Skip to content

Commit c2b1107

Browse files
stefaniukballr73
stefaniuk
and
ballr73
authored
Recipe book for dependency scanning (#262)
Co-authored-by: Robert Ball <[email protected]>
1 parent e23b6a7 commit c2b1107

10 files changed

+731
-0
lines changed

‎practices/security-repository.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,7 @@ Depending on your use case, you may want to create additional teams (e.g. a read
4747
## Code security
4848

4949
- Enable, at a minimum, [Dependabot](https://github.blog/2020-06-01-keep-all-your-packages-up-to-date-with-dependabot/) alerts for vulnerabilities and respond to them appropriately.
50+
- Generate [SBOM (Software Bill of Materials)](../tools/dependency-scan/README.md) for your repository content and all the artefacts that are build as part of the CI/CD process
5051
- Disable ability to push to the default branch for everyone, admins included (`applies-to-admin` option).
5152
- Refer to [Quality Checks](../quality-checks.md) for further code security practices.
5253

‎tools/dependency-scan/.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
sbom*.json
2+
sbom*.xml

‎tools/dependency-scan/Design - Dependency Scan v1.drawio.png

99 KB
Loading

‎tools/dependency-scan/Design.drawio

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
<mxfile host="Electron" modified="2022-07-14T07:40:33.241Z" agent="5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) draw.io/19.0.3 Chrome/102.0.5005.63 Electron/19.0.3 Safari/537.36" etag="udLpUFjxY4F_XWO8Zi_o" version="19.0.3" type="device"><diagram name="Dependency Scan v1" id="MA9I2CS_o0D6G25iCx2h">7VtZc6M4EP41qdp9GBeHAfPo2Dnm2hxOZTL7MiVAxloDYoR87a/fFocNiDi2x1dl1lOTQOvA6u/rptWtXOi9cH7DUDz6Sj0cXGiKN7/Q+xeapuu6Br+EZJFJVFvtZBKfES+XrQQD8i/OhUounRAPJ5WOnNKAk7gqdGkUYZdXZIgxOqt2G9Kg+tQY+VgSDFwUyNJvxOOjXKqa9qrhFhN/lD+6o1lZQ4iKzvlKkhHy6Kwk0q8u9B6jlGdX4byHA6G9Qi94Ft5QK5rZ6Oll/PxwO3l+nn7IJrveZshyCQxHfOepp99mP/vUQr3HTw9m9+qfWTeZ5UOUKQomub7ytfJFoUBGJ5GHxSTKhX45GxGOBzFyResMOAOyEQ8DuFPhckiCoEcDytKx+tAQ/4ScRrwkzz4gTzijY1xqMdMPtHgoGaVPVfObe8Q5ZlEq0ZQ2SDdUS66+KWYcz0ukyNV0g2mIOVtAl7y13c7VUnC+YMBsRSCt6DMqcccshCgnrb+cewUMXOTYbEEBTcLpckLAEl4HS90aLA/hztBtBMXtYGd4QI1rdY2bssaXsrLGO4dSuC4pvI9jDLqNXJjcDOD5lw6DK19cJS6K3gsW7c65YdGWsHjCCX8v+ra0c9O3Ien7BkeYIY5BOri8+7pX1Q+H2HQbVe9ZtqMoR6S6Zp9a9aak+kHqWpTpJBAQOCQgnEA89U4RMNqnRsB6OyKC10BXRKZw5wYoSYhbVW81YsJzwl/yFnH9XchbRn7Xn5e69RfFTQRLeSnflEaJ29Ww9K4Ytx1MCZ0wF6/ply+dI+bjdfPlL0vsVUJxGfQSqEYDpoWM4QBxMq0G8E1A50+4pwSWu+SUodesuh6VZevOR5Uj5vpE9TehXZsoU4w0Ucq75bJ3p2LnfyrWKfYmFdtnRUXdtFt26dOpElPdkZhtW1k/0YGJaR+KmCsyfi/RtJmYJyKYcVYE25uvs4zqRLp5XEoVDN4jp5aOa+WrvldcVbPjSmClvHhORCP8S1wb/+w/qvj6JZqzHz91Y9HrOXdF1uVNrpnnxTWrxjVj1/dqfaIjv1dVOZtyghfrnv2XKXNqgbufPt8/K9MPD1RlffbSR1HBvTPlVFvfkVMdpbaR0I3jckpOUpyAU2cSrLVlLjb6Qe2suGir64I11bZbbVVZfTq7EdU2a85PObLzk7M7RT5zpBb5zHKuUykyEGrRD5676loIPTItRAMUxoHIFcUkxgGJxOWUJBMUkAQAolELBE8jkojvKn4g+D8kTOT0FMJFpgk6wTUdChaNxHgPJ8SPUi4AFWCIuAYVAWGzvpwKJs1B4KWD0oldFGcpk0XRIySc+FkmK5uYkWRcfdRgEseBGNAbISKmRpwjd9wqLb+0WMnKOXyJql1X0yp5SFHOweSiJEYuiXwQGKu7JxqD4IP2WvGFTjEbBqlTGREPMJMcyXbGvXnuRq0S2dKEn6knb9pKg8GCKRmvW+em6ZvYDMdD+77/cmnEz44ROH8nfkNBq/cRJur1U5BwLOfuPTwEinopnZYc+Ot2IEZcRT60YSZQ0ZRrhkI8o2wsT4IKGjvw3JhlFj8EcGFCjMKkoN8kwRJhlpUuARadcGExvWU1VKlyCWzIFzUwF8DEwJ3LADk4uKcJSe2g1CCAJC4KvtQ6cEGoZWs3n8+hnNNQ0G6EYvHFwrkvKsKtGXYC6tOk5YPhTZxDkcmsVYA6MpUsQ2aStQcerQuTyjnw20H3QuTqTXBvAon0p3ATz1cNrEIcOagB7UK/7gJw9jDT307XOpk5f3GWAnBHfmrkdxldCkeTVd9VQ87xYtUzsNWU47VNS0fmIQscNWgbc7xag5vYR4533f6rnGWnQz6DlS/RjZxE/Lok6Wzp2+ErvDYYQUEio/2HqIr8KWOd6ro4dqDV3go1QxNO3B3B3rPlUXcSAgjaK9TIYVZamnHE1Hy7CHHfSs2b5j68+7qAsQRcq9WS1L5VLQSU7xFQXZ8wcLiZi8Qo4QfUrH3Kil+jXjfYvGx1DGSNUs+n8FqHwdKtxgBGxqGebt0bDnJs/hnDt+vuMcgsAogAD3lDHBBCDCke0ohwlQPiTM8g/0qbHlH6dZCUJpDUTgNK2qFQkou096uNThZkniFcB0PIqpuR1oSQfUyENijiHsifnbCWLpmKeXJ/JlcwK5mF7NiU4oijbNkWC/Ya7vj3Nh/z9OazQX3vQOZzwm2KZD72yc2noSh2NReHYJEYynCeiP2tzcU+qrl8Ij9uHtkP45bfOTq+RdFLx1suorSd5AgUB7IuQLVI0lzkI04mARdXH0WGBrZ6kS8ChmvKQsSb9pTdx4/XJ91USrBsiujGm0rTUmXwDrepbIRPPuor6Xy7yk1TBXn3Ew616sgeyzS5Qt8s0yjNkJ6oQmgrdSZsXHeulV7adY+wv9JLI9H2XiJ8/ajC4UjTUGd+3Sm+B9LUpjLqpx52Jg3crv54KOu++hss/eo/</diagram></mxfile>

‎tools/dependency-scan/Makefile

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
generate-sbom: ### Run SBOM generator - mandatory: SCHEME=[file|directory|image|registry]; optional: ARGS=[syft args]
2+
docker run --interactive --tty --rm \
3+
--volume $(PWD):/project \
4+
--env "DOCKER_CONFIG=/config" \
5+
--workdir /project \
6+
anchore/syft:latest $(SCHEME) $(ARGS)
7+
8+
scan-vulnerabilities: ### Run vulnerability scanner - mandatory: SCHEME=[sbom|file|directory|image|registry]; optional: ARGS=[grype args]
9+
docker run --interactive --tty --rm \
10+
--volume /tmp/grype/db:/tmp/grype/db \
11+
--volume $(PWD):/project \
12+
--env "DOCKER_CONFIG=/config" \
13+
--env "XDG_CACHE_HOME=/tmp/grype/db" \
14+
--workdir /project \
15+
anchore/grype:latest $(SCHEME) $(ARGS)
16+
17+
.SILENT: \
18+
generate-sbom \
19+
scan-vulnerabilities

‎tools/dependency-scan/README.md

Lines changed: 425 additions & 0 deletions
Large diffs are not rendered by default.

‎tools/dependency-scan/config/.grype.yaml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# TODO: Example
2+
3+
ignore:
4+
# This is the full set of supported rule fields:
5+
- vulnerability: CVE-2008-4318
6+
fix-state: unknown
7+
package:
8+
name: libcurl
9+
version: 1.5.1
10+
type: npm
11+
location: "/usr/local/lib/node_modules/**"
12+
13+
# We can make rules to match just by vulnerability ID:
14+
- vulnerability: CVE-2017-41432
15+
16+
# ...or just by a single package field:
17+
- package:
18+
type: gem

‎tools/dependency-scan/config/.syft.yaml

Lines changed: 220 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,220 @@
1+
# TODO: Example
2+
3+
# the output format(s) of the SBOM report (options: table, text, json, spdx, ...)
4+
# same as -o, --output, and SYFT_OUTPUT env var
5+
# to specify multiple output files in differing formats, use a list:
6+
# output:
7+
# - "json=<syft-json-output-file>"
8+
# - "spdx-json=<spdx-json-output-file>"
9+
output: "table"
10+
11+
# suppress all output (except for the SBOM report)
12+
# same as -q ; SYFT_QUIET env var
13+
quiet: false
14+
15+
# same as --file; write output report to a file (default is to write to stdout)
16+
file: ""
17+
18+
# enable/disable checking for application updates on startup
19+
# same as SYFT_CHECK_FOR_APP_UPDATE env var
20+
check-for-app-update: true
21+
22+
# a list of globs to exclude from scanning. same as --exclude ; for example:
23+
# exclude:
24+
# - "/etc/**"
25+
# - "./out/**/*.json"
26+
exclude: []
27+
28+
# os and/or architecture to use when referencing container images (e.g. "windows/armv6" or "arm64")
29+
# same as --platform; SYFT_PLATFORM env var
30+
platform: ""
31+
32+
# set the list of package catalogers to use when generating the SBOM
33+
# default = empty (cataloger set determined automatically by the source type [image or file/directory])
34+
# catalogers:
35+
# - ruby-gemfile
36+
# - ruby-gemspec
37+
# - python-index
38+
# - python-package
39+
# - javascript-lock
40+
# - javascript-package
41+
# - php-composer-installed
42+
# - php-composer-lock
43+
# - alpmdb
44+
# - dpkgdb
45+
# - rpmdb
46+
# - java
47+
# - apkdb
48+
# - go-module-binary
49+
# - go-mod-file
50+
# - dartlang-lock
51+
# - rust
52+
# - dotnet-deps
53+
catalogers:
54+
55+
# cataloging packages is exposed through the packages and power-user subcommands
56+
package:
57+
58+
# search within archives that do contain a file index to search against (zip)
59+
# note: for now this only applies to the java package cataloger
60+
# SYFT_PACKAGE_SEARCH_INDEXED_ARCHIVES env var
61+
search-indexed-archives: true
62+
63+
# search within archives that do not contain a file index to search against (tar, tar.gz, tar.bz2, etc)
64+
# note: enabling this may result in a performance impact since all discovered compressed tars will be decompressed
65+
# note: for now this only applies to the java package cataloger
66+
# SYFT_PACKAGE_SEARCH_UNINDEXED_ARCHIVES env var
67+
search-unindexed-archives: false
68+
69+
cataloger:
70+
# enable/disable cataloging of packages
71+
# SYFT_PACKAGE_CATALOGER_ENABLED env var
72+
enabled: true
73+
74+
# the search space to look for packages (options: all-layers, squashed)
75+
# same as -s ; SYFT_PACKAGE_CATALOGER_SCOPE env var
76+
scope: "squashed"
77+
78+
# cataloging file classifications is exposed through the power-user subcommand
79+
file-classification:
80+
cataloger:
81+
# enable/disable cataloging of file classifications
82+
# SYFT_FILE_CLASSIFICATION_CATALOGER_ENABLED env var
83+
enabled: true
84+
85+
# the search space to look for file classifications (options: all-layers, squashed)
86+
# SYFT_FILE_CLASSIFICATION_CATALOGER_SCOPE env var
87+
scope: "squashed"
88+
89+
# cataloging file contents is exposed through the power-user subcommand
90+
file-contents:
91+
cataloger:
92+
# enable/disable cataloging of secrets
93+
# SYFT_FILE_CONTENTS_CATALOGER_ENABLED env var
94+
enabled: true
95+
96+
# the search space to look for secrets (options: all-layers, squashed)
97+
# SYFT_FILE_CONTENTS_CATALOGER_SCOPE env var
98+
scope: "squashed"
99+
100+
# skip searching a file entirely if it is above the given size (default = 1MB; unit = bytes)
101+
# SYFT_FILE_CONTENTS_SKIP_FILES_ABOVE_SIZE env var
102+
skip-files-above-size: 1048576
103+
104+
# file globs for the cataloger to match on
105+
# SYFT_FILE_CONTENTS_GLOBS env var
106+
globs: []
107+
108+
# cataloging file metadata is exposed through the power-user subcommand
109+
file-metadata:
110+
cataloger:
111+
# enable/disable cataloging of file metadata
112+
# SYFT_FILE_METADATA_CATALOGER_ENABLED env var
113+
enabled: true
114+
115+
# the search space to look for file metadata (options: all-layers, squashed)
116+
# SYFT_FILE_METADATA_CATALOGER_SCOPE env var
117+
scope: "squashed"
118+
119+
# the file digest algorithms to use when cataloging files (options: "sha256", "md5", "sha1")
120+
# SYFT_FILE_METADATA_DIGESTS env var
121+
digests: ["sha256"]
122+
123+
# cataloging secrets is exposed through the power-user subcommand
124+
secrets:
125+
cataloger:
126+
# enable/disable cataloging of secrets
127+
# SYFT_SECRETS_CATALOGER_ENABLED env var
128+
enabled: true
129+
130+
# the search space to look for secrets (options: all-layers, squashed)
131+
# SYFT_SECRETS_CATALOGER_SCOPE env var
132+
scope: "all-layers"
133+
134+
# show extracted secret values in the final JSON report
135+
# SYFT_SECRETS_REVEAL_VALUES env var
136+
reveal-values: false
137+
138+
# skip searching a file entirely if it is above the given size (default = 1MB; unit = bytes)
139+
# SYFT_SECRETS_SKIP_FILES_ABOVE_SIZE env var
140+
skip-files-above-size: 1048576
141+
142+
# name-regex pairs to consider when searching files for secrets. Note: the regex must match single line patterns
143+
# but may also have OPTIONAL multiline capture groups. Regexes with a named capture group of "value" will
144+
# use the entire regex to match, but the secret value will be assumed to be entirely contained within the
145+
# "value" named capture group.
146+
additional-patterns: {}
147+
148+
# names to exclude from the secrets search, valid values are: "aws-access-key", "aws-secret-key", "pem-private-key",
149+
# "docker-config-auth", and "generic-api-key". Note: this does not consider any names introduced in the
150+
# "secrets.additional-patterns" config option.
151+
# SYFT_SECRETS_EXCLUDE_PATTERN_NAMES env var
152+
exclude-pattern-names: []
153+
154+
# options when pulling directly from a registry via the "registry:" scheme
155+
registry:
156+
# skip TLS verification when communicating with the registry
157+
# SYFT_REGISTRY_INSECURE_SKIP_TLS_VERIFY env var
158+
insecure-skip-tls-verify: false
159+
# use http instead of https when connecting to the registry
160+
# SYFT_REGISTRY_INSECURE_USE_HTTP env var
161+
insecure-use-http: false
162+
163+
# credentials for specific registries
164+
auth:
165+
# the URL to the registry (e.g. "docker.io", "localhost:5000", etc.)
166+
# SYFT_REGISTRY_AUTH_AUTHORITY env var
167+
- authority: ""
168+
# SYFT_REGISTRY_AUTH_USERNAME env var
169+
username: ""
170+
# SYFT_REGISTRY_AUTH_PASSWORD env var
171+
password: ""
172+
# note: token and username/password are mutually exclusive
173+
# SYFT_REGISTRY_AUTH_TOKEN env var
174+
token: ""
175+
# - ... # note, more credentials can be provided via config file only
176+
177+
# generate an attested SBOM
178+
attest:
179+
# path to the private key file to use for attestation
180+
# SYFT_ATTEST_KEY env var
181+
key: "cosign.key"
182+
183+
# password to decrypt to given private key
184+
# SYFT_ATTEST_PASSWORD env var, additionally responds to COSIGN_PASSWORD
185+
password: ""
186+
187+
log:
188+
# use structured logging
189+
# same as SYFT_LOG_STRUCTURED env var
190+
structured: false
191+
192+
# the log level; note: detailed logging suppress the ETUI
193+
# same as SYFT_LOG_LEVEL env var
194+
level: "error"
195+
196+
# location to write the log file (default is not to have a log file)
197+
# same as SYFT_LOG_FILE env var
198+
file: ""
199+
200+
# uploading package SBOM is exposed through the packages subcommand
201+
anchore:
202+
# (feature-preview) the Anchore Enterprise Host or URL to upload results to (supported on Enterprise 3.0+)
203+
# same as -H ; SYFT_ANCHORE_HOST env var
204+
host: ""
205+
206+
# (feature-preview) the path after the host to the Anchore External API (supported on Enterprise 3.0+)
207+
# same as SYFT_ANCHORE_PATH env var
208+
path: ""
209+
210+
# (feature-preview) the username to authenticate against Anchore Enterprise (supported on Enterprise 3.0+)
211+
# same as -u ; SYFT_ANCHORE_USERNAME env var
212+
username: ""
213+
214+
# (feature-preview) the password to authenticate against Anchore Enterprise (supported on Enterprise 3.0+)
215+
# same as -p ; SYFT_ANCHORE_PASSWORD env var
216+
password: ""
217+
218+
# (feature-preview) path to dockerfile to be uploaded with the syft results to Anchore Enterprise (supported on Enterprise 3.0+)
219+
# same as -d ; SYFT_ANCHORE_DOCKERFILE env var
220+
dockerfile: ""

‎tools/dependency-scan/github-workflow-action-generate-sbom.yml

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: "Generate SBOM"
2+
on:
3+
push:
4+
branches: [main]
5+
pull_request:
6+
types: [opened, synchronize, reopened]
7+
jobs:
8+
generate-sbom:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- uses: actions/checkout@master
12+
- uses: anchore/sbom-action@v0
13+
with:
14+
path: ./
15+
format: cyclonedx-json
16+
artifact-name: sbom-repo.cdx.json
17+
- uses: anchore/sbom-action@v0
18+
with:
19+
image: my-registry.com/my/awesome/image
20+
registry-username: ${{ secrets.REGISTRY_USERNAME }}
21+
registry-password: ${{ secrets.REGISTRY_PASSWORD }}
22+
format: cyclonedx-json
23+
artifact-name: sbom-image.cdx.json

‎tools/dependency-scan/github-workflow-action-scan-vulnerabilities.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: "Scan vulnerabilities"
2+
on:
3+
push:
4+
branches: [main]
5+
pull_request:
6+
types: [opened, synchronize, reopened]
7+
jobs:
8+
scan-vulnerabilities:
9+
runs-on: ubuntu-latest
10+
steps:
11+
- uses: anchore/scan-action@v3
12+
with:
13+
sbom: sbom-repo.cdx.json
14+
fail-build: true
15+
severity-cutoff: critical
16+
acs-report-enable: true
17+
- uses: anchore/scan-action@v3
18+
with:
19+
sbom: sbom-image.cdx.json
20+
fail-build: true
21+
severity-cutoff: critical
22+
acs-report-enable: true

0 commit comments

Comments
 (0)