Skip to content

ROX-9545: Use manifest API instead of deprecated image API in quay.io #825

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
janisz merged 5 commits into from
Mar 4, 2022
Merged

ROX-9545: Use manifest API instead of deprecated image API in quay.io #825

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
be6ff9d
ROX-9545: Retry request to quay in vulns check
janisz Mar 2, 2022
a0c563f
HACK: Scan images in quay
janisz Mar 3, 2022
73ed2ce
curl: fail with body
janisz Mar 3, 2022
2ce90d8
Revert hack
janisz Mar 4, 2022
3522170
Change echo
janisz Mar 4, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions release/scripts/vuln_check.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,12 +19,12 @@ function compare_fixable_vulns {
local image_name=$1
local image_tag=$2

echo "Fetching current image id from quay for $image_name:$image_tag"
echo "Fetching current image SHA from quay for $image_name:$image_tag"
img_data="$(quay_curl "${image_name}/tag/?specificTag=${image_tag}" | jq -r '.tags | first')"
if [[ "$(jq -r '.is_manifest_list' <<<"$img_data")" == "true" ]]; then
Copy link
Copy Markdown
Contributor

@gavin-stackrox gavin-stackrox Mar 4, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you change the echo on line 22. echo "Fetching current image data ...

img_data="$(quay_curl "${image_name}/tag/?specificTag=${image_tag}-amd64" | jq -r '.tags | first')"
fi
CURRENT_IMAGE="$(jq -r '.image_id' <<<"$img_data")"
CURRENT_IMAGE="$(jq -r '.manifest_digest' <<<"$img_data")"
if [[ -z "$CURRENT_IMAGE" || "$CURRENT_IMAGE" == "null" ]]; then
echo >&2 "Tag ${image_tag} could not be found for image ${image_name}"
FAIL_SCRIPT=true
Expand All @@ -36,11 +36,11 @@ function compare_fixable_vulns {
local scan_present
local count=1

echo "Getting scan status"
scan_present=$(quay_curl "${image_name}/image/${CURRENT_IMAGE}/security?vulnerabilities=true" | jq -r '.status')
echo "Getting scan status for ${image_name}"
scan_present=$(quay_curl "${image_name}/manifest/${CURRENT_IMAGE}/security?vulnerabilities=true" | jq -r '.status')
until [ "$scan_present" = "scanned" ] || [ "$count" -gt 100 ]; do
echo "Waiting for scan to complete..."
scan_present=$(quay_curl "${image_name}/image/${CURRENT_IMAGE}/security?vulnerabilities=true" | jq -r '.status')
scan_present=$(quay_curl "${image_name}/manifest/${CURRENT_IMAGE}/security?vulnerabilities=true" | jq -r '.status')
count=$((count+1))
sleep 15
done
Expand All @@ -50,8 +50,8 @@ function compare_fixable_vulns {
echo "${image_name}:${image_tag} scan never completed. Check Quay website."
FAIL_SCRIPT=true
else
echo "Trying to get any fixable vulns for the scanned image"
CURRENT_FIXABLE=$(quay_curl "${image_name}/image/${CURRENT_IMAGE}/security?vulnerabilities=true" | jq -r '.data.Layer.Features | .[] | select(.Vulnerabilities != null) | .Vulnerabilities | .[] | select(.FixedBy != null) | .Name')
echo "Trying to get any fixable vulns for ${image_name}"
CURRENT_FIXABLE=$(quay_curl "${image_name}/manifest/${CURRENT_IMAGE}/security?vulnerabilities=true" | jq -r '.data.Layer.Features | .[] | select(.Vulnerabilities != null) | .Vulnerabilities | .[] | select(.FixedBy != null) | .Name')

# fail the check if fixable vulns are found that are not allowed
if [[ -n "$CURRENT_FIXABLE" ]]; then
Expand Down