Node / ReticulumProjects / MeshChatX.git / files / scripts / ci / setup-trivy.sh

Displaying Raw • Download

T8b949e#!/bin/sh

T8b949e# Install Trivy .deb for CI (scan / docker workflows).

T8b949e#

T8b949e# Default (no TRIVY_DEB_URL): official assets from

T8b949e# https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/

T8b949e# 1) cosign verify-blob on trivy_${VER}_checksums.txt (+ .sigstore.json)

T8b949e# 2) sha256sum -c for the arch .deb using that checksums file

T8b949e# 3) cosign verify-blob on the .deb (+ .deb.sigstore.json)

T8b949e#

T8b949e# Optional mirror: TRIVY_DEB_URL and TRIVY_DEB_SHA256 (sha256sum -c format, hex only).

Tffa657set -eu

Te6edf3COSIGN_VERSIONTff7b72=Ta5d6ff"Tffd700${Te6edf3COSIGN_VERSIONTff7b72:-Te6edf33Tb4b4b4.0.6Tffd700}Ta5d6ff"

Te6edf3TRIVY_VERSIONTff7b72=Ta5d6ff"Tffd700${Te6edf3TRIVY_VERSIONTff7b72:-Te6edf30Tb4b4b4.69.3Tffd700}Ta5d6ff"

Te6edf3TRIVY_RELEASE_BASETff7b72=Ta5d6ff"Ta5d6ffhttps://github.com/aquasecurity/trivy/releases/download/vTffd700${Te6edf3TRIVY_VERSIONTffd700}Ta5d6ff"

T8b949e# Keyless signing identity for aquasecurity/trivy reusable release workflow (any semver tag).

Te6edf3TRIVY_CERT_IDENTITY_RETff7b72=Ta5d6ff'^https://github.com/aquasecurity/trivy/\.github/workflows/reusable-release\.yaml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+$'

Te6edf3TRIVY_CERT_ISSUER_RETff7b72=Ta5d6ff'^https://token\.actions\.githubusercontent\.com$'

ensure_cosignTff7b72(Tff7b72) Tff7b72{

Tff7b72if Tffa657command -v cosign >/dev/null T79c0ff2>Tb4b4b4&T79c0ff1Tb4b4b4; Tff7b72then

Tff7b72return T79c0ff0

Tff7b72fi

sh scripts/ci/setup-cosign.sh Ta5d6ff"Tffd700${Te6edf3COSIGN_VERSIONTffd700}Ta5d6ff"

Tff7b72}

verify_upstream_debTff7b72(Tff7b72) Tff7b72{

Te6edf3deb_archTff7b72=Ta5d6ff"Te6edf3$1Ta5d6ff"

Te6edf3DEB_BASETff7b72=Ta5d6ff"Ta5d6fftrivy_Tffd700${Te6edf3TRIVY_VERSIONTffd700}Ta5d6ff_Tffd700${Te6edf3deb_archTffd700}Ta5d6ff.debTa5d6ff"

ensure_cosign

Tffa657export Te6edf3COSIGN_YESTff7b72=Ta5d6ff"Tffd700${Te6edf3COSIGN_YESTff7b72:-Te6edf3trueTffd700}Ta5d6ff"

curl -fsSL --retry T79c0ff5 --retry-delay T79c0ff2 -o /tmp/trivy_checksums.txt Ta5d6ff"Tffd700${Te6edf3TRIVY_RELEASE_BASETffd700}Ta5d6ff/trivy_Tffd700${Te6edf3TRIVY_VERSIONTffd700}Ta5d6ff_checksums.txtTa5d6ff"

curl -fsSL --retry T79c0ff5 --retry-delay T79c0ff2 -o /tmp/trivy_checksums.sigstore.json Ta5d6ff"Tffd700${Te6edf3TRIVY_RELEASE_BASETffd700}Ta5d6ff/trivy_Tffd700${Te6edf3TRIVY_VERSIONTffd700}Ta5d6ff_checksums.txt.sigstore.jsonTa5d6ff"

cosign verify-blob /tmp/trivy_checksums.txt --bundle /tmp/trivy_checksums.sigstore.json Tffea00\

--certificate-identity-regexpTff7b72=Ta5d6ff"Tffd700${Te6edf3TRIVY_CERT_IDENTITY_RETffd700}Ta5d6ff" Tffea00\

--certificate-oidc-issuer-regexpTff7b72=Ta5d6ff"Tffd700${Te6edf3TRIVY_CERT_ISSUER_RETffd700}Ta5d6ff"

Te6edf3EXPECTED_SHATff7b72=Ta5d6ff"Tff7b72$(awk -v Te6edf3fTff7b72=Ta5d6ff"Tffd700${Te6edf3DEB_BASETffd700}Ta5d6ff" Ta5d6ff'$2 == f { print $1; exit }' /tmp/trivy_checksums.txtTff7b72)Ta5d6ff"

Tff7b72if Tff7b72[ -z Ta5d6ff"Tffd700${Te6edf3EXPECTED_SHATffd700}Ta5d6ff" Tff7b72]Tb4b4b4; Tff7b72then

Tffa657echo Ta5d6ff"Ta5d6ffsetup-trivy.sh: no SHA256 line for Tffd700${Te6edf3DEB_BASETffd700}Ta5d6ff in checksums.txtTa5d6ff" >Tb4b4b4&T79c0ff2

Tffa657exit T79c0ff1

Tff7b72fi

curl -fsSL --retry T79c0ff5 --retry-delay T79c0ff2 -o /tmp/trivy.deb Ta5d6ff"Tffd700${Te6edf3TRIVY_RELEASE_BASETffd700}Ta5d6ff/Tffd700${Te6edf3DEB_BASETffd700}Ta5d6ff"

Tffa657echo Ta5d6ff"Tffd700${Te6edf3EXPECTED_SHATffd700}Ta5d6ff /tmp/trivy.debTa5d6ff" Tb4b4b4| sha256sum -c

curl -fsSL --retry T79c0ff5 --retry-delay T79c0ff2 -o /tmp/trivy.deb.sigstore.json Ta5d6ff"Tffd700${Te6edf3TRIVY_RELEASE_BASETffd700}Ta5d6ff/Tffd700${Te6edf3DEB_BASETffd700}Ta5d6ff.sigstore.jsonTa5d6ff"

cosign verify-blob /tmp/trivy.deb --bundle /tmp/trivy.deb.sigstore.json Tffea00\

--certificate-identity-regexpTff7b72=Ta5d6ff"Tffd700${Te6edf3TRIVY_CERT_IDENTITY_RETffd700}Ta5d6ff" Tffea00\

--certificate-oidc-issuer-regexpTff7b72=Ta5d6ff"Tffd700${Te6edf3TRIVY_CERT_ISSUER_RETffd700}Ta5d6ff"

rm -f /tmp/trivy_checksums.txt /tmp/trivy_checksums.sigstore.json /tmp/trivy.deb.sigstore.json

Tff7b72}

Tff7b72if Tff7b72[ -n Ta5d6ff"Tffd700${Te6edf3TRIVY_DEB_URLTff7b72:-Tffd700}Ta5d6ff" Tff7b72]Tb4b4b4; Tff7b72then

Tff7b72if Tff7b72[ -z Ta5d6ff"Tffd700${Te6edf3TRIVY_DEB_SHA256Tff7b72:-Tffd700}Ta5d6ff" Tff7b72]Tb4b4b4; Tff7b72then

Tffa657echo Ta5d6ff"setup-trivy.sh: TRIVY_DEB_URL requires TRIVY_DEB_SHA256" >Tb4b4b4&T79c0ff2

Tffa657exit T79c0ff1

Tff7b72fi

curl -fsSL --retry T79c0ff5 --retry-delay T79c0ff2 -o /tmp/trivy.deb Ta5d6ff"Tffd700${Te6edf3TRIVY_DEB_URLTffd700}Ta5d6ff"

Tffa657echo Ta5d6ff"Tffd700${Te6edf3TRIVY_DEB_SHA256Tffd700}Ta5d6ff /tmp/trivy.debTa5d6ff" Tb4b4b4| sha256sum -c

Tff7b72else

Te6edf3archTff7b72=Ta5d6ff"Tff7b72$(uname -mTff7b72)Ta5d6ff"

Te6edf3deb_archTff7b72=

Tff7b72case Ta5d6ff"Te6edf3$archTa5d6ff" Tff7b72in

x86_64Tb4b4b4|amd64Tff7b72) Te6edf3deb_archTff7b72=Linux-64bit Tb4b4b4;Tb4b4b4;

aarch64Tb4b4b4|arm64Tff7b72) Te6edf3deb_archTff7b72=Linux-ARM64 Tb4b4b4;Tb4b4b4;

armv7lTb4b4b4|armv6lTb4b4b4|armhfTff7b72) Te6edf3deb_archTff7b72=Linux-ARM Tb4b4b4;Tb4b4b4;

*Tff7b72)

Tffa657echo Ta5d6ff"Ta5d6ffsetup-trivy.sh: unsupported uname -m: Tffd700${Te6edf3archTffd700}Ta5d6ff (set TRIVY_DEB_URL)Ta5d6ff" >Tb4b4b4&T79c0ff2

Tffa657exit T79c0ff1

Tb4b4b4;Tb4b4b4;

Tff7b72esac

verify_upstream_deb Ta5d6ff"Tffd700${Te6edf3deb_archTffd700}Ta5d6ff"

Tff7b72fi

sh scripts/ci/exec-priv.sh dpkg -i /tmp/trivy.deb Tff7b72|| sh scripts/ci/exec-priv.sh apt-get install -f -y

trivy --version