stackrox · RTann · Feb 24, 2022 · Jan 14, 2022 · Jan 17, 2022 · Jan 18, 2022
diff --git a/.circleci/config.yml b/.circleci/config.yml
@@ -1376,6 +1376,8 @@ commands:
       - attach_workspace:
           at: /go/src/github.com/stackrox/rox
 
+      - *restoreGoModCache
+
       - *setupRoxctl
       - setup-gcp
       - setup-dep-env:

@@ -51,9 +51,12 @@ var (
 			"/v1.ImageService/CountImages",
 			"/v1.ImageService/ListImages",
 		},
-		or.Or(idcheck.SensorsOnly(), idcheck.AdmissionControlOnly()): {
+		or.SensorOrAuthorizer(idcheck.AdmissionControlOnly()): {
 			"/v1.ImageService/ScanImageInternal",
 		},
+		idcheck.SensorsOnly(): {
+			"/v1.ImageService/GetImageVulnerabilitiesInternal",
+		},
 		user.With(permissions.Modify(permissions.WithLegacyAuthForSAC(resources.Image, true))): {
 			"/v1.ImageService/DeleteImages",
 			"/v1.ImageService/ScanImage",
@@ -108,9 +111,10 @@ func (s *serviceImpl) GetImage(ctx context.Context, request *v1.GetImageRequest)
 	if request.GetId() == "" {
 		return nil, errors.Wrap(errorhelpers.ErrInvalidArgs, "id must be specified")
 	}
-	request.Id = types.NewDigest(request.Id).Digest()
 
-	image, exists, err := s.datastore.GetImage(ctx, request.GetId())
+	id := types.NewDigest(request.GetId()).Digest()
+
+	image, exists, err := s.datastore.GetImage(ctx, id)
 	if err != nil {
 		return nil, err
 	}
@@ -122,6 +126,11 @@ func (s *serviceImpl) GetImage(ctx context.Context, request *v1.GetImageRequest)
 		// This modifies the image object
 		utils.FilterSuppressedCVEsNoClone(image)
 	}
+	if request.GetStripDescription() {
+		// This modifies the image object
+		utils.StripCVEDescriptionsNoClone(image)
+	}
+
 	return image, nil
 }
 
@@ -175,7 +184,7 @@ func internalScanRespFromImage(img *storage.Image) *v1.ScanImageInternalResponse
 	}
 }
 
-// ScanImageInternal handles an image request from Sensor
+// ScanImageInternal handles an image request from Sensor and Admission Controller.
 func (s *serviceImpl) ScanImageInternal(ctx context.Context, request *v1.ScanImageInternalRequest) (*v1.ScanImageInternalResponse, error) {
 	if err := s.internalScanSemaphore.Acquire(concurrency.AsContext(concurrency.Timeout(maxSemaphoreWaitTime)), 1); err != nil {
 		s, err := status.New(codes.Unavailable, err.Error()).WithDetails(&v1.ScanImageInternalResponseDetails_TooManyParallelScans{})
@@ -192,7 +201,8 @@ func (s *serviceImpl) ScanImageInternal(ctx context.Context, request *v1.ScanIma
 		if err != nil {
 			return nil, err
 		}
-		// If the scan exists and it is less than the reprocessing interval then return the scan. Otherwise, fetch it from the DB
+		// If the scan exists, and it is less than the reprocessing interval, then return the scan.
+		// Otherwise, fetch it from the DB.
 		if exists {
 			return internalScanRespFromImage(img), nil
 		}
@@ -251,6 +261,14 @@ func (s *serviceImpl) ScanImage(ctx context.Context, request *v1.ScanImageReques
 	return img, nil
 }
 
+// GetImageVulnerabilitiesInternal retrieves the vulnerabilities related to the image
+// specified by the given components and scan notes.
+// This is meant to be called by Sensor.
+// TODO(ROX-9281): Implement me.
+func (s *serviceImpl) GetImageVulnerabilitiesInternal(ctx context.Context, request *v1.GetImageVulnerabilitiesInternalRequest) (*v1.ScanImageInternalResponse, error) {
+	return nil, nil
+}
+
 // DeleteImages deletes images based on query
 func (s *serviceImpl) DeleteImages(ctx context.Context, request *v1.DeleteImagesRequest) (*v1.DeleteImagesResponse, error) {
 	if request.GetQuery() == nil {

diff --git a/generated/api/v1/image_service.pb.go b/generated/api/v1/image_service.pb.go
diff --git a/generated/api/v1/image_service.swagger.json b/generated/api/v1/image_service.swagger.json
@@ -215,6 +215,12 @@
             "in": "query",
             "required": false,
             "type": "boolean"
+          },
+          {
+            "name": "stripDescription",
+            "in": "query",
+            "required": false,
+            "type": "boolean"
           }
         ],
         "tags": [
@@ -408,20 +414,6 @@
       ],
       "default": "UI_NONE"
     },
-    "EmbeddedImageScanComponentExecutable": {
-      "type": "object",
-      "properties": {
-        "path": {
-          "type": "string"
-        },
-        "dependencies": {
-          "type": "array",
-          "items": {
-            "type": "string"
-          }
-        }
-      }
-    },
     "EmbeddedVulnerabilityVulnerabilityType": {
       "type": "string",
       "enum": [
@@ -480,6 +472,210 @@
         }
       }
     },
+    "scannerV1Components": {
+      "type": "object",
+      "properties": {
+        "namespace": {
+          "type": "string"
+        },
+        "osComponents": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/scannerV1OSComponent"
+          }
+        },
+        "rhelComponents": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/scannerV1RHELComponent"
+          }
+        },
+        "languageComponents": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/scannerV1LanguageComponent"
+          }
+        }
+      }
+    },
+    "scannerV1Executable": {
+      "type": "object",
+      "properties": {
+        "path": {
+          "type": "string"
+        },
+        "requiredFeatures": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/scannerV1FeatureNameVersion"
+          }
+        }
+      }
+    },
+    "scannerV1FeatureNameVersion": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "version": {
+          "type": "string"
+        }
+      }
+    },
+    "scannerV1JavaComponent": {
+      "type": "object",
+      "properties": {
+        "implementationVersion": {
+          "type": "string"
+        },
+        "mavenVersion": {
+          "type": "string"
+        },
+        "origins": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "specificationVersion": {
+          "type": "string"
+        },
+        "bundleName": {
+          "type": "string"
+        }
+      }
+    },
+    "scannerV1LanguageComponent": {
+      "type": "object",
+      "properties": {
+        "type": {
+          "$ref": "#/definitions/scannerV1SourceType"
+        },
+        "name": {
+          "type": "string"
+        },
+        "version": {
+          "type": "string"
+        },
+        "location": {
+          "type": "string"
+        },
+        "java": {
+          "$ref": "#/definitions/scannerV1JavaComponent"
+        },
+        "python": {
+          "$ref": "#/definitions/scannerV1PythonComponent"
+        },
+        "addedBy": {
+          "type": "string"
+        }
+      }
+    },
+    "scannerV1Note": {
+      "type": "string",
+      "enum": [
+        "OS_CVES_UNAVAILABLE",
+        "OS_CVES_STALE",
+        "LANGUAGE_CVES_UNAVAILABLE",
+        "CERTIFIED_RHEL_SCAN_UNAVAILABLE"
+      ],
+      "default": "OS_CVES_UNAVAILABLE"
+    },
+    "scannerV1OSComponent": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "namespace": {
+          "type": "string"
+        },
+        "version": {
+          "type": "string"
+        },
+        "addedBy": {
+          "type": "string"
+        },
+        "executables": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/scannerV1Executable"
+          }
+        }
+      }
+    },
+    "scannerV1PythonComponent": {
+      "type": "object",
+      "properties": {
+        "homepage": {
+          "type": "string"
+        },
+        "authorEmail": {
+          "type": "string"
+        },
+        "downloadUrl": {
+          "type": "string"
+        },
+        "summary": {
+          "type": "string"
+        },
+        "description": {
+          "type": "string"
+        }
+      }
+    },
+    "scannerV1RHELComponent": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "format": "int64"
+        },
+        "name": {
+          "type": "string"
+        },
+        "namespace": {
+          "type": "string"
+        },
+        "version": {
+          "type": "string"
+        },
+        "arch": {
+          "type": "string"
+        },
+        "module": {
+          "type": "string"
+        },
+        "cpes": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "addedBy": {
+          "type": "string"
+        },
+        "executables": {
+          "type": "array",
+          "items": {
+            "$ref": "#/definitions/scannerV1Executable"
+          }
+        }
+      }
+    },
+    "scannerV1SourceType": {
+      "type": "string",
+      "enum": [
+        "UNSET_SOURCE_TYPE",
+        "JAVA",
+        "PYTHON",
+        "NPM",
+        "GEM",
+        "DOTNETCORERUNTIME"
+      ],
+      "default": "UNSET_SOURCE_TYPE"
+    },
     "storageCVSSV2": {
       "type": "object",
       "properties": {
@@ -721,13 +917,27 @@
         "executables": {
           "type": "array",
           "items": {
-            "$ref": "#/definitions/EmbeddedImageScanComponentExecutable"
+            "$ref": "#/definitions/storageEmbeddedImageScanComponentExecutable"
           },
           "title": "Values are cleared after moving to cache, remove them from the grpc return as well"
         }
       },
       "title": "Next Tag: 13"
     },
+    "storageEmbeddedImageScanComponentExecutable": {
+      "type": "object",
+      "properties": {
+        "path": {
+          "type": "string"
+        },
+        "dependencies": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
     "storageEmbeddedVulnerability": {
       "type": "object",
       "properties": {

@@ -4,7 +4,7 @@ go 1.16
 
 // CAVEAT: This introduces a circular dependency. If you change this line, you MUST change the "exclude"
 // directive at the bottom of the file as well.
-require github.com/stackrox/scanner v0.0.0-20220106020903-2744339f7e9d
+require github.com/stackrox/scanner v0.0.0-20220214215744-13c0e1db0298
 
 require (
 	cloud.google.com/go/compute v1.3.0