project-copacetic / copacetic Goto Github PK
View Code? Open in Web Editor NEW🧵 CLI tool for directly patching container images!
Home Page: https://project-copacetic.github.io/copacetic/
License: Apache License 2.0
🧵 CLI tool for directly patching container images!
Home Page: https://project-copacetic.github.io/copacetic/
License: Apache License 2.0
New feature
It would be good to have scanners to be modular so they don't have to live in the core copacetic repository. The intention is for others to contribute without each scanner being part of the core copa.
perhaps a model like https://github.com/deislabs/ratify/blob/main/pkg/verifier/plugin/skel/skel.go https://github.com/deislabs/ratify/blob/main/plugins/verifier/licensechecker/licensechecker.go (example) which defines inputs and outputs might work
None
add brews
to goreleaser config https://goreleaser.com/customization/homebrew/?h=brews
we might want to create a homebrew-copacetic
repo so it's easier to add a tap
https://docs.brew.sh/Taps#repository-naming-conventions-and-assumptions
New feature
Handle secure registries in copa:
No response
looks like we are missing version in goreleaser output so we can be in parity with existing release
https://github.com/project-copacetic/copacetic/blob/main/.goreleaser.yml#L25
No response
No response
New feature
Today, copa supports trivy json as the input. We should also support sarif
as input for generic results.
Scanners like trivy and grype supports exporting as sarif.
https://aquasecurity.github.io/trivy/v0.37/docs/vulnerability/examples/report/#sarif
v0.1.0
No remaining vulnerabilities after patching
Original image contains libssl and openssl vulnerabilities (at the time of this writing).
Copa patch reports both are fixed and validated.
INFO[0001] Validated package libssl1.1 version 1.1.1n-0+deb11u4 meets requested version 1.1.1n-0+deb11u4
INFO[0001] Validated package openssl version 1.1.1n-0+deb11u4 meets requested version 1.1.1n-0+deb11u4
After patching, openssl vulnerability is resolved. However libssl still reports vulnerabilities.
trivy image --vuln-type os --ignore-unfixed --scanners vuln openpolicyagent/opa:0.46.0 --format json -o opa.json
Total: 10 (UNKNOWN: 0, LOW: 0, MEDIUM: 8, HIGH: 2, CRITICAL: 0)
copa patch \
-i openpolicyagent/opa:0.46.0 \
-r opa.json \
-t 0.46.0-patched \
-a tcp://0.0.0.0:$BUILDKIT_PORT --timeout 60m
trivy image --vuln-type os --ignore-unfixed --scanners vuln openpolicyagent/opa:0.46.0-patched
Total: 5 (UNKNOWN: 0, LOW: 0, MEDIUM: 4, HIGH: 1, CRITICAL: 0)
New feature
today, we fail patching if any package fails to patch
if patching fails for a package for whatever reason, we might want to continue anyway to produce an image
Other
documentation similar to
https://open-policy-agent.github.io/gatekeeper/website/docs/help/#developer-certification-of-origin-dco
Other
Update docs to be versioned similar to https://azure.github.io/eraser
New feature
Currently, Oracle Linux (https://hub.docker.com/_/oraclelinux) cannot be patched and the following error message is shown:
Error: unsupported osType oracle specified
Please, add support for Oracle Linux.
Note: Oracle Linux 7 uses yum
, while starting with version 8 dnf
is used as package manager.
Other
we should mirror the images used in the tests to a registry (like ghcr) or as tarballs or pin to digests so they don't change
None
publish darwin binaries as part of release
Improvement of existing experience
I would like copa to be able to scan an image built within a pipeline that is tagged with a remote hostname, but exists locally.
In our setup we build an image and tag registry-name.azurecr.io/repo:tag
. At this point in time (build only / PR validation) the pipeline isn't authenticated to the container registry. Trivy scans this after build using the local image. We've then setup to run copa on this image but currently it fails with the debug log:
time="2023-06-09T06:17:02Z" level=debug msg=resolving host=registry-name.azurecr.io
time="2023-06-09T06:17:02Z" level=debug msg="do request" host=registry-name.azurecr.io request.header.accept="application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*" request.header.user-agent=buildkit/0.0.0+unknown request.method=HEAD url="https://registry-name.azurecr.io/v2/repo/manifests/tag"
time="2023-06-09T06:17:02Z" level=debug msg="fetch response received" host=registry-name.azurecr.io response.header.access-control-expose-headers=Docker-Content-Digest response.header.access-control-expose-headers.1=WWW-Authenticate response.header.access-control-expose-headers.2=Link response.header.access-control-expose-headers.3=X-Ms-Correlation-Request-Id response.header.connection=keep-alive response.header.content-length=211 response.header.content-type="application/json; charset=utf-8" response.header.date="Fri, 09 Jun 2023 06:17:02 GMT" response.header.docker-distribution-api-version=registry/2.0 response.header.server=openresty response.header.strict-transport-security="max-age=31536000; includeSubDomains" response.header.strict-transport-security.1="max-age=31536000; includeSubDomains" response.header.www-authenticate="Bearer realm=\"https://registry-name.azurecr.io/oauth2/token\",service=\"registry-name.azurecr.io\",scope=\"repository:repo:pull\"" response.header.x-content-type-options=nosniff response.header.x-ms-correlation-request-id=60b02c26-0626-4ffe-b00e-4a39acb5ccb7 response.status="401 Unauthorized" url="https://registry-name.azurecr.io/v2/repo/manifests/tag"
time="2023-06-09T06:17:02Z" level=debug msg=Unauthorized header="Bearer realm=\"https://registry-name.azurecr.io/oauth2/token\",service=\"registry-name.azurecr.io\",scope=\"repository:repo:pull\"" host=registry-name.azurecr.io
time="2023-06-09T06:17:02Z" level=debug msg="do request" host=registry-name.azurecr.io request.header.accept="application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*" request.header.user-agent=buildkit/0.0.0+unknown request.method=HEAD url="https://registry-name.azurecr.io/v2/repo/manifests/tag"
time="2023-06-09T06:17:02Z" level=info msg="trying next host" error="failed to authorize: failed to fetch anonymous token: unexpected status from GET request to https://registry-name.azurecr.io/oauth2/token?scope=repository%3Arepo%3Apull&service=registry-name.azurecr.io: 401 Unauthorized" host=registry-name.azurecr.io
time="2023-06-09T06:17:02Z" level=warning msg="--debug specified, working folder at /tmp/copa-1306459613 needs to be manually cleaned up"
Error: failed to authorize: failed to fetch anonymous token: unexpected status from GET request to https://registry-name.azurecr.io/oauth2/token?scope=repository%3Arepo%3Apull&service=registry-name.azurecr.io: 401 Unauthorized
##[debug]Exit code 1 received from tool '/usr/bin/bash'
If the image already exists on the build machine, can this request and hence authentication process be skipped and work with the local image?
v0.2.0
Patch succeeds
Starting image patching
Error: failed to dial gRPC: rpc error: code = Unavailable desc = rpc error: code = Unavailable desc = connection error: desc = "transport: error while dialing: dial unix /run/buildkit/buildkitd.sock: connect: no such file or directory"
Finished image patching
time="2023-05-21T22:35:21Z" level=info msg="auto snapshotter: using overlayfs"
time="2023-05-21T22:35:21Z" level=warning msg="using host network as the default"
time="2023-05-21T22:35:21Z" level=info msg="found worker \"q5k6257l21nsa2apkvri5g60b\", labels=map[org.mobyproject.buildkit.worker.executor:oci org.mobyproject.buildkit.worker.hostname:vm1 org.mobyproject.buildkit.worker.network:host org.mobyproject.buildkit.worker.oci.process-mode:sandbox org.mobyproject.buildkit.worker.selinux.enabled:false org.mobyproject.buildkit.worker.snapshotter:overlayfs], platforms=[linux/amd64 linux/amd64/v2 linux/amd64/v3 linux/amd64/v4 linux/386]"
time="2023-05-21T22:35:21Z" level=warning msg="using host network as the default"
time="2023-05-21T22:35:21Z" level=info msg="found worker \"w4v4jlc5lrw5c8i6r42f4j909\", labels=map[org.mobyproject.buildkit.worker.containerd.namespace:buildkit org.mobyproject.buildkit.worker.containerd.uuid:91fde356-0f86-4d04-9899-109cbdb56f59 org.mobyproject.buildkit.worker.executor:containerd org.mobyproject.buildkit.worker.hostname:vm1 org.mobyproject.buildkit.worker.network:host org.mobyproject.buildkit.worker.selinux.enabled:false org.mobyproject.buildkit.worker.snapshotter:overlayfs], platforms=[linux/amd64 linux/amd64/v2 linux/amd64/v3 linux/amd64/v4 linux/386]"
time="2023-05-21T22:35:21Z" level=info msg="found 2 workers, default=\"q5k6257l21nsa2apkvri5g60b\""
time="2023-05-21T22:35:21Z" level=warning msg="currently, only the default worker can be used."
time="2023-05-21T22:35:21Z" level=info msg="stopping server"
buildkitd: context canceled
Followed the steps from https://project-copacetic.github.io/copacetic/website/quick-start#sample-steps
This seems to be a sporadic occurrence when there's an issue with buildkit.
Ideally copa should be fault tolerant.
New feature
copa currently supports patching images using report generated by Trivy in JSON format
FEATURE:
add support to copa for patching images using report format generated by Kubescape as well, in JSON format.
New feature
investigate wolfi based images https://github.com/chainguard-images/images#chainguard-images
cgr.dev/chainguard/go:1.19.4 (fixable vulns in git, openssl, libcrypto)
cgr.dev/chainguard/cc-dynamic
cgr.dev/chainguard/static
...
will they be similar to distroless/debian or alpine?
New feature
We should design a GitHub action to utilize copa. I think that would live in a separate repo in the same org
Improvement of existing experience
Is it possible \ desirable to allow Copa to patch local images instead of requiring a remote registry? At the moment when Copa is used as part of a build pipeline you have to push your image to a remote registry, patch it, then push the image to the registry again. With the ability to patch local images you could build, patch, and then only push the image once.
New feature
https://github.com/openvex/vexctl
https://github.com/openvex/spec
outputs fixed vulnerabilities as fixed
New feature
We could write a dependabot plugin that patches similar to how depedabot handles dependencies today
Missing information or guidance
add/update docs for #233
https://github.com/project-copacetic/copacetic/tree/main/website/docs
None
No response
Other
Missing coverage in most of the packages
? github.com/project-copacetic/copacetic/pkg/buildkit [no test files]
? github.com/project-copacetic/copacetic/pkg/patch [no test files]
? github.com/project-copacetic/copacetic/pkg/pkgmgr [no test files]
? github.com/project-copacetic/copacetic/pkg/report [no test files]
? github.com/project-copacetic/copacetic/pkg/types [no test files]
ok github.com/project-copacetic/copacetic/pkg/utils 0.003s
Hey there 👋 .. First of all thanks for this great project! .. Just was curious, if there's a plan to also (maybe conditionally) support patching application specific dependencies and not only OS-level dependencies.
Some background / example context: A Spring Boot App that's running on eclipse-temurin:17-jre-alpine
might have the list of vulnerabilties below:
myregistry.com/some-app:latest (alpine 3.17.3)
Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 0, CRITICAL: 0)
┌────────────┬───────────────┬──────────┬───────────────────┬───────────────┬────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │
├────────────┼───────────────┼──────────┼───────────────────┼───────────────┼────────────────────────────────────────────────────────────┤
│ libcrypto3 │ CVE-2023-1255 │ MEDIUM │ 3.0.8-r3 │ 3.0.8-r4 │ Input buffer over-read in AES-XTS implementation on 64 bit │
│ │ │ │ │ │ ARM │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-1255 │
├────────────┤ │ │ │ │ │
│ libssl3 │ │ │ │ │ │
│ │ │ │ │ │ │
│ │ │ │ │ │ │
└────────────┴───────────────┴──────────┴───────────────────┴───────────────┴────────────────────────────────────────────────────────────┘
2023-05-12T17:08:53.318+0200 INFO Table result includes only package filenames. Use '--format json' option to get the full path to the package file.
Java (jar)
Total: 8 (UNKNOWN: 0, LOW: 0, MEDIUM: 5, HIGH: 1, CRITICAL: 2)
┌──────────────────────────────────────────────────┬──────────────────┬──────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │
├──────────────────────────────────────────────────┼──────────────────┼──────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ org.springframework:spring-web (application.jar) │ CVE-2016-1000027 │ CRITICAL │ 5.3.27 │ 6.0.0 │ spring: HttpInvokerServiceExporter readRemoteInvocation │
│ │ │ │ │ │ method untrusted java deserialization │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2016-1000027 │
├──────────────────────────────────────────────────┼──────────────────┤ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ org.yaml:snakeyaml (application.jar) │ CVE-2022-1471 │ │ 1.30 │ 2.0 │ Constructor Deserialization Remote Code Execution │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-1471 │
│ ├──────────────────┼──────────┤ ├───────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2022-25857 │ HIGH │ │ 1.31 │ Denial of Service due to missing nested depth limitation for │
│ │ │ │ │ │ collections │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-25857 │
│ ├──────────────────┼──────────┤ │ ├──────────────────────────────────────────────────────────────┤
│ │ CVE-2022-38749 │ MEDIUM │ │ │ Uncaught exception in │
│ │ │ │ │ │ org.yaml.snakeyaml.composer.Composer.composeSequenceNode │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-38749 │
│ ├──────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤
│ │ CVE-2022-38750 │ │ │ │ Uncaught exception in │
│ │ │ │ │ │ org.yaml.snakeyaml.constructor.BaseConstructor.constructObj- │
│ │ │ │ │ │ ect │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-38750 │
│ ├──────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤
│ │ CVE-2022-38751 │ │ │ │ Uncaught exception in │
│ │ │ │ │ │ java.base/java.util.regex.Pattern$Ques.match │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-38751 │
│ ├──────────────────┤ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2022-38752 │ │ │ 1.32 │ Uncaught exception in java.base/java.util.ArrayList.hashCode │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-38752 │
│ ├──────────────────┤ │ │ ├──────────────────────────────────────────────────────────────┤
│ │ CVE-2022-41854 │ │ │ │ DoS via stack overflow │
│ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-41854 │
└──────────────────────────────────────────────────┴──────────────────┴──────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘
With Copa
, I am so glad that I can get libcrypto3
& libssl3
patched and hence get no base image vulnerabilties anymore. However, what about the lovely snakeyaml
in my application? 😄 .. Despite using the latest (or maybe I could say fairly new) version of the Spring Boot framework, the upstream project didn't update the vulnerable library .. soooo
Missing information or guidance
We should be clear on the copa capabilities today. I had a few questions from folks that thought it would patch Go or Java app level dependency vulnerabilities
We should also clarify what is an "OS" vs "App" vulnerability
None
document how to filter vulns using rego policy or ignore file
https://aquasecurity.github.io/trivy/v0.43/docs/configuration/filtering/
example from CI:
copacetic/.github/workflows/build.yml
Lines 112 to 126 in 3e22d49
Other
group dependabot update where it makes sense
example: https://github.com/Azure/azure-workload-identity/blob/main/.github/dependabot.yml#L14-L21
Other
looks like mdx-js react bump causes website to break (see #223)
we should have a check to verify website deploys succeed
None
Hi
Trivy will output Detected OS: amazon https://aquasecurity.github.io/trivy/v0.17.2/vuln-detection/os/
Amazon Linux 2 is based of fedora/RHEL. Package manager is yum so you could use yum to update the layers.
Copa outputs Error: unsupported osType amazon specified
v0.2.0-17-g4d03dd1
fix the os vuln in image successfully
failed to patch image because copa can't request registry
$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 22.04 LTS
Release: 22.04
Codename: jammy
$ docker version
Client: Docker Engine - Community
Version: 23.0.6
API version: 1.42
Go version: go1.19.9
Git commit: ef23cbc
Built: Fri May 5 21:18:13 2023
OS/Arch: linux/amd64
Context: default
Server: Docker Engine - Community
Engine:
Version: 23.0.6
API version: 1.42 (minimum version 1.12)
Go version: go1.19.9
Git commit: 9dbdbd4
Built: Fri May 5 21:18:13 2023
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: 1.6.21
GitCommit: 3dce8eb055cbb6872793272b4f20ed16117344f8
runc:
Version: 1.1.7
GitCommit: v1.1.7-0-g860f061
docker-init:
Version: 0.19.0
GitCommit: de40ad0
$ cat /etc/docker/daemon.json
{
"insecure-registries":["https://192.168.1.94","192.168.1.94:443"]
}
copa patch -i 192.168.1.94:443/deploy/my_image:v1.1 -r my_image_v1.1.json -t v1.1-patched --debug
to patch imageDEBU[0000] updates to apply: &{alpine 3.17.0 amd64 [{libcom_err 1.46.6-r0} {libcrypto3 3.0.7-r2} {libcrypto3 3.0.8-r0} {libcrypto3 3.0.8-r0} {libcrypto3 3.0.8-r0} {libcrypto3 3.0.8-r0} {libcrypto3 3.0.8-r0} {libcrypto3 3.0.8-r0} {libcrypto3 3.0.8-r1} {libcrypto3 3.0.8-r0} {libcrypto3 3.0.8-r0} {libcrypto3 3.0.8-r2} {libcrypto3 3.0.8-r3} {libcrypto3 3.0.8-r4} {libssl3 3.0.7-r2} {libssl3 3.0.8-r0} {libssl3 3.0.8-r0} {libssl3 3.0.8-r0} {libssl3 3.0.8-r0} {libssl3 3.0.8-r0} {libssl3 3.0.8-r0} {libssl3 3.0.8-r1} {libssl3 3.0.8-r0} {libssl3 3.0.8-r0} {libssl3 3.0.8-r2} {libssl3 3.0.8-r3} {libssl3 3.0.8-r4}]}
DEBU[0000] resolving host="192.168.1.94:443"
DEBU[0000] do request host="192.168.1.94:443" request.header.accept="application/vnd.docker.distribution.manifest.v2+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, */*" request.header.user-agent=buildkit/0.0.0+unknown request.method=HEAD url="https://192.168.1.94:443/v2/deploy/my_image/manifests/v1.1"
INFO[0000] trying next host error="failed to do request: Head \"https://192.168.1.94:443/v2/deploy/my_image/manifests/v1.1\": tls: failed to verify certificate: x509: certificate signed by unknown authority" host="192.168.1.94:443"
WARN[0000] --debug specified, working folder at /tmp/copa-3163234201 needs to be manually cleaned up
Error: failed to do request: Head "https://192.168.1.94:443/v2/deploy/my_image/manifests/v1.1": tls: failed to verify certificate: x509: certificate signed by unknown authority
Improvement of existing experience
We should consider adding copa to brew to provide a more seamless installation experience for Mac and Linux users
v0.2.0
Patched image is exported successfully
Encountered below error and then output froze, I had to ^C to exit.
=> ERROR exporting to docker image format 0.7s
=> => exporting layers 0.7s
=> => exporting manifest sha256:f4bxxxx2f7 0.0s
=> => exporting config sha256:fadxxxx26f 0.0s
------
> exporting to docker image format:
------
Installed with brew install copa
Ran buildkit in a container with docker run --detach --rm --privileged -p 127.0.0.1:8888:8888/tcp --name buildkitd --entrypoint buildkitd moby/buildkit --addr tcp://0.0.0.0:8888
Ran trivy image --vuln-type os --ignore-unfixed -f json -o my-image.json my-image:test
Ran copa patch -i my-image:test -r my-image.json -t -patched -a tcp://0.0.0.0:8888
Received the error as shared above
Details about image from docker inspect, Architecture: arm64
, Os: linux
No response
No response
release process fails with the following error:
#10 ERROR: failed to push ghcr.io/project-copacetic/copa-action:v0.4.0: failed to authorize: failed to fetch anonymous token: unexpected status from GET request to https://ghcr.io/token?scope=repository%3Aproject-copacetic%2Fcopa-action%3Apull%2Cpush&service=ghcr.io: 403 Forbidden
Looks like action needs permission to push to GHCR
https://github.com/project-copacetic/copacetic/actions/runs/5942389504/job/16115269547
Improvement of existing experience
I would like to add http proxy support when executing package manager updates, so we can use this tool in environments using corporate proxies.
Other
Move @CodeMonkeyLeet out of maintainers and codeowners into emeritus given the change in roles.
Other
https://github.com/project-copacetic/copacetic/blob/main/.github/workflows/release-pr.yml
#109
consider updating release-pr to something like release-docs since workflow is different in this repo
Curious if you can configure the package repository that the tool uses to patch the affected packages?
Incorrect or outdated information
currently, installation steps are more like developer docs, we should update with info on how to download from Github release and brew (once we have it)
https://project-copacetic.github.io/copacetic/website/installation
None
[2023-04-24T22:15:01.179Z] (!) WARNING: Using the deprecated 'docker-in-docker' Feature. See https://github.com/devcontainers/features/tree/main/src/docker-in-docker#example-usage for the updated Feature.
we are using the deprecated 'docker-in-docker' Feature, migrate to "ghcr.io/devcontainers/features/docker-in-docker:2"
Improvement of existing experience
It would be nice to push to the image registry directly.
Like :
copa patch -i docker.io/library/alpine:3.16.4 -r patch.json -p ttl.sh/alpinepatched:1h
One side-effect of this would be that copa wouldn't rely on Docker anymore if there is a remote buildkit setup as I mentioned here. #285 (comment)
New feature
Direct feedback after demoing copa:
One other feature I would like to see from Copacetic would be the ability to specify the licenses I'm willing to incorporate into my images. Sometimes, ensuring licensing models are in tact may be more important to the business than the security patching at the image level. Said another way, sometimes I'll block that at the perimeter rather than open myself up to possible licensing litigation. It would be nice to patch unless the patch requires me to violate an acceptable license rule I have in place.
v0.2.0
I've expected that the patch applies the latest
or at least the highest fixedVersion
number of a package in case there are a few of the same libraries listed in the patch.json
.
Which would update in my case for example:
libwebp
from version 1.2.3-r0
to 1.3.0-r3"
tiff
from version 4.4.0-r0
to 4.5.0-r0
Instead copa seems to update the package to the next version in row.
Error: 5 errors occurred:
...
* downloaded package libwebp version 1.2.3-r1 lower than required 1.3.0-r3 for update
* downloaded package tiff version 4.4.0-r3 lower than required 4.5.0-r0 for update
root@6f623b4cd7d7:/azp# trivy image --exit-code 0 --format json --output ./patch.json --scanners vuln --vuln-type os --ignore-unfixed --severity "HIGH" some-registry.org/repo/corp-aspnetcore:6.0-alpine
2023-06-21T10:20:54.536Z INFO Vulnerability scanning is enabled
2023-06-21T10:20:54.545Z INFO Detected OS: alpine
2023-06-21T10:20:54.545Z INFO Detecting Alpine vulnerabilities...
root@6f623b4cd7d7:/azp# cat patch.json | jq '.Results[0].Vulnerabilities[] | "\(.PkgID) \(.Severity) \(.CweIDs) \(.Title) \(.InstalledVersion) \(.FixedVersion)"' | sort | uniq
"[email protected] HIGH [\"CWE-190\"] integer overflow vulnerabilities in PAC parsing 1.19.4-r0 1.20.1-r0"
"[email protected] HIGH [\"CWE-120\"] X.509 Email Address Buffer Overflow 1.1.1t-r0 3.0.7-r0"
"[email protected] HIGH [\"CWE-120\"] X.509 Email Address Variable Length Buffer Overflow 1.1.1t-r0 3.0.7-r0"
"[email protected] HIGH [\"CWE-295\"] Denial of service by excessive resource usage in verifying X509 policy constraints 1.1.1t-r0 3.1.0-r1"
"[email protected] HIGH [\"CWE-404\"] OPENSSL_LH_flush() breaks reuse of memory 1.1.1t-r0 3.0.3-r0"
"[email protected] HIGH [\"CWE-415\"] double free after calling PEM_read_bio_ex 1.1.1t-r0 3.0.8-r0"
"[email protected] HIGH [\"CWE-416\"] use-after-free following BIO_new_NDEF 1.1.1t-r0 3.0.8-r0"
"[email protected] HIGH [\"CWE-476\"] invalid pointer dereference in d2i_PKCS7 functions 1.1.1t-r0 3.0.8-r0"
"[email protected] HIGH [\"CWE-476\"] NULL dereference during PKCS7 data verification 1.1.1t-r0 3.0.8-r0"
"[email protected] HIGH [\"CWE-476\"] NULL dereference validating DSA public key 1.1.1t-r0 3.0.8-r0"
"[email protected] HIGH [\"CWE-476\"] Using a Custom Cipher with NID_undef may lead to NULL encryption 1.1.1t-r0 3.0.6-r0"
"[email protected] HIGH [\"CWE-667\"] openssl: double locking leads to denial of service 1.1.1t-r0 3.0.7-r2"
"[email protected] HIGH [\"CWE-770\"] Possible DoS translating ASN.1 object identifiers 1.1.1t-r0 3.1.1-r0"
"[email protected] HIGH [\"CWE-835\"] openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates 1.1.1t-r0 3.0.2-r0"
"[email protected] HIGH [\"CWE-835\"] openssl: invalid handling of X509_verify_cert() internal errors in libssl 1.1.1t-r0 3.0.1-r0"
"[email protected] HIGH [\"CWE-843\"] X.400 address type confusion in X.509 GeneralName 1.1.1t-r0 3.0.8-r0"
"[email protected] HIGH [\"CWE-120\"] X.509 Email Address Buffer Overflow 1.1.1t-r0 3.0.7-r0"
"[email protected] HIGH [\"CWE-120\"] X.509 Email Address Variable Length Buffer Overflow 1.1.1t-r0 3.0.7-r0"
"[email protected] HIGH [\"CWE-295\"] Denial of service by excessive resource usage in verifying X509 policy constraints 1.1.1t-r0 3.1.0-r1"
"[email protected] HIGH [\"CWE-404\"] OPENSSL_LH_flush() breaks reuse of memory 1.1.1t-r0 3.0.3-r0"
"[email protected] HIGH [\"CWE-415\"] double free after calling PEM_read_bio_ex 1.1.1t-r0 3.0.8-r0"
"[email protected] HIGH [\"CWE-416\"] use-after-free following BIO_new_NDEF 1.1.1t-r0 3.0.8-r0"
"[email protected] HIGH [\"CWE-476\"] invalid pointer dereference in d2i_PKCS7 functions 1.1.1t-r0 3.0.8-r0"
"[email protected] HIGH [\"CWE-476\"] NULL dereference during PKCS7 data verification 1.1.1t-r0 3.0.8-r0"
"[email protected] HIGH [\"CWE-476\"] NULL dereference validating DSA public key 1.1.1t-r0 3.0.8-r0"
"[email protected] HIGH [\"CWE-476\"] Using a Custom Cipher with NID_undef may lead to NULL encryption 1.1.1t-r0 3.0.6-r0"
"[email protected] HIGH [\"CWE-667\"] openssl: double locking leads to denial of service 1.1.1t-r0 3.0.7-r2"
"[email protected] HIGH [\"CWE-770\"] Possible DoS translating ASN.1 object identifiers 1.1.1t-r0 3.1.1-r0"
"[email protected] HIGH [\"CWE-835\"] openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates 1.1.1t-r0 3.0.2-r0"
"[email protected] HIGH [\"CWE-835\"] openssl: invalid handling of X509_verify_cert() internal errors in libssl 1.1.1t-r0 3.0.1-r0"
"[email protected] HIGH [\"CWE-843\"] X.400 address type confusion in X.509 GeneralName 1.1.1t-r0 3.0.8-r0"
"[email protected] HIGH null Double-free in libwebp 1.2.3-r0 1.3.0-r3"
"[email protected] HIGH [\"CWE-189\",\"CWE-190\"] integer overflow in function TIFFReadRGBATileExt of the file 4.4.0-r0 4.5.0-r0"
root@6f623b4cd7d7:/azp# copa patch -i some-registry.org/repo/corp-aspnetcore:6.0-alpine -r ./patch.json -t 6.0-alpine-patched
[+] Building 0.1s (8/8) FINISHED
=> docker-image://some-registry.org/repo/corp-aspnetcore:6.0-alpine 0.0s
=> => resolve some-registry.org/repo/corp-aspnetcore:6.0-alpine 0.0s
=> CACHED apk update 0.0s
=> CACHED apk add --no-cache krb5-libs libcrypto1.1 libssl1.1 libwebp tiff 0.0s
=> CACHED apk upgrade --no-cache krb5-libs libcrypto1.1 libssl1.1 libwebp tiff 0.0s
=> CACHED mkdir /copa-out 0.0s
=> CACHED sh -c apk info --installed -v krb5-libs libcrypto1.1 libssl1.1 libwebp tiff > results.manifest; if [[ $? -ne 0 ]]; then echo "WARN: apk info --installed returned $?"; fi 0.0s
=> CACHED diff (apk upgrade --no-cache krb5-libs libcrypto1.1 libssl1.1 libwebp tiff) -> (sh -c apk info --installed -v krb5-libs libcrypto1.1 libssl1.1 libwebp tiff > results.manifest; if [[ $? -ne 0 ]]; then echo "WARN: apk info --installed returned $?"; fi) 0.0s
=> exporting to client directory 0.0s
=> => copying files 172B 0.0s
ERRO[0000] downloaded package krb5-libs version 1.19.4-r0 lower than required 1.20.1-r0 for update
ERRO[0000] downloaded package libcrypto1.1 version 1.1.1u-r1 lower than required 3.1.1-r0 for update
ERRO[0000] downloaded package libssl1.1 version 1.1.1u-r1 lower than required 3.1.1-r0 for update
ERRO[0000] downloaded package libwebp version 1.2.3-r1 lower than required 1.3.0-r3 for update
ERRO[0000] downloaded package tiff version 4.4.0-r3 lower than required 4.5.0-r0 for update
Error: 5 errors occurred:
* downloaded package krb5-libs version 1.19.4-r0 lower than required 1.20.1-r0 for update
* downloaded package libcrypto1.1 version 1.1.1u-r1 lower than required 3.1.1-r0 for update
* downloaded package libssl1.1 version 1.1.1u-r1 lower than required 3.1.1-r0 for update
* downloaded package libwebp version 1.2.3-r1 lower than required 1.3.0-r3 for update
* downloaded package tiff version 4.4.0-r3 lower than required 4.5.0-r0 for update
This does not happen with all our images. Is there anything I'm missing?
Thanks for taking the time to take care of this.
Other
Similar to https://open-policy-agent.github.io/gatekeeper/ and https://azure.github.io/eraser - let's spin up a docusaurus site to host the docs with GitHub pages
The save-state
& set-output
deprecation warnings in the build pipelines are due to the dependency on the devcontainers/ci Action which still use the deprecated actions.
Once devcontainers/ci#187 is merged and a new release is available, upgrading to the new build should remove the warnings.
Is Centos7 not supported?
Really cool project :)
Improvement of existing experience
Hey folks, I'd like to use Copa using a remote buildkit daemon, if people have builds and patching done over the same buildkit instance, they'll benefit from the cache.
I've submitted a PR to support it: #284
New feature
Output a report that includes which components got patched for what CVEs
Other
document copa action in copa docs
Other
https://github.com/project-copacetic/copacetic/tree/main/docs
We should assess if these need to be moved to website
None
use copa as a buildkit frontend to generate build context and pass to buildkit
example: copa generate -i foo/bar -t patched | docker build -
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.