Merge pull request #7 from stackabletech/feat/command_for_upload_sbom

feat: command to upload SBOMs for a release

Author: dervoeti

.github/workflows/upload_sbom_release.yml

@@ -0,0 +1,38 @@
+name: Scan specific release
+on:
+  workflow_dispatch:
+    inputs:
+      release:
+        description: 'Release version to scan'
+        required: true
+        default: '0.0.0-dev'
+
+jobs:
+  scan_release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - name: Init submodules
+        run: git submodule update --init --recursive
+      - name: Set up Cosign
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        with:
+          python-version: 3.11
+      - name: Setup Rust
+        uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2
+        with:
+          toolchain: stable
+      - name: Run image
+        uses: abatilo/actions-poetry@3765cf608f2d4a72178a9fc5b918668e542b89b1 # v4.0.0
+        with:
+          poetry-version: 1.7.1
+      - name: Install CycloneDX CLI
+        run: |
+          curl -sSfL https://github.com/CycloneDX/cyclonedx-cli/releases/download/v0.30.0/cyclonedx-linux-x64 -o /usr/local/bin/cyclonedx
+          chmod +x /usr/local/bin/cyclonedx
+      - name: Install deps
+        run: poetry install
+      - name: Upload SBOMs for release
+        id: scan
+        run: poetry run python stack_scanner/main.py upload-sbom-release ${{ secrets.SECOBSERVE_API_TOKEN }} ${{ github.event.inputs.release }}

stack_scanner/main.py

@@ -10,6 +10,9 @@
 import urllib.parse
 import urllib.request
 
+from typing import Optional
+
+
 excluded_products = [
     "hello-world",
     "java-base",
@@ -264,7 +267,7 @@ def _build_base_env(secobserve_api_token: str, product_name: str, branch_name: s
 _GRYPE_REPORT = "grype.json"
 
 
-def _combined_scan_script(env: dict, mode: str) -> str:
+def _combined_scan_script(env: dict, mode: str, upload_sbom: Optional[bool] = False) -> str:
     """Return a shell script that scans with Trivy and Grype, then uploads results.
 
     Trivy and Grype scan the same target independently, so they are launched
@@ -279,29 +282,33 @@ def _combined_scan_script(env: dict, mode: str) -> str:
 
     The existing per-scanner entrypoints are reused (with ``SO_UPLOAD=false`` so
     they only scan) to avoid duplicating the scanner invocation flags here.
-
-    In ``sbom`` mode the target itself is a CycloneDX SBOM, so it is additionally
-    uploaded to SecObserve. In ``image`` mode there is no SBOM file to upload.
     """
-    script = (
-        "export TRIVY_NO_PROGRESS=true\n"
-        f"SO_UPLOAD=false REPORT_NAME={_TRIVY_REPORT} /entrypoints/entrypoint_trivy_{mode}.sh &\n"
-        "trivy_pid=$!\n"
-        f"SO_UPLOAD=false REPORT_NAME={_GRYPE_REPORT} /entrypoints/entrypoint_grype_{mode}.sh &\n"
-        "grype_pid=$!\n"
-        'wait "$trivy_pid" || echo "WARNING: Trivy scan failed"\n'
-        'wait "$grype_pid" || echo "WARNING: Grype scan failed"\n'
-        f"if [ -f {_TRIVY_REPORT} ]; then SO_FILE_NAME={_TRIVY_REPORT} SO_PARSER_NAME=CycloneDX "
-        'file_upload_observations.sh; else echo "WARNING: no Trivy report to upload"; fi\n'
-        f"if [ -f {_GRYPE_REPORT} ]; then SO_FILE_NAME={_GRYPE_REPORT} SO_PARSER_NAME=CycloneDX "
-        'file_upload_observations.sh; else echo "WARNING: no Grype report to upload"; fi\n'
-    )
-    if mode == "sbom":
-        script += f"SO_FILE_NAME={env.get('TARGET')} file_upload_sbom.sh\n"
+
+    if upload_sbom:
+        if mode == "sbom":
+            script = f"SO_FILE_NAME={env.get('TARGET')} file_upload_sbom.sh\n"
+        else:
+            print(f"Can't upload SBOM because mode is {mode}")
+            script = ""
+    else:
+        script = (
+            "export TRIVY_NO_PROGRESS=true\n"
+            f"SO_UPLOAD=false REPORT_NAME={_TRIVY_REPORT} /entrypoints/entrypoint_trivy_{mode}.sh &\n"
+            "trivy_pid=$!\n"
+            f"SO_UPLOAD=false REPORT_NAME={_GRYPE_REPORT} /entrypoints/entrypoint_grype_{mode}.sh &\n"
+            "grype_pid=$!\n"
+            'wait "$trivy_pid" || echo "WARNING: Trivy scan failed"\n'
+            'wait "$grype_pid" || echo "WARNING: Grype scan failed"\n'
+            f"if [ -f {_TRIVY_REPORT} ]; then SO_FILE_NAME={_TRIVY_REPORT} SO_PARSER_NAME=CycloneDX "
+            'file_upload_observations.sh; else echo "WARNING: no Trivy report to upload"; fi\n'
+            f"if [ -f {_GRYPE_REPORT} ]; then SO_FILE_NAME={_GRYPE_REPORT} SO_PARSER_NAME=CycloneDX "
+            'file_upload_observations.sh; else echo "WARNING: no Grype report to upload"; fi\n'
+        )
+
     return script
 
 
-def _run_combined_scan(env: dict, mode: str) -> None:
+def _run_combined_scan(env: dict, mode: str, upload_sbom: Optional[bool] = False) -> None:
     """Run Trivy and Grype in a single container for one target, then upload."""
     cmd = [
         "docker", "run",
@@ -312,7 +319,7 @@ def _run_combined_scan(env: dict, mode: str) -> None:
     for key, value in env.items():
         cmd.extend(["-e", f"{key}={value}"])
     cmd.append(SECOBSERVE_SCANNER_IMAGE)
-    cmd.extend(["-c", _combined_scan_script(env, mode)])
+    cmd.extend(["-c", _combined_scan_script(env, mode, upload_sbom)])
 
     print(f"docker run (combined trivy+grype, {mode} mode) TARGET={env.get('TARGET')}")
     subprocess.run(cmd)
@@ -429,13 +436,17 @@ def main():
         for release in releases:
             scan_release(secobserve_api_token, release)
         sys.exit(0)
+    elif sys.argv[1] == "upload-sbom-release":
+        secobserve_api_token = sys.argv[2]
+        release = sys.argv[3]
+        scan_release(secobserve_api_token, release, upload_sbom=True)
     else:
         secobserve_api_token = sys.argv[2]
         release = sys.argv[3]
         scan_release(secobserve_api_token, release)
 
 
-def scan_release(secobserve_api_token: str, release: str) -> None:
+def scan_release(secobserve_api_token: str, release: str, upload_sbom: Optional[bool] = False) -> None:
     """Scan all operator and product images of a single SDP release."""
     checkout = "main" if release == DEV_RELEASE else "tags/" + release
 
@@ -500,6 +511,7 @@ def scan_release(secobserve_api_token: str, release: str) -> None:
                 f"{REGISTRY_URL}/sdp/{product_name}:{release}-{arch}",
                 product_name,
                 f"{release}-{arch}",
+                upload_sbom,
             )
 
         if use_conf_py:
@@ -515,6 +527,7 @@ def scan_release(secobserve_api_token: str, release: str) -> None:
                         f"{REGISTRY_URL}/sdp/{product_name}:{product_version}-{arch}",
                         product_name,
                         f"{product_version}-{arch}",
+                        upload_sbom,
                     )
         else:
             for product_name, versions in product_versions.items():
@@ -527,6 +540,7 @@ def scan_release(secobserve_api_token: str, release: str) -> None:
                         f"{REGISTRY_URL}/sdp/{product_name}:{product_version}-{arch}",
                         product_name,
                         f"{product_version}-{arch}",
+                        upload_sbom,
                     )
 
     # Scan additional infrastructure/third-party images using Harbor API tag discovery.
@@ -546,6 +560,7 @@ def scan_image(
     image: str,
     product_name: str,
     branch_name: str,
+    upload_sbom: Optional[bool] = False,
 ) -> None:
     mode = "sbom"
     extract_sbom_cmd = [
@@ -582,7 +597,7 @@ def scan_image(
 
     env = _build_base_env(secobserve_api_token, product_name, branch_name)
     env["TARGET"] = image if mode == "image" else "/tmp/bom.json"
-    _run_combined_scan(env, mode)
+    _run_combined_scan(env, mode, upload_sbom)
 
 
 if __name__ == "__main__":