tegwick
312ab97e87
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
19 lines
2 KiB
Python
19 lines
2 KiB
Python
from pathlib import Path
|
|
import json,hashlib,subprocess,datetime,shutil
|
|
root=Path('/tmp/infd-zlib-published-9b4bb25d');cache=Path('/tmp/infd-zlib-published-scan-cache');(cache/'db').mkdir(parents=True,exist_ok=False)
|
|
for name in ['trivy.db','metadata.json']:shutil.copy2(Path('/tmp/infd-zlib-scan-cache/db')/name,cache/'db'/name)
|
|
meta=json.loads((cache/'db/metadata.json').read_text());nextupdate=datetime.datetime.fromisoformat(meta['NextUpdate'].replace('Z','+00:00'))
|
|
records=[]
|
|
for image,prefix in [('base-image.tar','base-'),('image.tar','')]:
|
|
for fmt,name in [('json','trivy-full.json'),('cyclonedx','sbom.cdx.json')]:
|
|
now=datetime.datetime.now(datetime.timezone.utc)
|
|
if now>=nextupdate:raise SystemExit('Fresh DB required; refusing stale scan')
|
|
cmd=['docker','--config','/tmp/infd-purpose-published-verification/empty-docker-config','--host','unix:///var/run/docker.sock','run','--rm','--network','none','--cpus','1','--memory','1g','-v',str(root)+':/artifact','-v',str(cache)+':/cache','aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969','image','--input','/artifact/'+image,'--cache-dir','/cache','--skip-db-update','--skip-java-db-update','--scanners','vuln','--format',fmt,'--output','/artifact/'+prefix+name]
|
|
r=subprocess.run(cmd,capture_output=True,text=True);(root/(prefix+name+'.log')).write_text(r.stdout+r.stderr)
|
|
records.append({'archive':image,'format':fmt,'started_utc':now.isoformat(),'exit_code':r.returncode,'command':cmd})
|
|
if r.returncode:raise SystemExit('Actual scanner failed; retained log')
|
|
sha=hashlib.sha256()
|
|
with (cache/'db/trivy.db').open('rb') as f:
|
|
for b in iter(lambda:f.read(1024*1024),b''):sha.update(b)
|
|
(root/'scan-receipt.json').write_text(json.dumps({'scanner':'aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969','db_sha256':sha.hexdigest(),'db_metadata':meta,'same_fresh_db_both_images':True,'no_suppression':True,'records':records},indent=2)+'\n')
|
|
print(json.dumps({'scans':len(records),'same_fresh_db':True,'db_sha256':sha.hexdigest()}))
|