Skip to content

Commit 68abf63

Browse files
deansheatherdeansheather
committed
feat: add ironbank trivy scanning
1 parent 5415709 commit 68abf63

File tree

6 files changed

+151
-10
lines changed

6 files changed

+151
-10
lines changed

‎.github/workflows/security.yaml

Lines changed: 30 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,9 @@ jobs:
9292
restore-keys: |
9393
js-${{ runner.os }}-
9494
95+
- name: Install yq
96+
run: go run github.com/mikefarah/yq/v4@v4.30.6
97+
9598
- name: Build Coder linux amd64 Docker image
9699
id: build
97100
run: |
@@ -100,6 +103,17 @@ jobs:
100103
DOCKER_IMAGE_NO_PREREQUISITES=true make -j "$image_job"
101104
echo "image=$(cat "$image_job")" >> $GITHUB_OUTPUT
102105
106+
- name: Build Coder linux amd64 Docker image (ironbank)
107+
id: build-ironbank
108+
run: |
109+
set -euo pipefail
110+
# NOTE: This is not a real image tag we publish.
111+
image_tag="ghcr.io/coder/coder/ironbank:v$(./scripts/version.sh)"
112+
./scripts/ironbank/build_ironbank.sh \
113+
--target "$image_tag" \
114+
"build/coder_$(./scripts/version.sh)_linux_amd64"
115+
echo "image=$image_tag" >> $GITHUB_OUTPUT
116+
103117
- name: Run Trivy vulnerability scanner
104118
uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
105119
with:
@@ -113,9 +127,24 @@ jobs:
113127
with:
114128
sarif_file: trivy-results.sarif
115129

130+
- name: Run Trivy vulnerability scanner (ironbank)
131+
uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
132+
with:
133+
image-ref: ${{ steps.build-ironbank.outputs.image }}
134+
format: sarif
135+
output: trivy-results-ironbank.sarif
136+
severity: "CRITICAL,HIGH"
137+
138+
- name: Upload Trivy scan results to GitHub Security tab (ironbank)
139+
uses: github/codeql-action/upload-sarif@v2
140+
with:
141+
sarif_file: trivy-results-ironbank.sarif
142+
116143
- name: Upload Trivy scan results as an artifact
117144
uses: actions/upload-artifact@v2
118145
with:
119146
name: trivy
120-
path: trivy-results.sarif
147+
path: |
148+
trivy-results.sarif
149+
trivy-results-ironbank.sarif
121150
retention-days: 7

‎scripts/ironbank/.gitignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
11
coder.tar.gz
22
terraform.zip
33
terraform-provider-coder.zip
4+
5+
.terraform.zip.*
6+
.terraform-provider-coder.zip.*

‎scripts/ironbank/Dockerfile

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -42,20 +42,22 @@ RUN echo "FIPS" >/etc/crypto-policies/config && \
4242
ln --symbolic --force /usr/share/crypto-policies/FIPS/openssl.txt /etc/crypto-policies/back-ends/openssl.config && \
4343
ln --symbolic --force /usr/share/crypto-policies/FIPS/opensslcnf.txt /etc/crypto-policies/back-ends/opensslcnf.config
4444

45-
# Copy and extract Coder binary from tar file.
45+
# Copy and extract Coder binary from tar file. We have to put this in /opt to
46+
# match the Dockerfile.
4647
ARG CODER_BIN=/opt/coder
47-
RUN mkdir -p /opt
4848
ARG CODER_BIN_TAR_GZ=coder.tar.gz
4949
COPY "$CODER_BIN_TAR_GZ" /tmp/coder.tar.gz
50-
RUN tar -xzvf /tmp/coder.tar.gz --directory /opt --strip-components=1 ./coder && \
50+
RUN mkdir -p /opt && \
51+
tar -xzvf /tmp/coder.tar.gz --directory /opt --strip-components=1 ./coder && \
5152
rm /tmp/coder.tar.gz
53+
ENV PATH="/opt:${PATH}"
5254

5355
# Copy and extract Terraform binary from zip file.
5456
ARG TERRAFORM_BIN_DIR=/opt/terraform
55-
RUN mkdir -p "$TERRAFORM_BIN_DIR"
5657
ARG TERRAFORM_BIN_ZIP=terraform.zip
5758
COPY "$TERRAFORM_BIN_ZIP" /tmp/terraform.zip
58-
RUN unzip /tmp/terraform.zip -d "$CODER_BIN_DIR" && \
59+
RUN mkdir -p "$TERRAFORM_BIN_DIR" && \
60+
unzip /tmp/terraform.zip -d "$TERRAFORM_BIN_DIR" && \
5961
rm /tmp/terraform.zip
6062
ENV PATH="${TERRAFORM_BIN_DIR}:${PATH}"
6163

‎scripts/ironbank/build_ironbank.sh

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
#!/usr/bin/env bash
2+
3+
# This script builds the ironbank Docker image of Coder containing the given
4+
# binary. Other dependencies will be automatically downloaded and cached.
5+
#
6+
# Usage: ./build_ironbank.sh --target image_tag path/to/coder
7+
8+
set -euo pipefail
9+
# shellcheck source=scripts/lib.sh
10+
source "$(dirname "${BASH_SOURCE[0]}")/../lib.sh"
11+
12+
image_tag=""
13+
14+
args="$(getopt -o "" -l target: -- "$@")"
15+
eval set -- "$args"
16+
while true; do
17+
case "$1" in
18+
--target)
19+
image_tag="$2"
20+
shift 2
21+
;;
22+
--)
23+
shift
24+
break
25+
;;
26+
*)
27+
error "Unrecognized option: $1"
28+
;;
29+
esac
30+
done
31+
32+
if [[ "$image_tag" == "" ]]; then
33+
error "The --image-tag parameter is required"
34+
fi
35+
36+
# Check dependencies
37+
dependencies docker sha256sum yq
38+
if [[ $(yq --version) != *" v4."* ]]; then
39+
error "yq version 4 is required"
40+
fi
41+
42+
if [[ "$#" != 1 ]]; then
43+
error "Exactly one argument must be provided to this script, $# were supplied"
44+
fi
45+
if [[ ! -f "$1" ]]; then
46+
error "File '$1' does not exist or is not a regular file"
47+
fi
48+
input_file="$(realpath "$1")"
49+
50+
# Make temporary dir for Docker build context.
51+
tmpdir="$(mktemp -d)"
52+
trap 'rm -rf "$tmpdir"' EXIT
53+
pushd "$(dirname "${BASH_SOURCE[0]}")"
54+
cp Dockerfile "$tmpdir/"
55+
cp terraform-filesystem-mirror.tfrc "$tmpdir/"
56+
popd
57+
58+
# Create a coder.tar.gz file.
59+
execrelative ../archive.sh \
60+
--format tar.gz \
61+
--os linux \
62+
--output "$tmpdir/coder.tar.gz" \
63+
"$input_file"
64+
65+
# Download all resources in the hardening_manifest.yaml file except for
66+
# coder.tar.gz (which we will make ourselves).
67+
manifest_path="$(dirname "${BASH_SOURCE[0]}")/hardening_manifest.yaml"
68+
resources="$(yq e '.resources[] | select(.filename != "coder.tar.gz") | [.filename, .url, .validation.value] | @tsv' "$manifest_path")"
69+
while read -r line; do
70+
filename="$(echo "$line" | cut -f1)"
71+
url="$(echo "$line" | cut -f2)"
72+
sha256_hash="$(echo "$line" | cut -f3)"
73+
74+
pushd "$(dirname "${BASH_SOURCE[0]}")"
75+
target=".${filename}.${sha256_hash}"
76+
if [[ ! -f "$target" ]]; then
77+
log "Downloading $filename"
78+
curl -sSL "$url" -o "$target"
79+
fi
80+
81+
sum="$(sha256sum "$target" | cut -d' ' -f1)"
82+
if [[ "$sum" != "$sha256_hash" ]]; then
83+
rm "$target"
84+
error "Downloaded $filename has hash $sum, but expected $sha256_hash"
85+
fi
86+
cp "$target" "$tmpdir/$filename"
87+
popd
88+
done <<<"$resources"
89+
90+
terraform_coder_provider_version="$(yq e '.args.TERRAFORM_CODER_PROVIDER_VERSION' "$manifest_path")"
91+
if [[ "$terraform_coder_provider_version" == "" ]]; then
92+
error "TERRAFORM_CODER_PROVIDER_VERSION not found in hardening_manifest.yaml"
93+
fi
94+
95+
# Build the image.
96+
pushd "$tmpdir"
97+
docker build \
98+
--build-arg BASE_REGISTRY=registry.access.redhat.com \
99+
--build-arg BASE_IMAGE=ubi8/ubi-minimal \
100+
--build-arg BASE_TAG=8.7 \
101+
--build-arg TERRAFORM_CODER_PROVIDER_VERSION="$terraform_coder_provider_version" \
102+
-t "$image_tag" \
103+
. >&2
104+
popd
105+
106+
echo "$image_tag"

‎scripts/ironbank/hardening_manifest.yaml

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,6 @@ tags:
1212

1313
# Build args passed to Dockerfile ARGs
1414
args:
15-
BASE_IMAGE: "redhat/ubi/ubi8"
16-
BASE_TAG: "8.7"
1715
# Needs to be kept in sync with the resource below.
1816
TERRAFORM_CODER_PROVIDER_VERSION: "0.6.10"
1917

@@ -48,11 +46,14 @@ resources:
4846
value: b8cf184dee15dfa89713fe56085313ab23db22e17284a9a27c0999c67ce3021e
4947
# Coder Terraform provider, bundled inside of Coder to support air-gapped
5048
# installs.
49+
#
50+
# The version of this provider needs to be kept in sync with the
51+
# TERRAFORM_CODER_PROVIDER_VERSION build arg.
5152
- url: https://github.com/coder/terraform-provider-coder/releases/download/v0.6.10/terraform-provider-coder_0.6.10_linux_amd64.zip
5253
filename: "terraform-provider-coder.zip"
5354
validation:
5455
type: sha256
55-
value: de6db7814d4995938dcfa46a6d5b28bf9efb095fecf737285f52cfd4c85948c5
56+
value: 4c2a16010621e146251f6fb5e27105dde9213d85ca8f3c8866c3f5a4159b81b0
5657

5758
# List of project maintainers
5859
maintainers:

‎scripts/lib.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ realpath() {
3939
}
4040

4141
# We have to define realpath before these otherwise it fails on Mac's bash.
42-
SCRIPT_DIR="$(realpath "$(dirname "${BASH_SOURCE[0]}")")"
42+
SCRIPT_DIR="$(realpath "$(dirname "${BASH_SOURCE[1]}")")"
4343
PROJECT_ROOT="$(cd "$SCRIPT_DIR" && realpath "$(git rev-parse --show-toplevel)")"
4444

4545
# pushd is a silent alternative to the real pushd shell command.

0 commit comments

Comments
 (0)