bsodfather
0e8f1ca03a
Добавить структурированные журналы, метрики, трассировку и безопасный канал критических ошибок. Усилить границы рантайма, тесты, проверку зависимостей и сценарии развёртывания.
30 lines
871 B
Bash
Executable File
30 lines
871 B
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
if [ "$#" -eq 0 ]; then
|
|
echo "usage: scripts/scan-images.sh IMAGE [IMAGE ...]" >&2
|
|
exit 2
|
|
fi
|
|
|
|
trivy_version="0.70.0"
|
|
archive="trivy_${trivy_version}_Linux-64bit.tar.gz"
|
|
expected_sha256="8b4376d5d6befe5c24d503f10ff136d9e0c49f9127a4279fd110b727929a5aa9"
|
|
temp_dir="$(mktemp -d)"
|
|
trap 'rm -rf "$temp_dir"' EXIT HUP INT TERM
|
|
|
|
curl --fail --silent --show-error --location \
|
|
"https://github.com/aquasecurity/trivy/releases/download/v${trivy_version}/${archive}" \
|
|
--output "$temp_dir/$archive"
|
|
printf '%s %s\n' "$expected_sha256" "$temp_dir/$archive" | sha256sum --check --status
|
|
tar -C "$temp_dir" -xzf "$temp_dir/$archive" trivy
|
|
|
|
for image in "$@"; do
|
|
"$temp_dir/trivy" image \
|
|
--exit-code 1 \
|
|
--ignore-unfixed \
|
|
--severity HIGH,CRITICAL \
|
|
--scanners vuln \
|
|
--no-progress \
|
|
"$image"
|
|
done
|