feat: import chisel in scalibrplugin#2772
Conversation
another-rex
force-pushed
the
ROCKS-2010/add-chisel-scalibr-plugin
branch
from
64e6842 to
8b9aa1d
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #2772 +/- ##
==========================================
+ Coverage 79.19% 79.23% +0.03%
==========================================
Files 121 121
Lines 8185 8185
==========================================
+ Hits 6482 6485 +3
+ Misses 1322 1320 -2
+ Partials 381 380 -1 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
another-rex
left a comment
another-rex
left a comment
There was a problem hiding this comment.
Can you added a e2e test by added a dockerfile that can build a chisel image, which can be scanned by scanner?
|
Added as |
another-rex
force-pushed
the
ROCKS-2010/add-chisel-scalibr-plugin
branch
from
8a3f52e to
9168fb5
Compare
…el-scalibr-plugin # Conflicts: # cmd/osv-scanner/scan/image/__snapshots__/command_test.snap # cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml # cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml # cmd/osv-scanner/scan/source/testdata/cassettes/TestCommand.yaml # cmd/osv-scanner/scan/source/testdata/cassettes/TestCommand_CallAnalysis.yaml # cmd/osv-scanner/scan/source/testdata/cassettes/TestCommand_CommitSupport.yaml # cmd/osv-scanner/scan/source/testdata/cassettes/TestCommand_GithubActions.yaml # cmd/osv-scanner/scan/source/testdata/cassettes/TestCommand_MoreLockfiles.yaml # go.mod # go.sum
|
@zhijie-yang Hmm been trying to make this test pass for a while. The issue seems to be that because the image is not pinned, it's making the test container image that's being scanned is constantly changing. Is there a way we can pin the versions that chisel is adding? |
|
Hey @another-rex , I've modified the Dockerfile and let Chisel pull the packages from a frozen pocket of the Ubuntu archive. Please see if the tests can pass stably. |
3 participants
Description
This PR imports the
os/chiselextractor from the osv-scalibr in thescalibrplugin/presets.goto enable the scanning of container images built with Chisel.The description of
Ubuntu chiseled packagesis added todocs/supported_languages_and_lockfiles.md, which corresponds to the changes of this PR.This PR expects no breaking changes nor regressive UX to be introduced to the OSV-Scanner.
Related pull requests
google/osv-scalibr#764
google/osv-scalibr#2018
P.S. I've run
make refresh-all REBUILD_IMAGES=trueto update the snapshots.FYI: @cjdcordeiro