Skip to content

Commit 373516e

Browse files
refoo0refoo0
committed
merge main
Signed-off-by: rafi <refaei.shikho@hotmail.com>
2 parents 1c3d14a + 1389336 commit 373516e

269 files changed

Lines changed: 7433 additions & 7330 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/devguard-scanner.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ jobs:
4646
substituters = https://cache.nixos.org https://nix.garage.l3montree.cloud
4747
trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= nix.garage.l3montree.cloud:MGlzfPQKA91/zxw91CN+GP7NpjAAwmKvWXlDYgeeI8k=
4848
- name: Run unittests
49-
run: nix develop . --command bash -c "go test \$(go list ./... | grep -v '/mocks') -coverprofile=coverage.out && go tool cover -func=coverage.out"
49+
run: nix develop . --command bash -c "go test -timeout 20m \$(go list ./... | grep -v '/mocks') -coverprofile=coverage.out && go tool cover -func=coverage.out"
5050
- name: Archive code coverage results
5151
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 - https://github.com/actions/upload-artifact/releases/tag/v4.6.2
5252
with:
@@ -121,7 +121,7 @@ jobs:
121121
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
122122

123123
postgresql-pipeline:
124-
if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/') || github.ref == 'refs/heads/main'
124+
if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/')
125125
uses: l3montree-dev/devguard-action/.github/workflows/full-nix.yml@nix
126126
permissions:
127127
contents: read

‎.github/workflows/mirror-to-gitlab.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
# Avoid --mirror, which also pushes refs/remotes/* that GitLab rejects as hidden refs.
2424
# Push from refs/remotes/origin/* so all branches are present and --prune never deletes the default branch.
2525
git push --prune gitlab 'refs/remotes/origin/*:refs/heads/*'
26-
git push --prune gitlab 'refs/tags/*:refs/tags/*'
26+
git push --force gitlab 'refs/tags/*:refs/tags/*'
2727
env:
2828
GITLAB_TOKEN: ${{ secrets.GITLAB_MIRROR_TOKEN }}
2929
GITLAB_HOST: ${{ vars.GITLAB_HOST }}

‎.github/workflows/vulndb-v1.yaml‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
name: VulnDB v1 Workflow
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
run_generate_snapshot:
7+
description: "Run generate snapshot job"
8+
required: false
9+
default: "false"
10+
schedule:
11+
- cron: "0 */6 * * *" # every hour
12+
13+
permissions:
14+
contents: read
15+
packages: write
16+
17+
env:
18+
POSTGRES_DB: devguard
19+
POSTGRES_USER: devguard
20+
POSTGRES_HOST: localhost
21+
POSTGRES_PASSWORD: not_reachable_from_the_internet
22+
DATE: $(date +%s)
23+
24+
jobs:
25+
build:
26+
runs-on: ubuntu-latest
27+
env:
28+
FRONTEND_URL: "doesntmatter"
29+
services:
30+
postgres:
31+
image: ghcr.io/l3montree-dev/devguard-postgresql:v0.5.3@sha256:a06c9e7c8ee334790cc66d52e89ff5ef05352ab264841d3d9f3659c046732251
32+
env:
33+
POSTGRES_DB: ${{env.POSTGRES_DB}}
34+
POSTGRES_USER: ${{env.POSTGRES_USER}}
35+
POSTGRES_PASSWORD: ${{env.POSTGRES_PASSWORD}}
36+
ports:
37+
- 5432:5432
38+
options: '--health-cmd="pg_isready -U devguard" --health-interval=10s --health-timeout=5s --health-retries=5 '
39+
steps:
40+
- name: Install postgresql client
41+
run: |
42+
sudo apt-get update
43+
sudo apt-get install -y wget
44+
wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo apt-key add -
45+
echo "deb http://apt.postgresql.org/pub/repos/apt/ $(lsb_release -cs)-pgdg main" | sudo tee /etc/apt/sources.list.d/pgdg.list
46+
sudo apt-get update
47+
sudo apt-get install -y postgresql-client-16
48+
- name: Create semver extension
49+
run: |
50+
PGPASSWORD=${{env.POSTGRES_PASSWORD}} psql -h localhost -U devguard devguard -c "CREATE EXTENSION IF NOT EXISTS semver;"
51+
- name: Checkout code
52+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 - https://github.com/actions/checkout/releases/tag/v5.0.0
53+
with:
54+
persist-credentials: false
55+
ref: v1.3.1
56+
- name: Install Golang
57+
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0 - https://github.com/actions/setup-go/releases/tag/v5.5.0
58+
with:
59+
go-version: "1.25"
60+
- name: Build the database (this takes some time)
61+
run: |
62+
# will fetch the latest build database from ghcr.io
63+
go run ./cmd/devguard-cli/main.go vulndb sync
64+
65+
- name: Dump the PostgreSQL database
66+
if: ${{ github.event.inputs.run_generate_snapshot == 'true' }}
67+
# skip:checkov:CKV_SECRET_6
68+
run: |
69+
PGPASSWORD=${{env.POSTGRES_PASSWORD}} psql -h localhost -U devguard devguard -c "COPY (SELECT * FROM affected_components) TO STDOUT WITH DELIMITER ',' CSV HEADER" > affected_components.csv
70+
PGPASSWORD=${{env.POSTGRES_PASSWORD}} psql -h localhost -U devguard devguard -c "COPY (SELECT * FROM cve_affected_component) TO STDOUT WITH DELIMITER ',' CSV HEADER" > cve_affected_component.csv
71+
PGPASSWORD=${{env.POSTGRES_PASSWORD}} psql -h localhost -U devguard devguard -c "COPY (SELECT * FROM cves) TO STDOUT WITH DELIMITER ',' CSV HEADER" > cves.csv
72+
PGPASSWORD=${{env.POSTGRES_PASSWORD}} psql -h localhost -U devguard devguard -c "COPY (SELECT * FROM cwes) TO STDOUT WITH DELIMITER ',' CSV HEADER" > cwes.csv
73+
PGPASSWORD=${{env.POSTGRES_PASSWORD}} psql -h localhost -U devguard devguard -c "COPY (SELECT * FROM exploits) TO STDOUT WITH DELIMITER ',' CSV HEADER" > exploits.csv
74+
PGPASSWORD=${{env.POSTGRES_PASSWORD}} psql -h localhost -U devguard devguard -c "COPY (SELECT * FROM malicious_packages) TO STDOUT WITH DELIMITER ',' CSV HEADER" > malicious_packages.csv
75+
PGPASSWORD=${{env.POSTGRES_PASSWORD}} psql -h localhost -U devguard devguard -c "COPY (SELECT * FROM malicious_affected_components) TO STDOUT WITH DELIMITER ',' CSV HEADER" > malicious_affected_components.csv
76+
# PGPASSWORD=${{env.POSTGRES_PASSWORD}} psql -h localhost -U devguard devguard -c "COPY (SELECT * FROM weaknesses) TO STDOUT WITH DELIMITER ',' CSV HEADER" > weaknesses.csv
77+
PGPASSWORD=${{env.POSTGRES_PASSWORD}} psql -h localhost -U devguard devguard -c "COPY (SELECT * FROM cve_relationships) TO STDOUT WITH DELIMITER ',' CSV HEADER" > cve_relationships.csv
78+
- name: Export the diff csv files (this does not take some time)
79+
if: ${{ github.event.inputs.run_generate_snapshot == 'false' || github.event.inputs.run_generate_snapshot == '' }}
80+
run: |
81+
# writes the difference from the db before and after the sync into csv files
82+
go run ./cmd/devguard-cli/main.go vulndb export
83+
84+
- name: install zip
85+
run: sudo apt-get install zip
86+
87+
- name: Zip the CSV files
88+
if: ${{ github.event.inputs.run_generate_snapshot == 'true' }}
89+
run: zip vulndb.zip affected_components.csv cve_affected_component.csv cves.csv cwes.csv exploits.csv malicious_packages.csv malicious_affected_components.csv cve_relationships.csv
90+
- name: Zip the CSV files
91+
if: ${{ github.event.inputs.run_generate_snapshot == 'false' || github.event.inputs.run_generate_snapshot == '' }}
92+
run: zip -r vulndb.zip diffs-tmp
93+
- name: Install Cosign
94+
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
95+
with:
96+
cosign-release: "v2.6.1"
97+
98+
- name: Write signing key to disk
99+
run: echo "${{ secrets.COSIGN_PRIVATE_KEY }}" > cosign.key
100+
101+
- name: Sign the database zip file
102+
env:
103+
COSIGN_PASSWORD: ""
104+
run: cosign import-key-pair --key cosign.key && cosign sign-blob --yes --key import-cosign.key vulndb.zip > vulndb.zip.sig
105+
- name: Login to GitHub Container Registry
106+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
107+
with:
108+
registry: ghcr.io
109+
username: ${{ github.actor }}
110+
password: ${{ secrets.GITHUB_TOKEN }}
111+
- name: Setup oras cli
112+
uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1
113+
114+
- name: set the date
115+
run: echo "date="${{env.DATE}} >> "$GITHUB_ENV"
116+
117+
- name: Push the database ZIP file to GitHub Container Registry (vulndb/v1)
118+
if: ${{ github.event.inputs.run_generate_snapshot == 'false' || github.event.inputs.run_generate_snapshot == '' }}
119+
run: |
120+
oras push ghcr.io/l3montree-dev/devguard/vulndb/v1:$date vulndb.zip
121+
122+
- name: Push the database ZIP file to GitHub Container Registry (snapshot)
123+
if: ${{ github.event.inputs.run_generate_snapshot == 'true' }}
124+
run: |
125+
oras push ghcr.io/l3montree-dev/devguard/vulndb/v1:$date-snapshot vulndb.zip
126+
- name: Push the signatures to the GitHub Container Registry
127+
if: ${{ github.event.inputs.run_generate_snapshot == 'false' || github.event.inputs.run_generate_snapshot == '' }}
128+
run: |
129+
oras push ghcr.io/l3montree-dev/devguard/vulndb/v1:$date.sig vulndb.zip.sig
130+
- name: Push the signatures to the GitHub Container Registry (snapshot)
131+
if: ${{ github.event.inputs.run_generate_snapshot == 'true' }}
132+
run: |
133+
oras push ghcr.io/l3montree-dev/devguard/vulndb/v1:$date-snapshot.sig vulndb.zip.sig

‎.github/workflows/vulndb.yaml‎

Lines changed: 15 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,8 @@ name: VulnDB Workflow
22

33
on:
44
workflow_dispatch:
5-
inputs:
6-
run_generate_snapshot:
7-
description: "Run generate snapshot job"
8-
required: false
9-
default: "false"
105
schedule:
11-
- cron: "0 */6 * * *" # every hour
6+
- cron: "0 */1 * * *"
127

138
permissions:
149
contents: read
@@ -19,7 +14,6 @@ env:
1914
POSTGRES_USER: devguard
2015
POSTGRES_HOST: localhost
2116
POSTGRES_PASSWORD: not_reachable_from_the_internet
22-
DATE: $(date +%s)
2317

2418
jobs:
2519
build:
@@ -28,14 +22,14 @@ jobs:
2822
FRONTEND_URL: "doesntmatter"
2923
services:
3024
postgres:
31-
image: ghcr.io/l3montree-dev/devguard-postgresql:v0.5.3@sha256:a06c9e7c8ee334790cc66d52e89ff5ef05352ab264841d3d9f3659c046732251
25+
image: ghcr.io/l3montree-dev/devguard/postgresql:v1.3.1
3226
env:
3327
POSTGRES_DB: ${{env.POSTGRES_DB}}
3428
POSTGRES_USER: ${{env.POSTGRES_USER}}
3529
POSTGRES_PASSWORD: ${{env.POSTGRES_PASSWORD}}
3630
ports:
3731
- 5432:5432
38-
options: '--health-cmd="pg_isready -U devguard" --health-interval=10s --health-timeout=5s --health-retries=5 '
32+
options: '--health-cmd="pg_isready -U devguard" --health-interval=10s --health-timeout=5s --health-retries=5 --tmpfs /docker-entrypoint-initdb.d --tmpfs /run/postgresql'
3933
steps:
4034
- name: Install postgresql client
4135
run: |
@@ -56,39 +50,11 @@ jobs:
5650
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0 - https://github.com/actions/setup-go/releases/tag/v5.5.0
5751
with:
5852
go-version: "1.25"
59-
- name: Build the database (this takes some time)
53+
- name: Export the vulnerability database archive
6054
run: |
61-
# will fetch the latest build database from ghcr.io
62-
go run ./cmd/devguard-cli/main.go vulndb sync
63-
64-
- name: Dump the PostgreSQL database
65-
if: ${{ github.event.inputs.run_generate_snapshot == 'true' }}
66-
# skip:checkov:CKV_SECRET_6
67-
run: |
68-
PGPASSWORD=${{env.POSTGRES_PASSWORD}} psql -h localhost -U devguard devguard -c "COPY (SELECT * FROM affected_components) TO STDOUT WITH DELIMITER ',' CSV HEADER" > affected_components.csv
69-
PGPASSWORD=${{env.POSTGRES_PASSWORD}} psql -h localhost -U devguard devguard -c "COPY (SELECT * FROM cve_affected_component) TO STDOUT WITH DELIMITER ',' CSV HEADER" > cve_affected_component.csv
70-
PGPASSWORD=${{env.POSTGRES_PASSWORD}} psql -h localhost -U devguard devguard -c "COPY (SELECT * FROM cves) TO STDOUT WITH DELIMITER ',' CSV HEADER" > cves.csv
71-
PGPASSWORD=${{env.POSTGRES_PASSWORD}} psql -h localhost -U devguard devguard -c "COPY (SELECT * FROM cwes) TO STDOUT WITH DELIMITER ',' CSV HEADER" > cwes.csv
72-
PGPASSWORD=${{env.POSTGRES_PASSWORD}} psql -h localhost -U devguard devguard -c "COPY (SELECT * FROM exploits) TO STDOUT WITH DELIMITER ',' CSV HEADER" > exploits.csv
73-
PGPASSWORD=${{env.POSTGRES_PASSWORD}} psql -h localhost -U devguard devguard -c "COPY (SELECT * FROM malicious_packages) TO STDOUT WITH DELIMITER ',' CSV HEADER" > malicious_packages.csv
74-
PGPASSWORD=${{env.POSTGRES_PASSWORD}} psql -h localhost -U devguard devguard -c "COPY (SELECT * FROM malicious_affected_components) TO STDOUT WITH DELIMITER ',' CSV HEADER" > malicious_affected_components.csv
75-
# PGPASSWORD=${{env.POSTGRES_PASSWORD}} psql -h localhost -U devguard devguard -c "COPY (SELECT * FROM weaknesses) TO STDOUT WITH DELIMITER ',' CSV HEADER" > weaknesses.csv
76-
PGPASSWORD=${{env.POSTGRES_PASSWORD}} psql -h localhost -U devguard devguard -c "COPY (SELECT * FROM cve_relationships) TO STDOUT WITH DELIMITER ',' CSV HEADER" > cve_relationships.csv
77-
- name: Export the diff csv files (this does not take some time)
78-
if: ${{ github.event.inputs.run_generate_snapshot == 'false' || github.event.inputs.run_generate_snapshot == '' }}
79-
run: |
80-
# writes the difference from the db before and after the sync into csv files
55+
# writes the database snapshot files and bundles them into a single tar.zst archive
8156
go run ./cmd/devguard-cli/main.go vulndb export
8257
83-
- name: install zip
84-
run: sudo apt-get install zip
85-
86-
- name: Zip the CSV files
87-
if: ${{ github.event.inputs.run_generate_snapshot == 'true' }}
88-
run: zip vulndb.zip affected_components.csv cve_affected_component.csv cves.csv cwes.csv exploits.csv malicious_packages.csv malicious_affected_components.csv cve_relationships.csv
89-
- name: Zip the CSV files
90-
if: ${{ github.event.inputs.run_generate_snapshot == 'false' || github.event.inputs.run_generate_snapshot == '' }}
91-
run: zip -r vulndb.zip diffs-tmp
9258
- name: Install Cosign
9359
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
9460
with:
@@ -97,10 +63,12 @@ jobs:
9763
- name: Write signing key to disk
9864
run: echo "${{ secrets.COSIGN_PRIVATE_KEY }}" > cosign.key
9965

100-
- name: Sign the database zip file
66+
- name: Sign the database archive
10167
env:
10268
COSIGN_PASSWORD: ""
103-
run: cosign import-key-pair --key cosign.key && cosign sign-blob --yes --key import-cosign.key vulndb.zip > vulndb.zip.sig
69+
run: |
70+
cosign import-key-pair --key cosign.key
71+
cosign sign-blob --yes --key import-cosign.key vulndb.tar.zst > vulndb.tar.zst.sig
10472
- name: Login to GitHub Container Registry
10573
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
10674
with:
@@ -110,23 +78,11 @@ jobs:
11078
- name: Setup oras cli
11179
uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1
11280

113-
- name: set the date
114-
run: echo "date="${{env.DATE}} >> "$GITHUB_ENV"
115-
116-
- name: Push the database ZIP file to GitHub Container Registry (vulndb/v1)
117-
if: ${{ github.event.inputs.run_generate_snapshot == 'false' || github.event.inputs.run_generate_snapshot == '' }}
118-
run: |
119-
oras push ghcr.io/l3montree-dev/devguard/vulndb/v1:$date vulndb.zip
120-
121-
- name: Push the database ZIP file to GitHub Container Registry (snapshot)
122-
if: ${{ github.event.inputs.run_generate_snapshot == 'true' }}
123-
run: |
124-
oras push ghcr.io/l3montree-dev/devguard/vulndb/v1:$date-snapshot vulndb.zip
125-
- name: Push the signatures to the GitHub Container Registry
126-
if: ${{ github.event.inputs.run_generate_snapshot == 'false' || github.event.inputs.run_generate_snapshot == '' }}
81+
- name: Push the database archive to GitHub Container Registry
12782
run: |
128-
oras push ghcr.io/l3montree-dev/devguard/vulndb/v1:$date.sig vulndb.zip.sig
129-
- name: Push the signatures to the GitHub Container Registry (snapshot)
130-
if: ${{ github.event.inputs.run_generate_snapshot == 'true' }}
83+
oras push ghcr.io/l3montree-dev/devguard/vulndb/v2:latest \
84+
vulndb.tar.zst
85+
- name: Push the archive signature to the GitHub Container Registry
13186
run: |
132-
oras push ghcr.io/l3montree-dev/devguard/vulndb/v1:$date-snapshot.sig vulndb.zip.sig
87+
oras push ghcr.io/l3montree-dev/devguard/vulndb/v2:latest.sig \
88+
vulndb.tar.zst.sig

‎.vscode/launch.json‎

Lines changed: 34 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -42,16 +42,16 @@
4242
"program": "${workspaceRoot}/cmd/devguard/main.go",
4343
"args": [],
4444
},
45-
{
46-
"name": "Launch DepTreeWalk",
47-
"type": "go",
48-
"request": "launch",
49-
"cwd": "${workspaceRoot}",
50-
"mode": "auto",
51-
"program": "${workspaceRoot}/cmd/devguard-cli/test",
52-
"args": [
53-
],
54-
},
45+
{
46+
"name": "Launch DepTreeWalk",
47+
"type": "go",
48+
"request": "launch",
49+
"cwd": "${workspaceRoot}",
50+
"mode": "auto",
51+
"program": "${workspaceRoot}/cmd/devguard-cli/test",
52+
"args": [
53+
],
54+
},
5555
{
5656
"name": "Launch Policy eval",
5757
"type": "go",
@@ -105,6 +105,30 @@
105105
"epss"
106106
]
107107
},
108+
{
109+
"name": "VulnDB Import",
110+
"type": "go",
111+
"request": "launch",
112+
"cwd": "${workspaceRoot}",
113+
"mode": "auto",
114+
"program": "${workspaceRoot}/cmd/devguard-cli/main.go",
115+
"args": [
116+
"vulndb",
117+
"import"
118+
]
119+
},
120+
{
121+
"name": "VulnDB ExportRC",
122+
"type": "go",
123+
"request": "launch",
124+
"cwd": "${workspaceRoot}",
125+
"mode": "auto",
126+
"program": "${workspaceRoot}/cmd/devguard-cli/main.go",
127+
"args": [
128+
"vulndb",
129+
"export"
130+
]
131+
},
108132
{
109133
"name": "Scanner attestations",
110134
"type": "go",

0 commit comments

Comments
 (0)