General Tool Upgrade - #395
Conversation
* Tools that are used for scanning were upgraded to latest version available * Ubuntu version used for all processes, including docker images were upgraded to 22.04, latest LTS without excessive use of snap. * arm64/amd64 scripts were clearly defined and we tried to avoid repetition where possible. This was so far tested only with checkov. AppImage still needs some work to be fully reliable.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| COPY tools_config/ /usr/local/src/ | ||
|
|
||
| FROM shiftleft/scan-base-slim as sast-scan-tools | ||
| USER root |
Check failure
Code scanning / Security Audit for Infrastructure
Ensure the last USER is not root.
| @@ -1,96 +1,81 @@ | |||
| FROM shiftleft/scan-base as builder | |||
| FROM ubuntu:jammy as scan-base | |||
Check notice
Code scanning / Security Audit for Infrastructure
Ensure that HEALTHCHECK instructions have been added to container images.
| @@ -1,4 +1,6 @@ | |||
| FROM ubuntu:20.04 | |||
| FROM ubuntu:22.04 | |||
Check notice
Code scanning / Security Audit for Infrastructure
Ensure that a user for the container has been created.
| @@ -1,4 +1,6 @@ | |||
| FROM ubuntu:20.04 | |||
| FROM ubuntu:22.04 | |||
Check notice
Code scanning / Security Audit for Infrastructure
Ensure that HEALTHCHECK instructions have been added to container images.
| @@ -1,7 +1,8 @@ | |||
| FROM ubuntu:20.04 | |||
| FROM ubuntu:22.04 | |||
Check notice
Code scanning / Security Audit for Infrastructure
Ensure that a user for the container has been created.
| @@ -1,7 +1,8 @@ | |||
| FROM ubuntu:20.04 | |||
| FROM ubuntu:22.04 | |||
Check notice
Code scanning / Security Audit for Infrastructure
Ensure that HEALTHCHECK instructions have been added to container images.
Make actions use the same build script as everything else.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Scan Summary
| Tool | Critical | High | Medium | Low | Status |
|---|---|---|---|---|---|
| Shell Script Analysis | 0 | 0 | 0 | 0 | ✅ |
| Secrets Audit | 0 | 54 | 0 | 0 | ❌ |
| Python Source Analyzer | 0 | 0 | 0 | 0 | ✅ |
| Python Security Analysis | 0 | 0 | 0 | 0 | ✅ |
| Security Audit for Infrastructure | 0 | 2 | 0 | 6 | ✅ |
Recommendation
Please review the findings from Code scanning alerts before approving this pull request. You can also configure the build rules or add suppressions to customize this bot 👍
For now we will use the scan-reports repository but we will eventually update the pypi package
While PR is accepted in upstream
For some reason github actions are picking an older one.
There were leftover hardcoded architectures in the build script
A portion of code using the wrong python module was replaced for one equivalent.
Icons need to be renamed for AppImage builder to find them. It is unclear if we should change the icon name in the configuration.
My changes have been merged
Olof had some formatting suggestions (and corrected typos) Co-authored-by: Olof-Joachim Frahm (欧雅福) <olof@shiftleft.io>
Co-authored-by: Olof-Joachim Frahm (欧雅福) <olof@shiftleft.io>
Try to force AppImage to have all its needs Appimage, until this patch at least, lacks urllib3 despite it being an explicit requirement.
…o horacio/update_scan_tooling
Ensure we do not install recommends on build
4 participants
This was so far tested only with checkov.
AppImage still needs some work to be fully reliable.