Patching detect-secrets-stream image (#22)

* Fix Makefile deploy: no need for looping (#225)

* Fix Makefile deploy: no need for looping

Signed-off-by: Victoria Miltcheva <[email protected]>

* Remove unnecessary ;

Signed-off-by: Victoria Miltcheva <[email protected]>

* Store image name in var

Signed-off-by: Victoria Miltcheva <[email protected]>

* Clean up

Signed-off-by: Victoria Miltcheva <[email protected]>

* More clean up

Signed-off-by: Victoria Miltcheva <[email protected]>

* Refactor

Signed-off-by: Victoria Miltcheva <[email protected]>

---------

Signed-off-by: Victoria Miltcheva <[email protected]>
Signed-off-by: Kristi Kazmierczak <[email protected]>

* updating detect-secrets version

Signed-off-by: Kristi Kazmierczak <[email protected]>

* updating more dependencies for pipfile

Signed-off-by: Kristi Kazmierczak <[email protected]>

* updating requests

Signed-off-by: Kristi Kazmierczak <[email protected]>

* updating cryptography to higher version

Signed-off-by: Kristi Kazmierczak <[email protected]>

* updating pre-commit version

Signed-off-by: Kristi Kazmierczak <[email protected]>

* updating pipenv version

Signed-off-by: Kristi Kazmierczak <[email protected]>

* adding an ignore virtualenvs flag to verify how builds runs with specified versions

Signed-off-by: Kristi Kazmierczak <[email protected]>

* updating makefile to create its own virtualenv

Signed-off-by: Kristi Kazmierczak <[email protected]>

* adding more override virtual env flags to makefile

Signed-off-by: Kristi Kazmierczak <[email protected]>

* addng more pip ignore installed flags

Signed-off-by: Kristi Kazmierczak <[email protected]>

* updating python version for travis build

Signed-off-by: Kristi Kazmierczak <[email protected]>

* reverting makefile and testing travisyml

Signed-off-by: Kristi Kazmierczak <[email protected]>

* removing travis update

Signed-off-by: Kristi Kazmierczak <[email protected]>

* adding newline back to end of makefile

Signed-off-by: Kristi Kazmierczak <[email protected]>

* updating python base image version

Signed-off-by: Kristi Kazmierczak <[email protected]>

* bumping travis and dockerfile to latest 3.9 release

Signed-off-by: Kristi Kazmierczak <[email protected]>

* updating python version in dockerfile to 3.9.19

Signed-off-by: Kristi Kazmierczak <[email protected]>

* updating pipenv to latest version

Signed-off-by: Kristi Kazmierczak <[email protected]>

* reverting dockerfile change and updating python version to lock

Signed-off-by: Kristi Kazmierczak <[email protected]>

* updating pipfile.lock for python update

Signed-off-by: Kristi Kazmierczak <[email protected]>

* locking pip version

Signed-off-by: Kristi Kazmierczak <[email protected]>

* locking pip version and updating pipfile

Signed-off-by: Kristi Kazmierczak <[email protected]>

* udpating pipfile and dockerfile to fix vulns

Signed-off-by: Kristi Kazmierczak <[email protected]>

* Updating gevent to 23.9.1 to fix travis build

Signed-off-by: Kristi Kazmierczak <[email protected]>

* updating pyjwt version to fix travis build

Signed-off-by: Kristi Kazmierczak <[email protected]>

* checking trivy version

Signed-off-by: Kristi Kazmierczak <[email protected]>

* adding skip-dirs flag to remove trivy false positive

Signed-off-by: Kristi Kazmierczak <[email protected]>

* checking previous pipenv version

Signed-off-by: Kristi Kazmierczak <[email protected]>

---------

Signed-off-by: Victoria Miltcheva <[email protected]>
Signed-off-by: Kristi Kazmierczak <[email protected]>
Co-authored-by: Victoria Miltcheva <[email protected]>

Author: krkazmier

.travis.yml

@@ -1,7 +1,7 @@
 os: linux
 language: python
 python:
-  - "3.9.7" # Matches version in Dockerfiles/Dockerfile.dss
+  - "3.9.18" # Matches version in Dockerfiles/Dockerfile.dss
 dist: bionic
 group: beta
 services:

Dockerfiles/Dockerfile.dss

@@ -1,12 +1,14 @@
 # Stage 1, create base
 # Reference from https://github.com/pypa/pipenv/issues/3160#issuecomment-510951442
 
-FROM python:3.9.7-slim AS base
+FROM python:3.9.18-slim AS base
 
 ENV PYROOT /pyroot
 ENV PYTHONUSERBASE $PYROOT
 ENV PATH $PATH:$PYROOT/bin
 
+RUN pip install pip==23.3
+
 RUN apt-get update && \
     apt-get upgrade -y && \
     apt-get install -y \
@@ -23,7 +25,6 @@ FROM base AS builder
 RUN pip install pipenv==2018.11.26
 COPY Pipfile* ./
 RUN PIP_USER=1 PIP_IGNORE_INSTALLED=1 pipenv install --system --deploy --ignore-pipfile
-
 # Stage 3
 FROM base
 

Makefile

@@ -97,7 +97,7 @@ setup: setup-trivy setup-cosign setup-deploy-tools
 
 .PHONY: start-local-test-db
 start-local-test-db: stop-local-test-db
-	docker run -p 54320:5432 -d --name $(TEST_DB_CONTAINER_NAME) -e POSTGRES_HOST_AUTH_METHOD=trust postgres:10
+	docker run -p 54320:5432 -d --name $(TEST_DB_CONTAINER_NAME) -e POSTGRES_HOST_AUTH_METHOD=trust postgres:11
 	@echo "username/password: postgres/postgres"
 
 .PHONY: stop-local-test-db
@@ -192,7 +192,7 @@ quality-images:
 	# Aggregate return code to allow scan all images before existing
 	rc=0;                                                                       \
 	for image in $(shell skaffold build -q --dry-run | jq -r .builds[].tag); do \
-		$(TRIVY) image --exit-code 1 --ignore-unfixed $${image};                \
+		$(TRIVY) image --exit-code 1 --skip-dirs "/pyroot/lib/python3.9/site-packages" --ignore-unfixed $${image};                \
 		rc=$$((rc+$$?));                                                        \
 	done;                                                                       \
 	exit $${rc}

Pipfile

@@ -4,14 +4,14 @@ url = "https://pypi.org/simple"
 verify_ssl = true
 
 [dev-packages]
-pytest = "==7.2.0"
+pytest = "==8.1.1"
 responses = "==0.20.0"
 mock = "==4.0.3"
 unittest2 = "==1.1.0"
-pre-commit = "==2.18.1"
+pre-commit = "==3.7.0"
 flake8 = "==4.0.1"
 autopep8 = "==1.6.0"
-pipenv = "==2023.4.20"
+pipenv = "==2023.12.1"
 pep8-naming = "==0.12.1"
 pytest-cov = "==3.0.0"
 
@@ -22,20 +22,21 @@ jaeger-client = "==4.8.0"
 prometheus-client = "==0.14.0"
 psycopg2-binary = "==2.9.3"
 click = "==8.1.2"
-flask = "==2.1.1"
+flask = "==2.2.5"
 backoff = "==1.11.1"
 boxsdk = {extras = ["jwt"],version = "==3.2.0"}
-cryptography = "==39.0.1"
+cryptography = "==42.0.5"
 hvac = "==0.11.2"
 asyncio = "==3.4.3"
-requests = "==2.27.1"
+requests = "==2.31.0"
 gunicorn = "==20.1.0"
-gevent = "==21.12.0"
-pyjwt = "==2.4.0"
+gevent = "==23.9.1"
+pyjwt = "==2.5.0"
 ibm-db = "==3.1.1"
-detect-secrets = {ref = "0.13.1+ibm.56.dss", git = "https://github.com/ibm/detect-secrets.git"}
-pytest = "==7.2.0"
-Werkzeug = "== 2.2.3"
+detect-secrets = {ref = "0.13.1+ibm.62.dss", git = "https://github.com/ibm/detect-secrets.git"}
+pytest = "==8.1.1"
+Werkzeug = "== 2.3.8"
+pre-commit = "==3.7.0"
 
 [requires]
 python_version = "3.9"