updates cosign, trivy, gitleaks and crane binaries

Author: timbastin

Dockerfile.scanner

@@ -5,22 +5,42 @@ WORKDIR /app
 
 ARG TARGETPLATFORM
 
-ENV CRANE_VERSION=v0.19.1
+ENV CRANE_VERSION=v0.20.6
 ENV OS=Linux
 ENV ARCH=x86_64
+ENV TRIVY_VERSION=v0.65.0
+ENV COSIGN_VERSION=v2.5.3
+ENV GITLEAKS_VERSION=v8.28.0
 
-RUN curl -sL "https://github.com/google/go-containerregistry/releases/download/${CRANE_VERSION}/go-containerregistry_${OS}_${ARCH}.tar.gz" > go-containerregistry.tar.gz && \
-    tar -zxvf go-containerregistry.tar.gz -C /usr/local/bin/ crane
-
-# install trivy   
-RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.62.1
+# Expected checksums for security verification
+ENV CRANE_CHECKSUM=c1d593d01551f2c9a3df5ca0a0be4385a839bd9b86d4a76e18d7b17d16559127
+ENV TRIVY_CHECKSUM=f0c5e3c912e7f5194a0efc85dfd34c94c63c4a4184b2d7b97ec7718661f5ead2
+ENV COSIGN_CHECKSUM=783b5d6c74105401c63946c68d9b2a4e1aab3c8abce043e06b8510b02b623ec9
+ENV GITLEAKS_CHECKSUM=a65b5253807a68ac0cafa4414031fd740aeb55f54fb7e55f386acb52e6a840eb
 
-# install cosign
-RUN curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64" && mv cosign-linux-amd64 /usr/local/bin/cosign && chmod +x /usr/local/bin/cosign
-
-# install gitleaks
-RUN curl -O -L "https://github.com/gitleaks/gitleaks/releases/download/v8.24.2/gitleaks_8.24.2_linux_x64.tar.gz" && \
-    tar -zxvf gitleaks_8.24.2_linux_x64.tar.gz -C /usr/local/bin/ gitleaks   
+# install crane with checksum verification
+RUN curl -sL "https://github.com/google/go-containerregistry/releases/download/${CRANE_VERSION}/go-containerregistry_${OS}_${ARCH}.tar.gz" > go-containerregistry.tar.gz && \
+    echo "${CRANE_CHECKSUM}  go-containerregistry.tar.gz" | sha256sum -c - && \
+    tar -zxvf go-containerregistry.tar.gz -C /usr/local/bin/ crane && \
+    rm go-containerregistry.tar.gz
+
+# install trivy with checksum verification
+RUN curl -sL "https://github.com/aquasecurity/trivy/releases/download/${TRIVY_VERSION}/trivy_$(echo ${TRIVY_VERSION} | sed 's/v//')_Linux-64bit.tar.gz" > trivy.tar.gz && \
+    echo "${TRIVY_CHECKSUM}  trivy.tar.gz" | sha256sum -c - && \
+    tar -zxvf trivy.tar.gz -C /usr/local/bin/ trivy && \
+    rm trivy.tar.gz
+
+# install cosign with checksum verification
+RUN curl -sL "https://github.com/sigstore/cosign/releases/download/${COSIGN_VERSION}/cosign-linux-amd64" > cosign-linux-amd64 && \
+    echo "${COSIGN_CHECKSUM}  cosign-linux-amd64" | sha256sum -c - && \
+    mv cosign-linux-amd64 /usr/local/bin/cosign && \
+    chmod +x /usr/local/bin/cosign
+
+# install gitleaks with checksum verification
+RUN curl -sL "https://github.com/gitleaks/gitleaks/releases/download/${GITLEAKS_VERSION}/gitleaks_$(echo ${GITLEAKS_VERSION} | sed 's/v//')_linux_x64.tar.gz" > gitleaks.tar.gz && \
+    echo "${GITLEAKS_CHECKSUM}  gitleaks.tar.gz" | sha256sum -c - && \
+    tar -zxvf gitleaks.tar.gz -C /usr/local/bin/ gitleaks && \
+    rm gitleaks.tar.gz   
 
 #install unzip
 RUN apt-get update && apt-get install -y unzip