Skip to content

whichphp v0.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 31 Oct 14:18
· 14 commits to main since this release
Immutable release. Only release title and notes can be modified.
v0.2.0
efbbf97

whichphp v0.2.0 adds a way to check what a Kubernetes cluster is actually running, and a way to be told when an image tag is fixed. The GitHub Action works the same as in v0.1.1.

What's new

  • whichphp cluster reads which image digest each running pod uses (with kubectl get, against the --context you name, nothing else) and checks each image once. Per workload it says whether a redeploy is enough, because the tag already points to a fixed image, or whether the image itself still ships vulnerable PHP and has to be rebuilt. It gives the kubectl rollout restart command, for the same context and kubeconfig, when a redeploy is the fix and the pods pull their tag on every start; with imagePullPolicy: IfNotPresent it says to pin the new digest or change the policy first. It reminds you to save logs before recreating pods. Output as a table or JSON. Exit codes: 0 nothing to do, 1 a workload needs action, 2 an image couldn't be proven fixed or couldn't be checked, 3 an error, such as a cluster that couldn't be read, no running pods to check, Syft or Grype missing, or an interrupted run.
  • Atom feeds per tag. The index now publishes a feed for every tracked tag, with an entry each time its status, image digest or verdicts change, and feeds/all.xml with the latest changes across the index. Each tag's details on the index page link to its feed. whichphp index writes the feeds; --site-url sets the links in them.

Fixes

  • Tag lookups renew registry tokens when they expire (Docker Hub's last five minutes), so a long run no longer fails with 401 Unauthorized partway through.
  • DOCKERHUB_USERNAME and DOCKERHUB_TOKEN are sent only to Docker Hub's own token service, for Docker Hub images, and a token made with them is used only for Docker Hub. Before, any registry whose token URL contained docker.io received them; with cluster mode, the registry can come from any pod spec.
  • Syft and Grype errors lose their terminal color codes, and long ones keep their end, where the cause is.

Limits of cluster mode

Settings come from the images: a php.ini mounted from a ConfigMap or set through the environment isn't read yet. An image loaded straight into a node rather than pulled has no registry digest, so the image in the pod spec is checked instead; for a tag, a fixed or no-PHP result counts only when the image ID matches the tag's image. Pods on Windows nodes are skipped when the nodes can be listed. The lookup of what a tag points to now is anonymous, except on Docker Hub with DOCKERHUB_USERNAME and DOCKERHUB_TOKEN, so for a private registry the report may say the tag couldn't be checked.

Verify your download

sha256sum --ignore-missing -c SHA256SUMS        # on macOS: shasum -a 256 --ignore-missing -c SHA256SUMS
gh attestation verify whichphp_0.2.0_linux_amd64.tar.gz --repo yusufyildiz34/whichphp \
  --signer-workflow yusufyildiz34/whichphp/.github/workflows/release.yml --bundle whichphp_0.2.0.sigstore.json
Assets 11
Loading