Skip to content

feat: Support old and new names in security scanning config #2340

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Cortey merged 1 commit into from
Feb 4, 2025
Merged

feat: Support old and new names in security scanning config #2340

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions pkg/module/scaffold/security_config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,9 @@ func (g *Generator) SecurityConfigFileExists() (bool, error) {
func (g *Generator) GenerateSecurityConfigFile() error {
cfg := module.SecurityScanCfg{
ModuleName: g.ModuleName,
Protecode: []string{"europe-docker.pkg.dev/kyma-project/prod/myimage:1.2.3",
Images: []string{"europe-docker.pkg.dev/kyma-project/prod/myimage:1.2.3",
"europe-docker.pkg.dev/kyma-project/prod/external/ghcr.io/mymodule/anotherimage:4.5.6"},
WhiteSource: module.WhiteSourceSecCfg{
Mend: module.WhiteSourceSecCfg{
Exclude: []string{"**/test/**", "**/*_test.go"},
},
}
Expand Down
53 changes: 43 additions & 10 deletions pkg/module/security_scan.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,13 +4,14 @@ import (
"errors"
"fmt"
"os"
"reflect"
"strings"

itociartifact "github.com/open-component-model/ocm/cmds/ocm/commands/ocmcmds/common/inputs/types/ociartifact"
"github.com/open-component-model/ocm/pkg/contexts/ocm/accessmethods/ociartifact"
ocm "github.com/open-component-model/ocm/pkg/contexts/ocm/compdesc"
ocmv1 "github.com/open-component-model/ocm/pkg/contexts/ocm/compdesc/meta/v1"
"sigs.k8s.io/yaml"
"gopkg.in/yaml.v3"
)

var ErrFailedToParseImageURL = errors.New("error parsing protecode image URL")
Expand All @@ -30,7 +31,7 @@ func AddSecurityScanningMetadata(descriptor *ocm.ComponentDescriptor, securityCo
if err != nil {
return err
}
excludedWhitesourcePathPatterns := strings.Join(config.WhiteSource.Exclude, ",")
excludedWhitesourcePathPatterns := strings.Join(config.Mend.Exclude, ",")

// add security scan enabled global label
err = appendLabelToAccessor(descriptor, "scan", secScanEnabled, globalLabelTemplate)
Expand All @@ -48,7 +49,7 @@ func AddSecurityScanningMetadata(descriptor *ocm.ComponentDescriptor, securityCo
if err != nil {
return err
}
err = appendLabelToAccessor(src, "language", config.WhiteSource.Language, labelTemplate)
err = appendLabelToAccessor(src, "language", config.Mend.Language, labelTemplate)
if err != nil {
return err
}
Expand All @@ -57,7 +58,7 @@ func AddSecurityScanningMetadata(descriptor *ocm.ComponentDescriptor, securityCo
return err
}

err = appendLabelToAccessor(src, "subprojects", config.WhiteSource.SubProjects, labelTemplate)
err = appendLabelToAccessor(src, "subprojects", config.Mend.SubProjects, labelTemplate)
if err != nil {
return err
}
Expand All @@ -77,7 +78,7 @@ func AddSecurityScanningMetadata(descriptor *ocm.ComponentDescriptor, securityCo
}

func appendProtecodeImagesLayers(descriptor *ocm.ComponentDescriptor, config *SecurityScanCfg) error {
for _, imageURL := range config.Protecode {
for _, imageURL := range config.Images {
imageName, imageTag, err := getImageName(imageURL)
if err != nil {
return err
Expand Down Expand Up @@ -125,18 +126,50 @@ func getImageName(imageURL string) (string, string, error) {
}

type SecurityScanCfg struct {
ModuleName string `json:"module-name" yaml:"module-name" comment:"string, name of your module"`
Protecode []string `json:"protecode" yaml:"protecode" comment:"list, includes the images which must be scanned by the Protecode scanner (aka. Black Duck Binary Analysis)"`
WhiteSource WhiteSourceSecCfg `json:"whitesource" yaml:"whitesource" comment:"whitesource (aka. Mend) security scanner specific configuration"`
DevBranch string `json:"dev-branch" yaml:"dev-branch" comment:"string, name of the development branch"`
RcTag string `json:"rc-tag" yaml:"rc-tag" comment:"string, release candidate tag"`
ModuleName string `json:"module-name" yaml:"module-name" comment:"string, name of your module"`
Images []string `json:"bdba" yaml:"bdba" comment:"list, includes the images which must be scanned by the Protecode scanner (aka. Black Duck Binary Analysis)"`
Mend WhiteSourceSecCfg `json:"mend" yaml:"mend" comment:"whitesource (aka. Mend) security scanner specific configuration"`
DevBranch string `json:"dev-branch" yaml:"dev-branch" comment:"string, name of the development branch"`
RcTag string `json:"rc-tag" yaml:"rc-tag" comment:"string, release candidate tag"`
}
type WhiteSourceSecCfg struct {
Language string `json:"language" yaml:"language" comment:"string, indicating the programming language the scanner has to analyze"`
SubProjects string `json:"subprojects" yaml:"subprojects" comment:"string, specifying any subprojects"`
Exclude []string `json:"exclude" yaml:"exclude" comment:"list, directories within the repository which should not be scanned"`
}

func (config *SecurityScanCfg) UnmarshalYAML(value *yaml.Node) error {
// Cannot use inheritance due to infinite loop
var cfg struct {
ModuleName string `json:"module-name" yaml:"module-name" comment:"string, name of your module"`
Protecode []string `json:"protecode" yaml:"protecode" comment:"list, includes the images which must be scanned by the Protecode scanner (aka. Black Duck Binary Analysis)"`
Whitesource WhiteSourceSecCfg `json:"whitesource" yaml:"whitesource" comment:"whitesource (aka. Mend) security scanner specific configuration"`
DevBranch string `json:"dev-branch" yaml:"dev-branch" comment:"string, name of the development branch"`
RcTag string `json:"rc-tag" yaml:"rc-tag" comment:"string, release candidate tag"`
Images []string `json:"bdba" yaml:"bdba" comment:"list, includes the images which must be scanned by the Protecode scanner (aka. Black Duck Binary Analysis)"`
Mend WhiteSourceSecCfg `json:"mend" yaml:"mend" comment:"whitesource (aka. Mend) security scanner specific configuration"`
}

if err := value.Decode(&cfg); err != nil {
return err
}

config.ModuleName = cfg.ModuleName
config.RcTag = cfg.RcTag
config.Images = cfg.Images
config.Mend = cfg.Mend

if len(cfg.Protecode) > 0 {
config.Images = cfg.Protecode
}

if !reflect.DeepEqual(cfg.Whitesource, WhiteSourceSecCfg{}) {
config.Mend = cfg.Whitesource
}

return nil
}

func parseSecurityScanConfig(securityConfigPath string) (*SecurityScanCfg, error) {
fileBytes, err := os.ReadFile(securityConfigPath)
if err != nil {
Expand Down
Loading