feat: judge, sign and verify netOrk's images in one place (NetOrk/netork#1390)
CI / Tests, lint (push) Successful in 18s
CI / Tests, lint (push) Successful in 18s
The CIS gate, the SBOM, the cosign signature and the matcher's verdict lived in NetOrk/base-os, the head of the chain. Every link below it -- base-python, engine, ui, satellite, the service images -- needs the same, so the tools move here, and every image repository pins them by commit. - image_tools: cis.py, cis_os.sh, sbom.py and verify.py from base-os. The image's own repository holds its cis.toml and packages.allow; both default to the working directory. - bin/sign.sh signs whatever platforms a reference holds: base-os's index of amd64 and arm64 (EXPECT_PLATFORMS) or a dev image's single manifest (image_tools/platforms.py). - bin/verify-base.sh checks every FROM image of a Dockerfile against cosign.pub before a build; one without a digest is refused (image_tools/dockerfile.py). - bin/install-cosign.sh installs cosign v3.1.3 for amd64 and arm64 runners, checked against the release checksums. - actions/verify-base, judge, sign wrap them for the workflows. - cosign.pub is the public half of the COSIGN_PRIVATE_KEY_B64 org secret, the key rotated on 2026-10-22.
This commit is contained in:
Christian Manivong committed
commit
d139d66c3d
27 files changed
+2085
No files matched your search
Whitespace-only changes.
@@ -0,0 +1,297 @@
|
||||
"""Is the image what CIS asks of it? (CIS Docker Benchmark 1.6.0 §4, CIS Debian Linux 12)
|
||||
|
||||
Two measurements, one verdict:
|
||||
|
||||
- Trivy's ``docker-cis-1.6.0`` spec, for the controls it automates (4.1, 4.4,
|
||||
4.6, 4.7, 4.9, 4.10); the rest it calls "Manual";
|
||||
- ``image_tools/cis_os.sh``, run inside the image as root, for what of that can be
|
||||
seen from inside (4.3, 4.8, 4.11) and the CIS Debian controls that make sense
|
||||
in a container.
|
||||
|
||||
The image's own repository decides the rest in ``cis.toml``: ``[[manual]]`` is
|
||||
met by how the image is made, ``[[exception]]`` fails on purpose, with a reason,
|
||||
until it expires. ``packages.allow`` there names the packages it may hold. The gate is red when a control fails without an exception, an
|
||||
exception has expired, a control is neither measured nor decided, a decision
|
||||
names a control nothing knows, or a measurement could not be taken.
|
||||
|
||||
python -m image_tools.cis <ref> [--decisions cis.toml] [--packages packages.allow] \
|
||||
--json cis.json --report cis.md
|
||||
|
||||
Both files default to the working directory: the image's repository.
|
||||
|
||||
Standard library only; Trivy runs as the container image_tools/verify.py pins.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import argparse
|
||||
import datetime
|
||||
import json
|
||||
import subprocess
|
||||
import tomllib
|
||||
from collections.abc import Callable
|
||||
from dataclasses import asdict, dataclass, field
|
||||
from pathlib import Path
|
||||
|
||||
from image_tools.verify import TIMEOUT, TRIVY_IMAGE
|
||||
|
||||
OS_CHECKS = Path(__file__).with_name("cis_os.sh")
|
||||
SPEC = "docker-cis-1.6.0"
|
||||
|
||||
PASS, FAIL, UNMEASURED = "pass", "fail", "unmeasured"
|
||||
#: What the gate makes of a control; the first three keep it green.
|
||||
GREEN = frozenset({"pass", "manual", "excepted"})
|
||||
|
||||
|
||||
@dataclass
|
||||
class Control:
|
||||
id: str
|
||||
title: str
|
||||
result: str
|
||||
detail: str = ""
|
||||
state: str = ""
|
||||
reason: str = ""
|
||||
|
||||
|
||||
@dataclass
|
||||
class Decision:
|
||||
kind: str
|
||||
reason: str
|
||||
expires: datetime.date | None = None
|
||||
|
||||
|
||||
@dataclass
|
||||
class Report:
|
||||
ok: bool
|
||||
controls: list[Control] = field(default_factory=list)
|
||||
stale: list[str] = field(default_factory=list)
|
||||
unknown: list[str] = field(default_factory=list)
|
||||
error: str | None = None
|
||||
|
||||
def to_json(self) -> str:
|
||||
return json.dumps(asdict(self), indent=2, default=str)
|
||||
|
||||
def failing(self) -> set[str]:
|
||||
return {c.id for c in self.controls if c.result == FAIL}
|
||||
|
||||
|
||||
def from_trivy(summary: dict) -> list[Control]:
|
||||
"""Trivy's compliance summary: no ``TotalFail`` means it did not measure."""
|
||||
controls = []
|
||||
for c in summary.get("SummaryControls") or []:
|
||||
fails = c.get("TotalFail")
|
||||
result = UNMEASURED if fails is None else (FAIL if fails else PASS)
|
||||
detail = f"{fails} failed (Trivy)" if fails else ""
|
||||
controls.append(Control(f"docker:{c['ID']}", c.get("Name", ""), result, detail))
|
||||
return controls
|
||||
|
||||
|
||||
def from_os(text: str) -> list[Control]:
|
||||
"""cis_os.sh's lines: id, PASS|FAIL, title, what fails."""
|
||||
controls = []
|
||||
for line in text.splitlines():
|
||||
if not line.strip():
|
||||
continue
|
||||
cid, result, title, detail = (line.split("\t") + ["", "", ""])[:4]
|
||||
if result not in ("PASS", "FAIL"):
|
||||
raise ValueError(f"cis_os.sh said: {line!r}")
|
||||
controls.append(Control(cid, title, result.lower(), detail))
|
||||
return controls
|
||||
|
||||
|
||||
def merge(*sources: list[Control]) -> list[Control]:
|
||||
"""One control per id, in order of first appearance; a failure wins, then a pass."""
|
||||
rank = {FAIL: 2, PASS: 1, UNMEASURED: 0}
|
||||
merged: dict[str, Control] = {}
|
||||
for controls in sources:
|
||||
for c in controls:
|
||||
known = merged.get(c.id)
|
||||
if known is None or rank[c.result] > rank[known.result]:
|
||||
if known is not None and not c.title:
|
||||
c.title = known.title
|
||||
merged[c.id] = c
|
||||
return list(merged.values())
|
||||
|
||||
|
||||
def load_decisions(text: str) -> dict[str, Decision]:
|
||||
data = tomllib.loads(text)
|
||||
decisions = {}
|
||||
for kind in ("manual", "exception"):
|
||||
for entry in data.get(kind) or []:
|
||||
if entry["id"] in decisions:
|
||||
raise ValueError(f"{entry['id']} is decided twice")
|
||||
if not entry.get("reason", "").strip():
|
||||
raise ValueError(f"{entry['id']} has no reason")
|
||||
if not isinstance(entry.get("expires", datetime.date.min), datetime.date):
|
||||
raise ValueError(f"{entry['id']}: expires is a date, not {entry['expires']!r}")
|
||||
decisions[entry["id"]] = Decision(kind, entry["reason"], entry.get("expires"))
|
||||
return decisions
|
||||
|
||||
|
||||
def judge(controls: list[Control], decisions: dict[str, Decision], today: datetime.date) -> Report:
|
||||
"""The gate on the measured *controls* and what ``cis.toml`` decided."""
|
||||
stale = []
|
||||
for c in controls:
|
||||
d = decisions.get(c.id)
|
||||
c.reason = d.reason if d else ""
|
||||
if d and d.kind == "manual":
|
||||
c.state = "manual"
|
||||
elif c.result == PASS:
|
||||
c.state = "pass"
|
||||
if d:
|
||||
stale.append(c.id)
|
||||
elif d and d.expires and d.expires < today:
|
||||
c.state = "expired"
|
||||
elif d:
|
||||
c.state = "excepted"
|
||||
else:
|
||||
c.state = "fail" if c.result == FAIL else "undecided"
|
||||
unknown = sorted(set(decisions) - {c.id for c in controls})
|
||||
ok = bool(controls) and not unknown and all(c.state in GREEN for c in controls)
|
||||
return Report(ok, controls, stale, unknown)
|
||||
|
||||
|
||||
def measure(
|
||||
ref: str,
|
||||
packages: list[str],
|
||||
*,
|
||||
trivy: Callable[[str], dict] | None = None,
|
||||
os_checks: Callable[[str, list[str]], str] | None = None,
|
||||
) -> list[Control]:
|
||||
trivy = trivy or trivy_compliance
|
||||
os_checks = os_checks or run_os_checks
|
||||
return merge(from_trivy(trivy(ref)), from_os(os_checks(ref, packages)))
|
||||
|
||||
|
||||
def check(
|
||||
ref: str,
|
||||
decisions: dict[str, Decision],
|
||||
packages: list[str],
|
||||
today: datetime.date,
|
||||
**seams,
|
||||
) -> Report:
|
||||
"""Measure *ref* and judge it; never raises."""
|
||||
try:
|
||||
return judge(measure(ref, packages, **seams), decisions, today)
|
||||
except (OSError, ValueError, KeyError, subprocess.SubprocessError) as exc:
|
||||
return Report(False, error=f"{type(exc).__name__}: {exc}")
|
||||
|
||||
|
||||
STATE_MARK = {
|
||||
"pass": "✅ pass",
|
||||
"manual": "📝 manual",
|
||||
"excepted": "⚠️ exception",
|
||||
"fail": "❌ fail",
|
||||
"expired": "❌ exception expired",
|
||||
"undecided": "❌ not measured, not decided",
|
||||
}
|
||||
|
||||
|
||||
def render(report: Report, ref: str) -> str:
|
||||
head = "**CIS: green**" if report.ok else "**CIS: red**"
|
||||
lines = [f"{head} for `{ref}` (CIS Docker 1.6.0 §4, CIS Debian Linux 12).", ""]
|
||||
if report.error:
|
||||
lines += [f"The measurement could not be taken: {report.error}", ""]
|
||||
if report.unknown:
|
||||
lines += [f"Decided in cis.toml but measured by nothing: {', '.join(report.unknown)}", ""]
|
||||
if report.stale:
|
||||
lines += [f"Exceptions for controls that pass now: {', '.join(report.stale)}", ""]
|
||||
if report.controls:
|
||||
lines += ["| Control | | Title | Detail |", "|---|---|---|---|"]
|
||||
for c in report.controls:
|
||||
detail = c.reason if c.state in ("manual", "excepted") else c.detail
|
||||
detail = detail.replace("|", "\\|").replace("\n", " ")
|
||||
lines.append(f"| {c.id} | {STATE_MARK.get(c.state, c.state)} | {c.title} | {detail} |")
|
||||
return "\n".join(lines).rstrip() + "\n"
|
||||
|
||||
|
||||
def load_packages(text: str) -> list[str]:
|
||||
return [ln.strip() for ln in text.splitlines() if ln.strip() and not ln.startswith("#")]
|
||||
|
||||
|
||||
def trivy_compliance(ref: str) -> dict: # pragma: no cover - container seam
|
||||
"""Trivy's summary of *ref* against the spec, with the checks it was released with."""
|
||||
proc = subprocess.run(
|
||||
[
|
||||
"docker",
|
||||
"run",
|
||||
"--rm",
|
||||
"-v",
|
||||
"/var/run/docker.sock:/var/run/docker.sock",
|
||||
"-e",
|
||||
"TRIVY_USERNAME",
|
||||
"-e",
|
||||
"TRIVY_PASSWORD",
|
||||
TRIVY_IMAGE,
|
||||
"image",
|
||||
"--quiet",
|
||||
"--disable-telemetry",
|
||||
"--skip-version-check",
|
||||
"--skip-check-update",
|
||||
# 4.4 is the matcher's (cis.toml); no vulnerability DB to fetch
|
||||
"--scanners",
|
||||
"misconfig,secret",
|
||||
"--compliance",
|
||||
SPEC,
|
||||
"--format",
|
||||
"json",
|
||||
ref,
|
||||
],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=TIMEOUT,
|
||||
check=True,
|
||||
)
|
||||
return json.loads(proc.stdout)
|
||||
|
||||
|
||||
def run_os_checks(ref: str, packages: list[str]) -> str: # pragma: no cover - container seam
|
||||
"""cis_os.sh inside *ref*, as root, fed on stdin: nothing to mount."""
|
||||
proc = subprocess.run(
|
||||
[
|
||||
"docker",
|
||||
"run",
|
||||
"--rm",
|
||||
"-i",
|
||||
"--user",
|
||||
"0",
|
||||
"--network",
|
||||
"none",
|
||||
"-e",
|
||||
"CIS_PACKAGES=" + " ".join(packages),
|
||||
"--entrypoint",
|
||||
"sh",
|
||||
ref,
|
||||
"-s",
|
||||
],
|
||||
input=OS_CHECKS.read_text(),
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=TIMEOUT,
|
||||
check=True,
|
||||
)
|
||||
return proc.stdout
|
||||
|
||||
|
||||
def main() -> int: # pragma: no cover - CLI seam
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument("ref")
|
||||
parser.add_argument("--decisions", default="cis.toml")
|
||||
parser.add_argument("--packages", default="packages.allow")
|
||||
parser.add_argument("--json")
|
||||
parser.add_argument("--report")
|
||||
args = parser.parse_args()
|
||||
decisions = load_decisions(Path(args.decisions).read_text())
|
||||
packages = load_packages(Path(args.packages).read_text())
|
||||
report = check(args.ref, decisions, packages, datetime.date.today())
|
||||
text = render(report, args.ref)
|
||||
if args.json:
|
||||
Path(args.json).write_text(report.to_json())
|
||||
if args.report:
|
||||
Path(args.report).write_text(text)
|
||||
print(text)
|
||||
return 0 if report.ok else 1
|
||||
|
||||
|
||||
if __name__ == "__main__": # pragma: no cover
|
||||
raise SystemExit(main())
|
||||
@@ -0,0 +1,171 @@
|
||||
#!/bin/sh
|
||||
# cis_os.sh: the CIS controls image_tools/cis.py measures from inside the image.
|
||||
#
|
||||
# Runs as root in the image, fed on stdin (docker run -i --user 0 ... sh -s), so
|
||||
# nothing has to be mounted from a runner whose paths the host daemon does not
|
||||
# know. Reads nothing from outside but CIS_PACKAGES, the package names the image
|
||||
# may hold. Prints one line per control:
|
||||
#
|
||||
# <id> TAB PASS|FAIL TAB <title> TAB <what fails>
|
||||
#
|
||||
# docker:* are the CIS Docker Benchmark 1.6.0 controls Trivy leaves to "Manual"
|
||||
# and that can be seen from inside; debian:* are the CIS Debian Linux 12 v1.1.0
|
||||
# controls that make sense in a container. Boot, partitions, kernel parameters,
|
||||
# services, logging, audit and sshd belong to the host (infrastructure
|
||||
# BAUSTANDARD §F) and are not measured here.
|
||||
set -u
|
||||
|
||||
# check <id> <title> <function>: PASS when the function names no offender.
|
||||
check() {
|
||||
out=$("$3" 2>/dev/null | head -n 20 | tr '\n' ' ')
|
||||
if [ -z "$out" ]; then
|
||||
printf '%s\tPASS\t%s\t\n' "$1" "$2"
|
||||
else
|
||||
printf '%s\tFAIL\t%s\t%s\n' "$1" "$2" "${out% }"
|
||||
fi
|
||||
}
|
||||
|
||||
login_defs() { awk -v k="$1" '$1 == k { v = $2 } END { print v }' /etc/login.defs; }
|
||||
|
||||
# Shells one can log in with: /etc/shells without the nologin ones.
|
||||
SHELLS=$(grep '^/' /etc/shells | grep -v nologin)
|
||||
|
||||
# --- CIS Docker Benchmark 1.6.0, section 4 -----------------------------------
|
||||
|
||||
extra_packages() {
|
||||
dpkg-query -W -f '${Package}\n' | while read -r p; do
|
||||
case " ${CIS_PACKAGES:-} " in *" $p "*) ;; *) echo "$p" ;; esac
|
||||
done
|
||||
}
|
||||
|
||||
setid_files() { find / -xdev -type f -perm /6000; }
|
||||
|
||||
unverified_sources() {
|
||||
grep -rEil 'trusted=yes|Trusted: *yes|AllowUnauthenticated|AllowInsecureRepositories|AllowDowngradeToInsecureRepositories' /etc/apt
|
||||
for f in /etc/apt/sources.list.d/*.sources; do
|
||||
[ -e "$f" ] || continue
|
||||
awk -v f="$f" 'BEGIN { RS = "" } index($0, "Signed-By:") == 0 { print f }' "$f"
|
||||
done
|
||||
grep -sE '^[[:space:]]*deb[[:space:]]' /etc/apt/sources.list /etc/apt/sources.list.d/*.list \
|
||||
| grep -v 'signed-by='
|
||||
}
|
||||
|
||||
check docker:4.3 "Unnecessary packages are not installed (packages.allow)" extra_packages
|
||||
check docker:4.8 "setuid and setgid permissions are removed" setid_files
|
||||
check docker:4.11 "Only verified packages are installed" unverified_sources
|
||||
|
||||
# --- CIS Debian Linux 12 v1.1.0 ----------------------------------------------
|
||||
|
||||
# in_range <key> <min> [max]: names the key unless min <= its value <= max.
|
||||
in_range() {
|
||||
v=$(login_defs "$1")
|
||||
case $v in '' | *[!0-9]*) echo "$1=${v:-unset}"; return ;; esac
|
||||
if [ "$v" -lt "$2" ] || [ "$v" -gt "${3:-$v}" ]; then echo "$1=$v"; fi
|
||||
}
|
||||
pass_max_days() { in_range PASS_MAX_DAYS 1 365; }
|
||||
pass_min_days() { in_range PASS_MIN_DAYS 1; }
|
||||
pass_warn_age() { in_range PASS_WARN_AGE 7; }
|
||||
weak_hashing() {
|
||||
v=$(login_defs ENCRYPT_METHOD)
|
||||
case $v in SHA512 | YESCRYPT) ;; *) echo "ENCRYPT_METHOD=${v:-unset}" ;; esac
|
||||
}
|
||||
weak_umask() {
|
||||
v=$(login_defs UMASK)
|
||||
case $v in '' | *[!0-7]*) echo "UMASK=${v:-unset}"; return ;; esac
|
||||
# 027 or stricter: group may not write, others get nothing
|
||||
if [ $(((0$v >> 3) & 2)) -eq 0 ] || [ $((0$v & 7)) -ne 7 ]; then echo "UMASK=$v"; fi
|
||||
}
|
||||
|
||||
other_uid0() { awk -F: '$3 == "0" && $1 != "root" { print $1 }' /etc/passwd; }
|
||||
other_gid0_accounts() {
|
||||
awk -F: '$4 == "0" && $1 !~ /^(root|sync|shutdown|halt|operator)$/ { print $1 }' /etc/passwd
|
||||
}
|
||||
other_gid0_groups() { awk -F: '$3 == "0" && $1 != "root" { print $1 }' /etc/group; }
|
||||
root_unlocked() { awk -F: '$1 == "root" && $2 !~ /^[!*]/ { print "root" }' /etc/shadow; }
|
||||
system_login_shells() {
|
||||
min=$(login_defs UID_MIN)
|
||||
echo "$SHELLS" | awk -F: -v min="${min:-1000}" '
|
||||
NR == FNR { if ($0 != "") shell[$0] = 1; next }
|
||||
$1 != "root" && ($3 + 0 < min + 0 || $3 == "65534") && ($7 in shell) { print $1 }
|
||||
' - /etc/passwd
|
||||
}
|
||||
unlocked_without_shell() {
|
||||
echo "$SHELLS" | awk -F: '
|
||||
FILENAME == "-" { if ($0 != "") shell[$0] = 1; next }
|
||||
FILENAME == "/etc/passwd" { if ($1 != "root" && !($7 in shell)) nologin[$1] = 1; next }
|
||||
($1 in nologin) && $2 !~ /^[!*]/ { print $1 }
|
||||
' - /etc/passwd /etc/shadow
|
||||
}
|
||||
|
||||
# too_open <file> <max mode> <owner> <group regex>: names the file when it is
|
||||
# more open than the mode allows or owned by someone else; a missing file is fine.
|
||||
too_open() {
|
||||
[ -e "$1" ] || return 0
|
||||
# shellcheck disable=SC2046
|
||||
set -- "$1" "$2" "$3" "$4" $(stat -Lc '%a %U %G' "$1")
|
||||
if [ $((0$5 & ~0$2 & 07777)) -ne 0 ] || [ "$6" != "$3" ] || ! echo "$7" | grep -qxE "$4"; then
|
||||
echo "$1=$5:$6:$7"
|
||||
fi
|
||||
}
|
||||
perm_passwd() { too_open /etc/passwd 644 root root; }
|
||||
perm_passwd_() { too_open /etc/passwd- 644 root root; }
|
||||
perm_group() { too_open /etc/group 644 root root; }
|
||||
perm_group_() { too_open /etc/group- 644 root root; }
|
||||
perm_shadow() { too_open /etc/shadow 640 root 'root|shadow'; }
|
||||
perm_shadow_() { too_open /etc/shadow- 640 root 'root|shadow'; }
|
||||
perm_gshadow() { too_open /etc/gshadow 640 root 'root|shadow'; }
|
||||
perm_gshadow_() { too_open /etc/gshadow- 640 root 'root|shadow'; }
|
||||
perm_shells() { too_open /etc/shells 644 root root; }
|
||||
perm_opasswd() { too_open /etc/security/opasswd 600 root root; }
|
||||
|
||||
world_writable() {
|
||||
find / -xdev -type f -perm -0002
|
||||
find / -xdev -type d -perm -0002 ! -perm -1000
|
||||
}
|
||||
unowned() { find / -xdev \( -nouser -o -nogroup \); }
|
||||
|
||||
not_shadowed() { awk -F: '$2 != "x" { print $1 }' /etc/passwd; }
|
||||
empty_passwords() { awk -F: '$2 == "" { print $1 }' /etc/shadow; }
|
||||
missing_groups() { awk -F: 'NR == FNR { g[$3] = 1; next } !($4 in g) { print $1 ":" $4 }' /etc/group /etc/passwd; }
|
||||
shadow_members() {
|
||||
awk -F: '
|
||||
NR == FNR { if ($1 == "shadow") { gid = $3; if ($4 != "") print "shadow:" $4 } next }
|
||||
gid != "" && $4 == gid { print $1 }
|
||||
' /etc/group /etc/passwd
|
||||
}
|
||||
dup_uids() { cut -d: -f3 /etc/passwd | sort | uniq -d; }
|
||||
dup_gids() { cut -d: -f3 /etc/group | sort | uniq -d; }
|
||||
dup_users() { cut -d: -f1 /etc/passwd | sort | uniq -d; }
|
||||
dup_groups() { cut -d: -f1 /etc/group | sort | uniq -d; }
|
||||
|
||||
check debian:5.4.1.1 "Password expiration is configured" pass_max_days
|
||||
check debian:5.4.1.2 "Minimum password days are configured" pass_min_days
|
||||
check debian:5.4.1.3 "Password expiration warning days are configured" pass_warn_age
|
||||
check debian:5.4.1.4 "Strong password hashing algorithm is configured" weak_hashing
|
||||
check debian:5.4.2.1 "root is the only UID 0 account" other_uid0
|
||||
check debian:5.4.2.2 "root is the only GID 0 account" other_gid0_accounts
|
||||
check debian:5.4.2.3 "group root is the only GID 0 group" other_gid0_groups
|
||||
check debian:5.4.2.4 "root account access is controlled (locked)" root_unlocked
|
||||
check debian:5.4.2.7 "System accounts do not have a valid login shell" system_login_shells
|
||||
check debian:5.4.2.8 "Accounts without a valid login shell are locked" unlocked_without_shell
|
||||
check debian:5.4.3.3 "Default user umask is configured" weak_umask
|
||||
check debian:7.1.1 "Permissions on /etc/passwd are configured" perm_passwd
|
||||
check debian:7.1.2 "Permissions on /etc/passwd- are configured" perm_passwd_
|
||||
check debian:7.1.3 "Permissions on /etc/group are configured" perm_group
|
||||
check debian:7.1.4 "Permissions on /etc/group- are configured" perm_group_
|
||||
check debian:7.1.5 "Permissions on /etc/shadow are configured" perm_shadow
|
||||
check debian:7.1.6 "Permissions on /etc/shadow- are configured" perm_shadow_
|
||||
check debian:7.1.7 "Permissions on /etc/gshadow are configured" perm_gshadow
|
||||
check debian:7.1.8 "Permissions on /etc/gshadow- are configured" perm_gshadow_
|
||||
check debian:7.1.9 "Permissions on /etc/shells are configured" perm_shells
|
||||
check debian:7.1.10 "Permissions on /etc/security/opasswd are configured" perm_opasswd
|
||||
check debian:7.1.11 "World writable files and directories are secured" world_writable
|
||||
check debian:7.1.12 "No files or directories without an owner and a group exist" unowned
|
||||
check debian:7.2.1 "Accounts in /etc/passwd use shadowed passwords" not_shadowed
|
||||
check debian:7.2.2 "/etc/shadow password fields are not empty" empty_passwords
|
||||
check debian:7.2.3 "All groups in /etc/passwd exist in /etc/group" missing_groups
|
||||
check debian:7.2.4 "The shadow group is empty" shadow_members
|
||||
check debian:7.2.5 "No duplicate UIDs exist" dup_uids
|
||||
check debian:7.2.6 "No duplicate GIDs exist" dup_gids
|
||||
check debian:7.2.7 "No duplicate user names exist" dup_users
|
||||
check debian:7.2.8 "No duplicate group names exist" dup_groups
|
||||
@@ -0,0 +1,59 @@
|
||||
"""The images a Dockerfile builds on, each pinned by digest.
|
||||
|
||||
bin/verify-base.sh checks their signatures before the build. A FROM naming a
|
||||
stage of the same file is no image, ``scratch`` is none either, and an image
|
||||
without ``@sha256:`` cannot be verified: a tag can move after the check.
|
||||
|
||||
python -m image_tools.dockerfile <Dockerfile>...
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import argparse
|
||||
import re
|
||||
from pathlib import Path
|
||||
|
||||
_FROM = re.compile(r"^\s*FROM\s+(.*)$", re.IGNORECASE)
|
||||
_DIGEST = re.compile(r"@sha256:[0-9a-f]{64}$")
|
||||
|
||||
|
||||
def _instructions(text: str) -> list[str]:
|
||||
return re.sub(r"\\\s*\n", " ", text).splitlines()
|
||||
|
||||
|
||||
def external_bases(text: str) -> list[str]:
|
||||
"""Every image the file's FROM lines name, once, in order."""
|
||||
stages: set[str] = set()
|
||||
bases: list[str] = []
|
||||
for line in _instructions(text):
|
||||
match = _FROM.match(line)
|
||||
if not match:
|
||||
continue
|
||||
words = [w for w in match.group(1).split() if not w.startswith("--")]
|
||||
ref = words[0]
|
||||
if len(words) >= 3 and words[1].lower() == "as":
|
||||
stages.add(words[2].lower())
|
||||
if ref.lower() in stages or ref == "scratch":
|
||||
continue
|
||||
if not _DIGEST.search(ref):
|
||||
raise ValueError(f"FROM {ref} is not pinned by digest")
|
||||
if ref not in bases:
|
||||
bases.append(ref)
|
||||
return bases
|
||||
|
||||
|
||||
def main() -> int: # pragma: no cover - CLI seam
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument("dockerfiles", nargs="+")
|
||||
args = parser.parse_args()
|
||||
seen: list[str] = []
|
||||
for path in args.dockerfiles:
|
||||
for ref in external_bases(Path(path).read_text()):
|
||||
if ref not in seen:
|
||||
seen.append(ref)
|
||||
print(ref)
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__": # pragma: no cover
|
||||
raise SystemExit(main())
|
||||
@@ -0,0 +1,64 @@
|
||||
"""The platform images of a published reference, for bin/sign.sh.
|
||||
|
||||
An index (base-os, a released netork image) lists them; a single manifest (a
|
||||
netork dev image) is one itself, its architecture in its config. Each line out
|
||||
is ``<arch> <digest>``. Only amd64 and arm64 are built, so anything else, or
|
||||
nothing at all, is an error rather than a quiet skip.
|
||||
|
||||
python -m image_tools.platforms <digest> <raw.json> <image.json>
|
||||
|
||||
``raw.json`` is ``docker buildx imagetools inspect --raw``, ``image.json`` its
|
||||
``--format '{{json .Image}}'``, and ``<digest>`` the reference's own.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import argparse
|
||||
import json
|
||||
from pathlib import Path
|
||||
|
||||
BUILT = ("amd64", "arm64")
|
||||
INDEXES = (
|
||||
"application/vnd.oci.image.index.v1+json",
|
||||
"application/vnd.docker.distribution.manifest.list.v2+json",
|
||||
)
|
||||
|
||||
|
||||
def _checked(arch: str) -> str:
|
||||
if arch not in BUILT:
|
||||
raise ValueError(f"{arch} is not a platform built here ({', '.join(BUILT)})")
|
||||
return arch
|
||||
|
||||
|
||||
def platforms(raw: str, image: str, digest: str) -> list[tuple[str, str]]:
|
||||
"""``(arch, digest)`` of every platform image behind the reference."""
|
||||
manifest = json.loads(raw)
|
||||
if manifest.get("mediaType") in INDEXES or "manifests" in manifest:
|
||||
found = []
|
||||
for entry in manifest.get("manifests") or []:
|
||||
platform = entry.get("platform") or {}
|
||||
if platform.get("os") != "linux":
|
||||
continue # buildx's attestation manifests say "unknown"
|
||||
found.append((_checked(platform.get("architecture", "")), entry["digest"]))
|
||||
else:
|
||||
arch = (json.loads(image) or {}).get("architecture")
|
||||
found = [(_checked(arch), digest)] if arch else []
|
||||
if not found:
|
||||
raise ValueError("the reference holds no platform image to sign")
|
||||
return found
|
||||
|
||||
|
||||
def main() -> int: # pragma: no cover - CLI seam
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument("digest")
|
||||
parser.add_argument("raw")
|
||||
parser.add_argument("image")
|
||||
args = parser.parse_args()
|
||||
found = platforms(Path(args.raw).read_text(), Path(args.image).read_text(), args.digest)
|
||||
for arch, digest in found:
|
||||
print(arch, digest)
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__": # pragma: no cover
|
||||
raise SystemExit(main())
|
||||
@@ -0,0 +1,60 @@
|
||||
"""The CycloneDX SBOM of an image, as Trivy reads it.
|
||||
|
||||
bin/sign.sh attaches it to each published platform image as an attestation,
|
||||
next to the CIS result, so what base-os holds can be read from the registry.
|
||||
|
||||
python -m image_tools.sbom <ref> <out.cdx.json>
|
||||
|
||||
Standard library only; Trivy runs as the container image_tools/verify.py pins.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import argparse
|
||||
import json
|
||||
import subprocess
|
||||
from pathlib import Path
|
||||
|
||||
from image_tools.verify import TIMEOUT, TRIVY_IMAGE
|
||||
|
||||
|
||||
def cyclonedx(ref: str) -> dict: # pragma: no cover - container seam
|
||||
proc = subprocess.run(
|
||||
[
|
||||
"docker",
|
||||
"run",
|
||||
"--rm",
|
||||
"-v",
|
||||
"/var/run/docker.sock:/var/run/docker.sock",
|
||||
"-e",
|
||||
"TRIVY_USERNAME",
|
||||
"-e",
|
||||
"TRIVY_PASSWORD",
|
||||
TRIVY_IMAGE,
|
||||
"image",
|
||||
"--quiet",
|
||||
"--disable-telemetry",
|
||||
"--skip-version-check",
|
||||
"--format",
|
||||
"cyclonedx",
|
||||
ref,
|
||||
],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=TIMEOUT,
|
||||
check=True,
|
||||
)
|
||||
return json.loads(proc.stdout)
|
||||
|
||||
|
||||
def main() -> int: # pragma: no cover - CLI seam
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument("ref")
|
||||
parser.add_argument("out")
|
||||
args = parser.parse_args()
|
||||
Path(args.out).write_text(json.dumps(cyclonedx(args.ref), indent=2))
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__": # pragma: no cover
|
||||
raise SystemExit(main())
|
||||
@@ -0,0 +1,221 @@
|
||||
"""Does a candidate image improve on the pinned one? (#1308)
|
||||
|
||||
Trivy lists both images' packages; netOrk's matcher in kb-server judges both in
|
||||
one call, so against one state of its data (kb-server#155). The verdict:
|
||||
|
||||
- **improved** when a critical or high CVE that has a fixed version is closed,
|
||||
Debian made a point release (``/etc/debian_version`` differs), or the
|
||||
candidate passes a CIS control the pin fails (``image_tools/cis.py``, both measured
|
||||
in the same run);
|
||||
- **same** otherwise, and whenever the matcher cannot be asked: no pin moves on
|
||||
a guess.
|
||||
|
||||
New critical or high CVEs in the candidate never block; the report lists them.
|
||||
|
||||
python -m image_tools.verify <current-ref> <candidate-ref> [--packages packages.allow] \
|
||||
--json verdict.json --report report.md
|
||||
|
||||
Standard library only; Trivy runs as a pinned container.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import argparse
|
||||
import json
|
||||
import os
|
||||
import subprocess
|
||||
import urllib.request
|
||||
from collections.abc import Callable, Iterable
|
||||
from dataclasses import asdict, dataclass, field
|
||||
from pathlib import Path
|
||||
|
||||
#: Trivy, pinned by its multi-platform index digest.
|
||||
TRIVY_IMAGE = (
|
||||
"aquasec/trivy:0.75.0@sha256:af6acf9a6b85dfe389a1941505c0ce9efef52a4719635e1a962f022a3d855daa"
|
||||
)
|
||||
SEVERE = frozenset({"critical", "high"})
|
||||
KB_URL = os.environ.get("KB_URL", "https://kb.netork.io")
|
||||
TIMEOUT = 300
|
||||
|
||||
|
||||
@dataclass
|
||||
class Verdict:
|
||||
improved: bool
|
||||
closed: list[dict] = field(default_factory=list)
|
||||
new: list[dict] = field(default_factory=list)
|
||||
point_release: tuple[str, str] | None = None
|
||||
cis_closed: list[str] = field(default_factory=list)
|
||||
counts: dict = field(default_factory=dict)
|
||||
error: str | None = None
|
||||
|
||||
def to_json(self) -> str:
|
||||
return json.dumps(asdict(self), indent=2)
|
||||
|
||||
|
||||
def _patched(finding: dict) -> bool:
|
||||
return (finding.get("severity") or "").lower() in SEVERE and bool(finding.get("fixed"))
|
||||
|
||||
|
||||
def judge(
|
||||
answer: dict,
|
||||
current_debian: str,
|
||||
candidate_debian: str,
|
||||
cis_closed: Iterable[str] = (),
|
||||
) -> Verdict:
|
||||
"""The verdict on the matcher's *answer*, both images' Debian versions and
|
||||
the CIS controls the candidate passes and the pin fails."""
|
||||
closed = [f for f in answer.get("closed") or [] if _patched(f)]
|
||||
new = [f for f in answer.get("new") or [] if (f.get("severity") or "").lower() in SEVERE]
|
||||
point = None
|
||||
if current_debian.strip() != candidate_debian.strip():
|
||||
point = (current_debian.strip(), candidate_debian.strip())
|
||||
counts = {"current": answer.get("current", {}), "candidate": answer.get("candidate", {})}
|
||||
cis = sorted(cis_closed)
|
||||
return Verdict(bool(closed) or point is not None or bool(cis), closed, new, point, cis, counts)
|
||||
|
||||
|
||||
def verify(
|
||||
current: str,
|
||||
candidate: str,
|
||||
*,
|
||||
sbom: Callable[[str], dict] | None = None,
|
||||
match: Callable[[dict, dict], dict] | None = None,
|
||||
debian_version: Callable[[str], str] | None = None,
|
||||
cis_failing: Callable[[str], set[str]] | None = None,
|
||||
) -> Verdict:
|
||||
"""Judge *candidate* against *current*; never raises."""
|
||||
sbom = sbom or trivy_sbom
|
||||
match = match or kb_match
|
||||
debian_version = debian_version or debian_version_of
|
||||
cis_failing = cis_failing or cis_failing_of
|
||||
try:
|
||||
answer = match(sbom(current), sbom(candidate))
|
||||
cis_closed = cis_failing(current) - cis_failing(candidate)
|
||||
return judge(answer, debian_version(current), debian_version(candidate), cis_closed)
|
||||
except (OSError, ValueError, subprocess.SubprocessError) as exc:
|
||||
return Verdict(False, error=f"{type(exc).__name__}: {exc}")
|
||||
|
||||
|
||||
def _row(f: dict) -> str:
|
||||
fixed = f.get("fixed") or "–"
|
||||
return f"| {f.get('cve')} | {f.get('package')} | {f.get('severity')} | {f.get('installed')} | {fixed} |"
|
||||
|
||||
|
||||
def render(verdict: Verdict, current: str, candidate: str) -> str:
|
||||
"""The pull request body: what closed, what is new, against what."""
|
||||
head = "**Improved**" if verdict.improved else "**Same** (the pin stays)"
|
||||
lines = [f"{head}: `{candidate}` against the pinned `{current}`.", ""]
|
||||
if verdict.error:
|
||||
lines += [f"The matcher could not be asked: {verdict.error}", ""]
|
||||
if verdict.point_release:
|
||||
old, new = verdict.point_release
|
||||
lines += [f"Debian point release: {old} → {new}", ""]
|
||||
if verdict.cis_closed:
|
||||
lines += [
|
||||
f"CIS controls the pin fails and the candidate passes: {', '.join(verdict.cis_closed)}",
|
||||
"",
|
||||
]
|
||||
table = ["| CVE | Package | Severity | Installed | Fixed in |", "|---|---|---|---|---|"]
|
||||
if verdict.closed:
|
||||
lines += ["### Closed critical/high", "", *table, *map(_row, verdict.closed), ""]
|
||||
if verdict.new:
|
||||
lines += ["### New critical/high in the candidate", "", *table, *map(_row, verdict.new), ""]
|
||||
if verdict.counts:
|
||||
lines += [
|
||||
f"Counts: current {verdict.counts.get('current')}, candidate {verdict.counts.get('candidate')}."
|
||||
]
|
||||
return "\n".join(lines).rstrip() + "\n"
|
||||
|
||||
|
||||
def trivy_sbom(ref: str) -> dict: # pragma: no cover - container seam
|
||||
"""Trivy's package inventory of *ref* (no vulnerability DB)."""
|
||||
proc = subprocess.run(
|
||||
[
|
||||
"docker",
|
||||
"run",
|
||||
"--rm",
|
||||
"-v",
|
||||
"/var/run/docker.sock:/var/run/docker.sock",
|
||||
"-e",
|
||||
"TRIVY_USERNAME",
|
||||
"-e",
|
||||
"TRIVY_PASSWORD",
|
||||
TRIVY_IMAGE,
|
||||
"image",
|
||||
"--quiet",
|
||||
"--disable-telemetry",
|
||||
"--skip-version-check",
|
||||
"--format",
|
||||
"json",
|
||||
"--list-all-pkgs",
|
||||
"--scanners",
|
||||
"license",
|
||||
ref,
|
||||
],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=TIMEOUT,
|
||||
check=True,
|
||||
)
|
||||
return json.loads(proc.stdout)
|
||||
|
||||
|
||||
def kb_match(current: dict, candidate: dict) -> dict: # pragma: no cover - network seam
|
||||
"""kb-server's verdict on both inventories, in one call (kb-server#155)."""
|
||||
body = json.dumps({"current": current, "candidate": candidate}).encode()
|
||||
request = urllib.request.Request(
|
||||
f"{KB_URL}/api/v1/match",
|
||||
data=body,
|
||||
method="POST",
|
||||
headers={
|
||||
"Content-Type": "application/json",
|
||||
"Authorization": f"Bearer {os.environ['NETORK_LICENSE_KEY']}",
|
||||
},
|
||||
)
|
||||
with urllib.request.urlopen(request, timeout=TIMEOUT) as response: # noqa: S310 - https
|
||||
return json.load(response)
|
||||
|
||||
|
||||
def debian_version_of(ref: str) -> str: # pragma: no cover - container seam
|
||||
proc = subprocess.run(
|
||||
["docker", "run", "--rm", "--entrypoint", "cat", ref, "/etc/debian_version"],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=120,
|
||||
check=True,
|
||||
)
|
||||
return proc.stdout.strip()
|
||||
|
||||
|
||||
def cis_failing_of(ref: str, packages: str = "packages.allow") -> set[str]: # pragma: no cover
|
||||
"""The CIS controls *ref* fails, measured as image_tools/cis.py measures a build;
|
||||
*packages* is the image repository's allow list."""
|
||||
from image_tools import cis
|
||||
|
||||
allowed = cis.load_packages(Path(packages).read_text())
|
||||
return {c.id for c in cis.measure(ref, allowed) if c.result == cis.FAIL}
|
||||
|
||||
|
||||
def main() -> int: # pragma: no cover - CLI seam
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument("current")
|
||||
parser.add_argument("candidate")
|
||||
parser.add_argument("--json", required=True)
|
||||
parser.add_argument("--report", required=True)
|
||||
parser.add_argument("--packages", default="packages.allow")
|
||||
args = parser.parse_args()
|
||||
verdict = verify(
|
||||
args.current,
|
||||
args.candidate,
|
||||
cis_failing=lambda ref: cis_failing_of(ref, args.packages),
|
||||
)
|
||||
with open(args.json, "w") as fh:
|
||||
fh.write(verdict.to_json())
|
||||
with open(args.report, "w") as fh:
|
||||
fh.write(render(verdict, args.current, args.candidate))
|
||||
print("improved" if verdict.improved else "same")
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__": # pragma: no cover
|
||||
raise SystemExit(main())
|
||||
Reference in new issue
Block a user