public/k3s
1
0
Fork 0
mirror of https://git.vectorsigma.ru/public/k3s.git synced 2026-07-29 00:39:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

Pass Rancher's VEX report to Trivy to remove known false-positives CVEs (#10956)

Browse Source 
Signed-off-by: Guilherme Macedo <guilherme@gmacedo.com>
This commit is contained in:
Guilherme Macedo
2024-10-01 18:20:35 -03:00
committed by GitHub
parent 6c6d87d1b0
commit 0553a1a1d9
2 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
scripts/image_scan.sh
View File

@@ -31,7 +31,11 @@ TRIVY_TEMPLATE='{{- $critical := 0 }}{{- $high := 0 }}
{{- end -}}
{{ end }}
Vulnerabilities - Critical: {{ $critical }}, High: {{ $high }}{{ println }}'
VEX_REPORT="rancher.openvex.json"
trivy --quiet image --severity ${SEVERITIES} --no-progress --ignore-unfixed --format template --template "${TRIVY_TEMPLATE}" ${IMAGE}
# Download Rancher's VEX Hub standalone report
curl -fsS -o ${VEX_REPORT} https://raw.githubusercontent.com/rancher/vexhub/refs/heads/main/reports/rancher.openvex.json
trivy --quiet image --severity ${SEVERITIES} --vex ${VEX_REPORT} --no-progress --ignore-unfixed --format template --template "${TRIVY_TEMPLATE}" ${IMAGE}
exit 0