Error: error parsing scanner output: invalid character 'E' looking for beginning of value

I ran grype (v0.69.1) with

grype $IMAGE -o json --file grype.json

seems like descriptor.name is empty?

 "descriptor": {
  "name": "",

pkg/report/report.go

pkg/patch/cmd.go

pkg/report/report.go

anubhav06 · 2023-10-04T07:37:42Z

@anubhav06 This is the motivation of the modular scanners so we don't have to (unless we want to officially support an integration). However, we should add a doc to document existing integrations (example: https://open-policy-agent.github.io/gatekeeper/website/docs/externaldata#providers-maintained-by-the-community)

Oh ok understood. That's interesting. I'll add the docs as well, once this PR is complete and merged.

anubhav06 · 2023-10-04T07:41:44Z

@anubhav06 looks like this is not working for me

This is because in the new version of grype (v0.69.1) which you are using, it seems they have removed "grype" from descriptor.name. I had tested this with v0.64.2, in that version descriptor.name used to have the value "grype".

It's strange as to why did they remove this in the new version, I'll look into this and will get back with a solution 👍

Update:
I checked with the team on slack and they say this isn't intentional. I've opened a bug report on grype for it anchore/grype#1538 and it should be fixed soon.

Signed-off-by: Anubhav Gupta <mail.anubhav06@gmail.com>

…into modular-scanners Signed-off-by: Anubhav Gupta <mail.anubhav06@gmail.com>

anubhav06 · 2023-10-05T22:36:05Z

For testing:

Download the newer version of copa-grype: https://github.com/anubhav06/copa-grype
Add "grype" to descriptor.name field of your grype output. (until the grype bug is fixed)

Update: The grype bug is fixed and there should be a new release of grype soon

Signed-off-by: Anubhav Gupta <mail.anubhav06@gmail.com>

pkg/report/provider.go

sozercan

see comment

pkg/report/report.go

Signed-off-by: Anubhav Gupta <mail.anubhav06@gmail.com>

…into modular-scanners

Signed-off-by: Anubhav Gupta <mail.anubhav06@gmail.com>

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>

sozercan · 2023-10-16T23:05:22Z

@anubhav06 sorry for delay, we had a few CI blockers! i pushed a minor update to your PR so we can get this merged asap, hope that's okay

sozercan

LGTM pending tests

sozercan · 2023-10-16T23:18:34Z

@anubhav06 merged, thank you!

anubhav06 force-pushed the modular-scanners branch from fa8e774 to e36543e Compare August 21, 2023 15:59

anubhav06 mentioned this pull request Aug 24, 2023

draft 2: modular plugins #270

Closed

feat: add modular scanners

b9a770d

Signed-off-by: Anubhav Gupta <mail.anubhav06@gmail.com>

anubhav06 changed the title ~~draft modular scanners~~ feat: add modular scanners Oct 3, 2023

anubhav06 force-pushed the modular-scanners branch from e36543e to b9a770d Compare October 3, 2023 06:04

anubhav06 marked this pull request as ready for review October 3, 2023 06:05

anubhav06 requested review from jeremyrickard, salaxander and sozercan as code owners October 3, 2023 06:05

sozercan reviewed Oct 3, 2023

View reviewed changes

sozercan reviewed Oct 4, 2023

View reviewed changes

pkg/report/report.go Outdated Show resolved Hide resolved

sozercan reviewed Oct 4, 2023

View reviewed changes

pkg/patch/cmd.go Outdated Show resolved Hide resolved

sozercan reviewed Oct 4, 2023

View reviewed changes

pkg/report/report.go Outdated Show resolved Hide resolved

anubhav06 added 3 commits October 5, 2023 12:07

prefix scanners with copa

616ea95

Signed-off-by: Anubhav Gupta <mail.anubhav06@gmail.com>

add tests

7072fd4

Signed-off-by: Anubhav Gupta <mail.anubhav06@gmail.com>

Merge branch 'main' of https://github.com/project-copacetic/copacetic …

eba5049

…into modular-scanners Signed-off-by: Anubhav Gupta <mail.anubhav06@gmail.com>

go fmt

1471213

Signed-off-by: Anubhav Gupta <mail.anubhav06@gmail.com>

sozercan self-requested a review October 5, 2023 22:48

sozercan mentioned this pull request Oct 6, 2023

[DOC] add scanner plugin docs #352

Closed

sozercan reviewed Oct 6, 2023

View reviewed changes

pkg/report/provider.go Outdated Show resolved Hide resolved

sozercan requested changes Oct 6, 2023

View reviewed changes

pkg/report/report.go Outdated Show resolved Hide resolved

sozercan mentioned this pull request Oct 6, 2023

feat: add apiVersion project-copacetic/scanner-plugin-template#3

Merged

add apiVersion support to plugins

71dabda

Signed-off-by: Anubhav Gupta <mail.anubhav06@gmail.com>

anubhav06 added 3 commits October 10, 2023 18:50

remove provider.go

8aff50d

Signed-off-by: Anubhav Gupta <mail.anubhav06@gmail.com>

Merge branch 'main' of https://github.com/project-copacetic/copacetic …

4c6c1e3

…into modular-scanners

fix apiVersion

891f345

Signed-off-by: Anubhav Gupta <mail.anubhav06@gmail.com>

sozercan self-requested a review October 11, 2023 15:59

sozercan added 2 commits October 16, 2023 22:09

Merge branch 'main' into modular-scanners

768561d

minor api change

bdcacab

Signed-off-by: Sertac Ozercan <sozercan@gmail.com>

sozercan approved these changes Oct 16, 2023

View reviewed changes

sozercan merged commit 4eacf06 into project-copacetic:main Oct 16, 2023
16 checks passed

anubhav06 deleted the modular-scanners branch October 17, 2023 17:05

This was referenced Oct 17, 2023

change reference from anubhav06 to project-copacetic kubescape/kubescape#1440

Merged

[REQ] add tests for plugins #387

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add modular scanners #261

feat: add modular scanners #261

anubhav06 commented Aug 21, 2023 •

edited

Loading

codecov bot commented Aug 21, 2023 •

edited

Loading

anubhav06 commented Oct 3, 2023

sozercan commented Oct 3, 2023 •

edited

Loading

sozercan Oct 3, 2023 •

edited

Loading

sozercan Oct 4, 2023

anubhav06 Oct 4, 2023 •

edited

Loading

sozercan Oct 4, 2023 •

edited

Loading

anubhav06 Oct 5, 2023

sozercan Oct 6, 2023

anubhav06 Oct 23, 2023

sozercan commented Oct 4, 2023 •

edited

Loading

anubhav06 commented Oct 4, 2023

anubhav06 commented Oct 4, 2023 •

edited

Loading

anubhav06 commented Oct 5, 2023 •

edited

Loading

sozercan left a comment

sozercan commented Oct 16, 2023

sozercan left a comment

sozercan commented Oct 16, 2023

feat: add modular scanners #261

feat: add modular scanners #261

Conversation

anubhav06 commented Aug 21, 2023 • edited Loading

Overview

How does it Work?

How to Test?

codecov bot commented Aug 21, 2023 • edited Loading

Codecov Report

anubhav06 commented Oct 3, 2023

sozercan commented Oct 3, 2023 • edited Loading

sozercan Oct 3, 2023 • edited Loading

Choose a reason for hiding this comment

sozercan Oct 4, 2023

Choose a reason for hiding this comment

anubhav06 Oct 4, 2023 • edited Loading

Choose a reason for hiding this comment

sozercan Oct 4, 2023 • edited Loading

Choose a reason for hiding this comment

anubhav06 Oct 5, 2023

Choose a reason for hiding this comment

sozercan Oct 6, 2023

Choose a reason for hiding this comment

anubhav06 Oct 23, 2023

Choose a reason for hiding this comment

sozercan commented Oct 4, 2023 • edited Loading

anubhav06 commented Oct 4, 2023

anubhav06 commented Oct 4, 2023 • edited Loading

anubhav06 commented Oct 5, 2023 • edited Loading

sozercan left a comment

Choose a reason for hiding this comment

sozercan commented Oct 16, 2023

sozercan left a comment

Choose a reason for hiding this comment

sozercan commented Oct 16, 2023

anubhav06 commented Aug 21, 2023 •

edited

Loading

codecov bot commented Aug 21, 2023 •

edited

Loading

sozercan commented Oct 3, 2023 •

edited

Loading

sozercan Oct 3, 2023 •

edited

Loading

anubhav06 Oct 4, 2023 •

edited

Loading

sozercan Oct 4, 2023 •

edited

Loading

sozercan commented Oct 4, 2023 •

edited

Loading

anubhav06 commented Oct 4, 2023 •

edited

Loading

anubhav06 commented Oct 5, 2023 •

edited

Loading