@@ -58,24 +58,26 @@ get_images() {
5858# Generate ignored vulnerabilities file
5959generate_trivy_ignore () {
6060 local imagename=$1
61- local global_vulnerabilities=$( yq .global_allowed_vulnerabilities[] src/kayobe-config/etc/kayobe/trivy/allowed-vulnerabilities.yml 2> /dev/null)
62- local image_vulnerabilities=$( yq .$imagename ' _allowed_vulnerabilities[]' 2> /dev/null)
61+ local global_vulnerabilities
62+ global_vulnerabilities=$( yq .global_allowed_vulnerabilities[] src/kayobe-config/etc/kayobe/trivy/allowed-vulnerabilities.yml 2> /dev/null)
63+ local image_vulnerabilities
64+ image_vulnerabilities=$( yq ." $imagename " ' _allowed_vulnerabilities[]' 2> /dev/null)
6365
6466 touch .trivyignore
6567 for vulnerability in $global_vulnerabilities ; do
66- echo $vulnerability >> .trivyignore
68+ echo " $vulnerability " >> .trivyignore
6769 done
6870 for vulnerability in $image_vulnerabilities ; do
69- echo $vulnerability >> .trivyignore
71+ echo " $vulnerability " >> .trivyignore
7072 done
7173}
7274
7375# Put results into CSV
7476generate_summary_csv () {
75- local imagename= $1
76- local filename= $2
77+ local scan= " $1 "
78+ local summary= " $2 "
7779
78- echo ' "PkgName","PkgPath","PkgID","VulnerabilityID","FixedVersion","PrimaryURL","Severity"' > image-scan-output/ ${imagename} / ${filename} - summary.csv
80+ echo ' "PkgName","PkgPath","PkgID","VulnerabilityID","FixedVersion","PrimaryURL","Severity"' > " $ summary"
7981
8082 jq -r ' .Results[]
8183 | select(.Vulnerabilities)
@@ -94,16 +96,15 @@ generate_summary_csv() {
9496 ]
9597 )
9698 | .[]
97- | @csv' image-scan-output/ ${imagename} / ${filename} - scan.json >> image-scan-output/ ${imagename} / ${filename} - summary.csv
99+ | @csv' " $ scan" >> " $ summary"
98100}
99101
100102# Categorise images based on severity
101103categorise_image () {
102- local imagename=$1
103- local filename=$2
104- local image=$3
104+ local summary=" $1 "
105+ local image=" $2 "
105106
106- if [ $( grep " CRITICAL" image-scan-output/ ${imagename} / ${filename} - summary.csv -c) -gt 0 ]; then
107+ if [ " $( grep " CRITICAL" " $ summary" ) " -gt 0 ]; then
107108 echo " ${image} " >> image-scan-output/critical-images.txt
108109 else
109110 echo " ${image} " >> image-scan-output/high-images.txt
@@ -112,45 +113,78 @@ categorise_image() {
112113
113114# Generate SBOM, return correct scan command for SBOM
114115generate_sbom () {
115- local imagename= $1
116- local filename= $2
117- local image=$3
116+ local sbom= " $1 "
117+ local scan= " $2 "
118+ local image=" $3 "
118119 trivy image \
120+ --debug \
119121 --format spdx-json \
120- --output image-scan-output/${imagename} /${filename} -sbom.json \
121- $image > /dev/null 2>&1
122- echo " trivy sbom $scan_common_args \
123- --output image-scan-output/${imagename} /${filename} -scan.json \
124- image-scan-output/${imagename} /${filename} -sbom.json"
122+ --output " $sbom "
123+ " $image " & > " $sbom .log"
124+ if [ ! -e " $sbom " ; then
125+ (
126+ echo " ERROR: trivy image didn't produce the sbom file $sbom for $image " 1>&2
127+ echo " ==== trivy log ===="
128+ cat " $sbom .log"
129+ ) 1>&2
130+ exit 1
131+ elif grep -q FATAL " $sbom .log" ; then
132+ (
133+ echo " ERROR: trivy image encountered a fatal error producing $sbom for $image "
134+ echo " ==== trivy log ===="
135+ cat " $sbom .log"
136+ echo " ==== sbom.json ===="
137+ cat " $sbom "
138+ ) 1>&2
139+ exit 1
140+ else
141+ echo " trivy sbom $scan_common_args --output $scan $sbom "
142+ fi
125143}
126144
127145# Scan images, generate SBOMs if requested
128146scan_image () {
129147 local image=$1
130- local filename=$( basename $image | sed ' s/:/\./g' )
131- local imagename=$( echo $filename | cut -d " ." | sed ' s/-/_/g' )
148+ local filename
149+ filename=$( basename " $image " | sed ' s/:/\./g' )
150+ local imagename
151+ imagename=$( echo " $filename " | cut -d " ." | sed ' s/-/_/g' )
152+ local sbom=" image-scan-output/${imagename} /${filename} -sbom.json"
153+ local scan=" image-scan-output/${imagename} /${filename} -scan.json"
154+ local summary=" image-scan-output/${imagename} /${filename} -summary.csv"
132155
133- mkdir -p image-scan-output/$imagename
134- generate_trivy_ignore $imagename
156+ mkdir -p " image-scan-output/$imagename "
157+ generate_trivy_ignore " $imagename "
135158
136159 # If SBOM is required, generate it first and scan the results, otherwise we
137160 # scan the image directly.
138161 if $generate_sbom ; then
139162 echo " Generating SBOM for $imagename "
140- scan_command=$( generate_sbom $imagename $filename $image )
163+ scan_command=" $( generate_sbom " $sbom " " $scan " " $image " ) "
141164 else
142- scan_command=" trivy image $scan_common_args \
143- --output image-scan-output/${imagename} /${filename} -scan.json $image "
165+ scan_command=" trivy image $scan_common_args --output $scan $image "
144166 fi
145167
146168 # Run scan against image or SBOM, format output. If no results, delete files.
147169 echo " Scanning $imagename for vulnerabilities"
148- if $scan_command > /dev/null 2>&1 ; then
149- rm -f image-scan-output/ ${imagename} / ${filename} - scan.json
170+ if $scan_command >& " $scan .log " ; then
171+ rm -f " $ scan"
150172 echo " ${image} " >> image-scan-output/clean-images.txt
173+ elif [ ! -f " $scan " ; then
174+ (
175+ echo " ERROR: trivy scan encountered an error producing $scan "
176+ echo " Command: $scan_command "
177+ echo " ==== trivy log ===="
178+ cat " $scan .log"
179+ if $generate_sbom ; then
180+ echo " ==== sbom.json ===="
181+ cat " $sbom "
182+ fi
183+ ) 1>&2
184+ exit 1
151185 else
152- generate_summary_csv $imagename $filename
153- categorise_image $imagename $filename $ image
186+ generate_summary_csv " $scan " " $summary "
187+ categorise_image " $summary " " $ image"
154188 fi
155189}
156190
@@ -170,9 +204,9 @@ main() {
170204 check_deps_installed
171205 file_prep
172206
173- images=$( get_images $1 $2 )
207+ images=$( get_images " $1 " " $2 " )
174208 for image in $images ; do
175- scan_image $image
209+ scan_image " $image "
176210 done
177211}
178212
0 commit comments