diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 99dd11f4728b033aed95b158b09b10c9ad049618_LmdpdGxhYi1jaS55bWw=..9e1e09be3e09a14dd3666eacb6c6879d352be3a7_LmdpdGxhYi1jaS55bWw= 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -7,6 +7,7 @@ - tests - post-test - package + - scan-dependencies - staging_upload - release - images @@ -179,6 +180,27 @@ - node_modules retry: 1 +Scan dependencies: + image: alpine:3.7 + stage: scan-dependencies + allow_failure: true + variables: + TERM: xterm-256color + REPORT_PATH: ./ + before_script: + - apk update && apk add curl jq bash + script: + - ./scripts/gitlab-depscan.sh pkg/ubuntu-xenial/version-manifest.json + only: + - tags@gitlab/omnibus-gitlab + dependencies: + - Ubuntu-16.04 + artifacts: + expire_in: 7 days + when: on_failure + paths: + - dependency_report.txt + .rpi_tag_template: &rpi_tag_build stage: raspbian script: diff --git a/scripts/gitlab-depscan.sh b/scripts/gitlab-depscan.sh new file mode 100755 index 0000000000000000000000000000000000000000..9e1e09be3e09a14dd3666eacb6c6879d352be3a7_c2NyaXB0cy9naXRsYWItZGVwc2Nhbi5zaA== --- /dev/null +++ b/scripts/gitlab-depscan.sh @@ -0,0 +1,71 @@ +#!/bin/bash +# Scans the dependencies for security vulnerabilities +# Arguments: A path to version-manifest.json file +# example: ./gitlab-debscan.sh $HOME/version-manifest.json + +set -e + +version_file=$1; + +if [ "$#" == "0" ]; then + echo "You need to pass a path to versions_manifest file"; + exit 1; +fi + +if [ ! -f $version_file ]; then + echo "$version_file does not exist"; + exit 1; +fi + +software_versions=($(cat $version_file | jq -r ".software|to_entries|map(\"\(.key)/\(.value.locked_version|tostring)\")|.[]" | grep -v 'null' )) +base_url=https://cve.circl.lu/api/search + +counter=0; + +vulnerabilities="" +short_descriptions="" +REPORT_PATH=${REPORT_PATH-/tmp} + +echo "Checking dependencies for known CVEs" +printf "%-70s %-10s\n\n" Dependency Status +for dependency in "${software_versions[@]}" +do + response=$(curl -s $base_url/$dependency); + + if [ "$response" = "[]" ]; then + printf "%-70s \033[0;32m%-10s\e[0m\n" ${dependency} Secure; + else + printf "%-70s \033[0;31m%-10s\e[0m\n" ${dependency} Vulnerable; + vulnerabilities="$vulnerabilities\n$dependency: " + short_descriptions="$short_descriptions\n$dependency: " + for row in $(echo "${response}" | jq -r '.[] | @base64'); do + _jq(){ + echo ${row} | base64 -d | jq -r ${1} + } + vulnerability=$(_jq '.') + vulnerabilities="$vulnerabilities + $(echo $vulnerability | jq -r '.id') + Severity: $(echo $vulnerability | jq -r '.cvss') + Summary: $(echo $vulnerability | jq -r '.summary') + References: + $(echo $vulnerability | jq -r '.references[1,2]' | tr '\n' ' ')" + + short_descriptions="$short_descriptions + - $(echo $vulnerability | jq -r '.id')" + counter=$((counter+1)); + done + vulnerabilities="$vulnerabilities\n" + fi +done + +if [ "$counter" -gt "0" ]; then + echo -e "\033[0;31m$counter vulnerabilities were found\e[0m"; + echo -e "\033[0;31m$short_descriptions\e[0m"; + IFS= && echo -e $vulnerabilities > $REPORT_PATH/dependency_report.txt + echo "Full dependency scanning report can be found at $REPORT_PATH/dependency_report.txt" + exit 1; +else + echo -e "\033[0;32mNo vulnerabilities were found\e[0m"; + exit 0; +fi +echo $vulnerabilities