build-labels 0.0.78 → 0.0.80

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8c98d7473c265c1f954d96ece1cfa66d725076c82a77575eb818e0f555203d8e
-  data.tar.gz: 0e255d2b86daef6f54e974b42ccb170e45ac36f71d7986b7c4b996999814826e
+  metadata.gz: 85c6a279190386fdb2b18065e676e640484c5ce4b2f4fe3b3de8597bb81214a8
+  data.tar.gz: 419d06b5f33b03d79312022cc7ee4df622d2bcca99474177481d131890cdfa6f
 SHA512:
-  metadata.gz: 78c6fea7954548de03d0253fc93fa101c29b405577a6cb9da917618af6e3fc9ea60d1b30b54d0b43e36b6e4f80e3b25f0c07c358f53ca67928ff61107d53c31e
-  data.tar.gz: 924f79076a6224150b2137851fa98a7b9d8f8f95c356d94c08cf5d3f908c438c4d9ccf8044925d0776b4ee958e80adde8fe5e6e1b1aa6280e705e75a6ed0c30b
+  metadata.gz: f915e25af163403dd28199c99cd08d1acac593d780bdd7fd3841028e567c6944342ebbe9a6198d05586ab2f70c02bf19d547d24eb0f5a0e4fc240eec8fdafaa1
+  data.tar.gz: 9c45b412e6622ac2bc9aa528ef8fb0cb0e13d9c8663cfe85f8e3b9b00c85d186c392455f515a9c38fd53fda4ea68421bb12e1e6c066cab531dacf2e7e8e18d3a

data/bin/install-docker-static

@@ -9,6 +9,16 @@ set -eux
 docker_major=""
 docker_version_prefix=""
 
+curl_fetch() {
+    curl -fsSL \
+        --retry "${CURL_RETRIES:-3}" \
+        --retry-delay "${CURL_RETRY_DELAY:-2}" \
+        --retry-all-errors \
+        --connect-timeout "${CURL_CONNECT_TIMEOUT:-10}" \
+        --max-time "${CURL_MAX_TIME:-120}" \
+        "$@"
+}
+
 usage() {
     cat <<'USAGE'
 Usage: install-docker-static [VERSION_PREFIX] [--docker-major N]
@@ -140,7 +150,7 @@ install_docker_static() {
     detect_arch
     base_url="https://download.docker.com/linux/static/stable/$docker_arch/"
     versions="$(
-        curl -fsSL "$base_url" \
+        curl_fetch "$base_url" \
             | sed -n 's/.*docker-\([0-9.][0-9.]*\)\.tgz.*/\1/p' \
             | sort -t. -k1,1n -k2,2n -k3,3n -k4,4n
     )"
@@ -170,7 +180,7 @@ install_docker_static() {
         exit 1
     fi
     tmp_dir="$(mktemp -d)"
-    curl -fsSL "${base_url}docker-${latest_version}.tgz" -o "$tmp_dir/docker.tgz"
+    curl_fetch "${base_url}docker-${latest_version}.tgz" -o "$tmp_dir/docker.tgz"
     tar -xzf "$tmp_dir/docker.tgz" -C "$tmp_dir"
     install -m 0755 "$tmp_dir/docker/docker" /usr/local/bin/docker
     rm -rf "$tmp_dir"
@@ -181,7 +191,7 @@ install_buildx() {
     buildx_version="${BUILDX_VERSION:-}"
     if [ -z "$buildx_version" ]; then
         buildx_version="$(
-            curl -fsSL https://api.github.com/repos/docker/buildx/releases/latest \
+            curl_fetch https://api.github.com/repos/docker/buildx/releases/latest \
                 | sed -n 's/.*"tag_name": "\(v[0-9.]*\)".*/\1/p' \
                 | head -n 1
         )"
@@ -192,7 +202,7 @@ install_buildx() {
     fi
     plugin_dir="/usr/local/lib/docker/cli-plugins"
     mkdir -p "$plugin_dir"
-    curl -fsSL \
+    curl_fetch \
         -o "$plugin_dir/docker-buildx" \
         "https://github.com/docker/buildx/releases/download/${buildx_version}/buildx-${buildx_version}.linux-${buildx_arch}"
     chmod 0755 "$plugin_dir/docker-buildx"
@@ -203,7 +213,7 @@ install_compose() {
     compose_version="${COMPOSE_VERSION:-}"
     if [ -z "$compose_version" ]; then
         compose_version="$(
-            curl -fsSL https://api.github.com/repos/docker/compose/releases/latest \
+            curl_fetch https://api.github.com/repos/docker/compose/releases/latest \
                 | sed -n 's/.*"tag_name": "\(v[0-9.]*\)".*/\1/p' \
                 | head -n 1
         )"
@@ -214,7 +224,7 @@ install_compose() {
     fi
     plugin_dir="/usr/local/lib/docker/cli-plugins"
     mkdir -p "$plugin_dir"
-    curl -fsSL \
+    curl_fetch \
         -o "$plugin_dir/docker-compose" \
         "https://github.com/docker/compose/releases/download/${compose_version}/docker-compose-linux-${compose_arch}"
     chmod 0755 "$plugin_dir/docker-compose"

data/bin/trivy-runner

@@ -0,0 +1,5 @@
+#!/usr/bin/env ruby
+
+require_relative '../lib/trivy-runner'
+
+exit TrivyRunner.new.run(ARGV)

data/lib/trivy-runner.rb

@@ -0,0 +1,93 @@
+require 'json'
+require 'open3'
+require 'optparse'
+require 'yaml'
+require_relative 'version'
+
+class TrivyRunner
+  SEVERITIES = %w[UNKNOWN LOW MEDIUM HIGH CRITICAL].freeze
+  IMAGE_ID = /\Asha256:[0-9a-f]{64}\z/
+
+  def run(args)
+    file = 'bake.yml'
+    metadata_file = nil
+    severity = %w[HIGH CRITICAL]
+    parser = OptionParser.new do |options|
+      options.banner = 'Usage: trivy-runner -f BAKE_FILE --metadata-file FILE [TARGET/GROUP ...]'
+      options.on('-f', '--file FILE', 'Bake or Compose file (default: bake.yml)') { file = _1 }
+      options.on('--metadata-file FILE', 'Buildx metadata from the local build') { metadata_file = _1 }
+      options.on('--image-src SOURCE', %w[docker], 'Image source (default: docker)')
+      options.on('--fail-on SEVERITIES', Array, 'Fail on these severities (default: HIGH,CRITICAL)') do |values|
+        severity = values.map { _1.strip.upcase }.uniq
+        if severity.empty? || (severity - SEVERITIES).any?
+          raise OptionParser::InvalidArgument, values.join(',')
+        end
+      end
+      options.on('-v', '--version', 'Print version') { puts BuildLabels::Builder::VERSION; return 0 }
+      options.on('-h', '--help', 'Print help') { puts options; return 0 }
+    end
+    targets = parser.parse!(args.dup)
+    raise OptionParser::MissingArgument, '--metadata-file' unless metadata_file
+    return 0 if targets.empty? && empty_compose?(file)
+
+    metadata = JSON.parse(File.read(metadata_file))
+    plan = capture_json('docker', 'buildx', 'bake', '-f', file, '--print', '--', *targets)
+    images = image_tags(plan.fetch('target'), metadata)
+    return 0 if images.empty?
+
+    verify_images(images)
+    images.values.uniq.each do |image_id|
+      return 1 unless system('trivy', 'image', '--image-src', 'docker', '--scanners', 'vuln',
+                             '--severity', severity.join(','), '--exit-code', '1', image_id)
+    end
+    verify_images(images)
+    0
+  rescue StandardError => error
+    warn error.message
+    1
+  end
+
+  private
+
+  def empty_compose?(file)
+    document = YAML.safe_load(File.read(file), aliases: true)
+    document.is_a?(Hash) && document['services'] == {}
+  rescue Psych::Exception
+    false
+  end
+
+  def image_tags(targets, metadata)
+    raise 'Invalid Bake target map' unless targets.is_a?(Hash)
+
+    images = {}
+    targets.each do |name, target|
+      raise "Multiple platforms for target: #{name}" if (target['platforms'] || []).size > 1
+
+      image_id = metadata.fetch(name).fetch('containerimage.config.digest')
+      raise "Invalid image ID for target: #{name}" unless image_id.is_a?(String) && IMAGE_ID.match?(image_id)
+
+      tags = target.fetch('tags')
+      raise "Missing image tags for target: #{name}" unless tags.is_a?(Array) && !tags.empty?
+
+      tags.each do |tag|
+        raise "Invalid image tag for target: #{name}" unless tag.is_a?(String) && !tag.empty?
+        raise "Conflicting image tag: #{tag}" if images.key?(tag) && images[tag] != image_id
+
+        images[tag] = image_id
+      end
+    end
+    images
+  end
+
+  def verify_images(images)
+    actual = capture_json('docker', 'image', 'inspect', '--', *images.keys).map { _1.fetch('Id') }
+    raise 'Image tags do not match build metadata' unless actual == images.values
+  end
+
+  def capture_json(*command)
+    output, status = Open3.capture2(*command)
+    raise "#{command.first} failed with status #{status.exitstatus}" unless status.success?
+
+    JSON.parse(output)
+  end
+end

data/lib/version.rb

@@ -1,5 +1,5 @@
 module BuildLabels
   class Builder
-    VERSION = '0.0.78'
+    VERSION = '0.0.80'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: build-labels
 version: !ruby/object:Gem::Version
-  version: 0.0.78
+  version: 0.0.80
 platform: ruby
 authors:
 - Artyom B
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-06-25 00:00:00.000000000 Z
+date: 2026-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -99,6 +99,7 @@ email: author@email.address
 executables:
 - build-labels
 - helm-push
+- trivy-runner
 - install-docker-static
 extensions: []
 extra_rdoc_files: []
@@ -106,6 +107,7 @@ files:
 - bin/build-labels
 - bin/helm-push
 - bin/install-docker-static
+- bin/trivy-runner
 - examples/Dockerfile
 - examples/common-compose.yml
 - examples/simple-compose.yml
@@ -124,6 +126,7 @@ files:
 - lib/helm-push.rb
 - lib/helm-push/command_line.rb
 - lib/helm-push/command_push.rb
+- lib/trivy-runner.rb
 - lib/version.rb
 homepage: https://rubygems.org/gems/build-labels
 licenses: