@@ -103,58 +103,103 @@ trivy_tmp_dir="$(mktemp -d -p "$PROJECT_ROOT")"
103103
104104trap ' rm -rf "$tmp_dir" "$trivy_tmp_dir"'
105105
106+ # Scan both example and enterprise images
106107for image in " ${IMAGES[@]} " ; do
107- image_ref=" codercom/enterprise-${image} :${TAG} "
108- image_name=" ${image} -${TAG} "
109- output=" ${tmp_dir} /${image} -${TAG} .sarif"
110-
111- if ! docker image inspect " $image_ref " > /dev/null 2>&1 ; then
112- echo " Image '$image_ref ' does not exist locally; skipping" >&2
113- continue
114- fi
115-
116- old_tmpdir=" ${TMPDIR:- } "
117- export TMPDIR=" $trivy_tmp_dir "
118-
119- # The timeout is set to 15 minutes because in Java images it can take a while
120- # to scan JAR files for vulnerabilities.
121- run_trace $DRY_RUN trivy image \
122- --severity CRITICAL,HIGH \
123- --format sarif \
124- --output " $output "
125- --timeout 15m0s \
126- " $image_ref " 2>&1 | indent
127-
128- if [ " $old_tmpdir " = " " ; then
129- unset TMPDIR
108+ # Process example images (primary)
109+ example_image_ref=" codercom/example-${image} :${TAG} "
110+ example_image_name=" example-${image} -${TAG} "
111+ example_output=" ${tmp_dir} /example-${image} -${TAG} .sarif"
112+
113+ if docker image inspect " $example_image_ref " > /dev/null 2>&1 ; then
114+ old_tmpdir=" ${TMPDIR:- } "
115+ export TMPDIR=" $trivy_tmp_dir "
116+
117+ # The timeout is set to 15 minutes because in Java images it can take a while
118+ # to scan JAR files for vulnerabilities.
119+ run_trace $DRY_RUN trivy image \
120+ --severity CRITICAL,HIGH \
121+ --format sarif \
122+ --output " $example_output "
123+ --timeout 15m0s \
124+ " $example_image_ref " 2>&1 | indent
125+
126+ if [ " $old_tmpdir " = " " ; then
127+ unset TMPDIR
128+ else
129+ export TMPDIR=" $old_tmpdir "
130+ fi
131+
132+ if [ $DRY_RUN = false ] && [ -f " $example_output " ; then
133+ # Do substitutions to add extra details to every message. Without these
134+ # substitutions, most messages won't have any information about which image
135+ # the vulnerability was found in.
136+ jq \
137+ " .runs[].tool.driver.name |= \" Trivy ${example_image_name} \" "
138+ " $example_output " > " $example_output .tmp"
139+ mv " $example_output .tmp" " $example_output "
140+ jq \
141+ " .runs[].results[].locations[].physicalLocation.artifactLocation.uri |= \" ${example_image_name} /\" + ."
142+ " $example_output " > " $example_output .tmp"
143+ mv " $example_output .tmp" " $example_output "
144+ jq \
145+ " .runs[].results[].locations[].message.text |= \" ${example_image_name} : \" + ."
146+ " $example_output " > " $example_output .tmp"
147+ mv " $example_output .tmp" " $example_output "
148+ elif [ $DRY_RUN = false ]; then
149+ echo " No SARIF output found for image '$example_image_ref ' at '$example_output '" >&2
150+ exit 1
151+ fi
130152 else
131- export TMPDIR= " $old_tmpdir "
153+ echo " Image ' $example_image_ref ' does not exist locally; skipping " >&2
132154 fi
133155
134- if [ $DRY_RUN = true ]; then
135- continue
136- fi
137-
138- if [ ! -f " $output " ; then
139- echo " No SARIF output found for image '$image_ref ' at '$output '" >&2
140- exit 1
156+ # Process enterprise images (alias)
157+ enterprise_image_ref=" codercom/enterprise-${image} :${TAG} "
158+ enterprise_image_name=" enterprise-${image} -${TAG} "
159+ enterprise_output=" ${tmp_dir} /enterprise-${image} -${TAG} .sarif"
160+
161+ if docker image inspect " $enterprise_image_ref " > /dev/null 2>&1 ; then
162+ old_tmpdir=" ${TMPDIR:- } "
163+ export TMPDIR=" $trivy_tmp_dir "
164+
165+ # The timeout is set to 15 minutes because in Java images it can take a while
166+ # to scan JAR files for vulnerabilities.
167+ run_trace $DRY_RUN trivy image \
168+ --severity CRITICAL,HIGH \
169+ --format sarif \
170+ --output " $enterprise_output "
171+ --timeout 15m0s \
172+ " $enterprise_image_ref " 2>&1 | indent
173+
174+ if [ " $old_tmpdir " = " " ; then
175+ unset TMPDIR
176+ else
177+ export TMPDIR=" $old_tmpdir "
178+ fi
179+
180+ if [ $DRY_RUN = false ] && [ -f " $enterprise_output " ; then
181+ # Do substitutions to add extra details to every message. Without these
182+ # substitutions, most messages won't have any information about which image
183+ # the vulnerability was found in.
184+ jq \
185+ " .runs[].tool.driver.name |= \" Trivy ${enterprise_image_name} \" "
186+ " $enterprise_output " > " $enterprise_output .tmp"
187+ mv " $enterprise_output .tmp" " $enterprise_output "
188+ jq \
189+ " .runs[].results[].locations[].physicalLocation.artifactLocation.uri |= \" ${enterprise_image_name} /\" + ."
190+ " $enterprise_output " > " $enterprise_output .tmp"
191+ mv " $enterprise_output .tmp" " $enterprise_output "
192+ jq \
193+ " .runs[].results[].locations[].message.text |= \" ${enterprise_image_name} : \" + ."
194+ " $enterprise_output " > " $enterprise_output .tmp"
195+ mv " $enterprise_output .tmp" " $enterprise_output "
196+ elif [ $DRY_RUN = false ]; then
197+ echo " No SARIF output found for image '$enterprise_image_ref ' at '$enterprise_output '" >&2
198+ exit 1
199+ fi
200+ else
201+ echo " Image '$enterprise_image_ref ' does not exist locally; skipping" >&2
141202 fi
142-
143- # Do substitutions to add extra details to every message. Without these
144- # substitutions, most messages won't have any information about which image
145- # the vulnerability was found in.
146- jq \
147- " .runs[].tool.driver.name |= \" Trivy ${image_name} \" "
148- " $output " > " $output .tmp"
149- mv " $output .tmp" " $output "
150- jq \
151- " .runs[].results[].locations[].physicalLocation.artifactLocation.uri |= \" ${image_name} /\" + ."
152- " $output " > " $output .tmp"
153- mv " $output .tmp" " $output "
154- jq \
155- " .runs[].results[].locations[].message.text |= \" ${image_name} : \" + ."
156- " $output " > " $output .tmp"
157- mv " $output .tmp" " $output "
158203done
159204
160205# Merge all SARIF files into one.
0 commit comments