examine 0.1.1 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d580d78447a470a51a68c9c9c67a921f223bd982b7d28977885b7b70ea1d9f1f
-  data.tar.gz: 7775399dbe8b3f043a77de1afb83be5a54e4096e9be051f3089f0a830aa3e1bd
+  metadata.gz: d0f7d30f66f0b34778516fcf2b3ce7c78c4e739a89dcf7b5dda1b1669e60b28f
+  data.tar.gz: bbe264a31ee2cee91c8039ff45839ced136073f08d7a820e5fa47a43fecc8464
 SHA512:
-  metadata.gz: 7deb9c99012fdb03a1a6bf94d49bd168c1590f17ed84be12ab704c0d77612b52fd6e22aa155bf5f64a8ca7367abf6288c2fe1054a5708d5ccc3c02f8d411df3c
-  data.tar.gz: 9b43e8f24d5b0d14a0f6a8cf797c18712f2f7ffd4299b1bde86a1de4e2fe726cc1c3d5e63dacc947caf5de114f2760023b73d140fc44088b3e88a6430966394c
+  metadata.gz: 5bc0f075a47b62872f43635eef0d0cca61e6f998dbbe068fc13061a1b12db3aee7cda41183024292cc29828be2c890aed6ce82d6edaa86c138a95edc2ac1b98b
+  data.tar.gz: d4a4f951c73fc4aff984af309397913f1981ebbfc95cf8b8a1bb1f4cc4372706ab7eda9561bae47fb1dc0407a13e20900b74de787f1adcd732ba1ab7e3e562a8

data/.gitlab-ci.yml

@@ -25,9 +25,19 @@ rspec:
     GIT_STRATEGY: none
   stage: test
   script:
-    - cd /examine/ && bundle exec rspec
+    - cd /examine/ && ./bin/test
 
-examine:
+lint:
+  image:
+    name: $DOCKER_IMAGE
+    entrypoint: [""]
+  variables:
+    GIT_STRATEGY: none
+  stage: test
+  script:
+    - cd /examine/ && ./bin/lint
+
+container_scanning:
   image:
     name: docker:stable
   allow_failure: true
@@ -43,4 +53,8 @@ examine:
     - apk add ruby curl
     - gem install examine --no-document
     - docker login -u gitlab-ci-token -p $CI_JOB_TOKEN $CI_REGISTRY
-    - examine clair scan $DOCKER_IMAGE --clair_url $CLAIR_URL --ip $(hostname -i)
+    - examine clair scan $DOCKER_IMAGE --clair_url $CLAIR_URL --ip $(hostname -i) --report gl-container-scanning-report.json
+  artifacts:
+    reports:
+      container_scanning: gl-container-scanning-report.json
+    paths: [gl-container-scanning-report.json]

data/.rubocop.yml

@@ -0,0 +1,30 @@
+require:
+  - rubocop/cop/internal_affairs
+  - rubocop-rspec
+AllCops:
+  Exclude:
+    - 'coverage/**/*'
+    - 'pkg/**/*'
+    - 'tmp/**/*'
+    - 'vendor/**/*'
+  TargetRubyVersion: 2.5
+
+Layout/IndentFirstArrayElement:
+  EnforcedStyle: consistent
+
+Metrics/BlockLength:
+  Exclude:
+    - '*.gemspec'
+    - 'spec/**/*.rb'
+
+Metrics/LineLength:
+  Exclude:
+    - 'spec/**/*.rb'
+  IgnoredPatterns:
+    - '^#*'
+
+Naming/RescuedExceptionsVariableName:
+  PreferredName: error
+
+RSpec/NamedSubject:
+  Enabled: false

data/Dockerfile

@@ -1,11 +1,16 @@
 FROM docker:stable
-RUN apk add ruby git curl
-RUN gem install bundler -v '~> 2.0' --no-document
+ENV PACKAGES build-base ruby ruby-dev ruby-json ruby-etc git curl
 RUN wget https://github.com/arminc/clair-scanner/releases/download/v12/clair-scanner_linux_amd64 && \
   mv clair-scanner_linux_amd64 /usr/local/bin/clair-scanner && \
   chmod +x /usr/local/bin/clair-scanner
 RUN mkdir -p /examine
 WORKDIR /examine
 COPY . .
-RUN bundle install --jobs "$(nproc)" --quiet
+RUN apk update && \
+  apk upgrade && \
+  apk add $PACKAGES && \
+  rm -fr /var/cache/apk/* && \
+  gem install bundler:'~> 2.0' --no-document && \
+  bundle install --jobs "$(nproc)" --quiet --path vendor/bundle && \
+  apk del build-base
 ENTRYPOINT ["bundle", "exec", "./exe/examine"]

data/Gemfile

@@ -1,4 +1,6 @@
-source "https://rubygems.org"
+# frozen_string_literal: true
+
+source 'https://rubygems.org'
 
 # Specify your gem's dependencies in examine.gemspec
 gemspec

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    examine (0.1.1)
+    examine (0.1.2)
       down (~> 4.8)
       thor (~> 0.20)
 
@@ -10,10 +10,19 @@ GEM
   specs:
     addressable (2.6.0)
       public_suffix (>= 2.0.2, < 4.0)
+    ast (2.4.0)
+    bundler-audit (0.6.1)
+      bundler (>= 1.2.0, < 3)
+      thor (~> 0.18)
     diff-lcs (1.3)
     down (4.8.1)
       addressable (~> 2.5)
+    jaro_winkler (1.5.2)
+    parallel (1.17.0)
+    parser (2.6.3.0)
+      ast (~> 2.4.0)
     public_suffix (3.1.1)
+    rainbow (3.0.0)
     rake (10.5.0)
     rspec (3.8.0)
       rspec-core (~> 3.8.0)
@@ -28,16 +37,30 @@ GEM
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.8.0)
     rspec-support (3.8.2)
+    rubocop (0.71.0)
+      jaro_winkler (~> 1.5.1)
+      parallel (~> 1.10)
+      parser (>= 2.6)
+      rainbow (>= 2.2.2, < 4.0)
+      ruby-progressbar (~> 1.7)
+      unicode-display_width (>= 1.4.0, < 1.7)
+    rubocop-rspec (1.33.0)
+      rubocop (>= 0.60.0)
+    ruby-progressbar (1.10.1)
     thor (0.20.3)
+    unicode-display_width (1.6.0)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
   bundler (~> 2.0)
+  bundler-audit (~> 0.6)
   examine!
   rake (~> 10.0)
   rspec (~> 3.0)
+  rubocop (~> 0.52)
+  rubocop-rspec (~> 1.22)
 
 BUNDLED WITH
    2.0.2

data/Rakefile

@@ -1,6 +1,14 @@
-require "bundler/gem_tasks"
-require "rspec/core/rake_task"
+# frozen_string_literal: true
+
+require 'bundler/audit/task'
+require 'bundler/gem_tasks'
+require 'rspec/core/rake_task'
+require 'rubocop/rake_task'
 
 RSpec::Core::RakeTask.new(:spec)
+RuboCop::RakeTask.new(:rubocop)
+Bundler::Audit::Task.new
 
-task :default => :spec
+desc 'run linters'
+task lint: [:rubocop, 'bundle:audit']
+task default: :spec

data/bin/console

@@ -1,7 +1,8 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
-require "bundler/setup"
-require "examine"
+require 'bundler/setup'
+require 'examine'
 
 # You can add fixtures and/or initialization code here to make experimenting
 # with your gem easier. You can also use a different console, if you like.
@@ -10,5 +11,5 @@ require "examine"
 # require "pry"
 # Pry.start
 
-require "irb"
+require 'irb'
 IRB.start(__FILE__)

data/bin/lint

@@ -0,0 +1,11 @@
+#!/bin/sh
+
+set -e
+
+[ -z "$DEBUG" ] || set -x
+
+echo [$(date "+%H:%M:%S")] "==> Running setup…"
+bin/setup
+
+echo [$(date "+%H:%M:%S")] "==> Running linters…"
+bundle exec rake lint

data/bin/setup

@@ -1,4 +1,4 @@
-#!/usr/bin/env bash
+#!/bin/sh
 set -euo pipefail
 IFS=$'\n\t'
 set -vx

data/bin/test

@@ -0,0 +1,28 @@
+#!/bin/sh
+
+# script/test: Run test suite for application. Optionally pass in a path to an
+#              individual test file to run a single test.
+
+
+set -e
+
+cd "$(dirname "$0")/.."
+
+[ -z "$DEBUG" ] || set -x
+
+# GC customizations
+export RUBY_GC_MALLOC_LIMIT=79000000
+export RUBY_GC_HEAP_INIT_SLOTS=800000
+export RUBY_HEAP_FREE_MIN=100000
+export RUBY_HEAP_SLOTS_INCREMENT=400000
+export RUBY_HEAP_SLOTS_GROWTH_FACTOR=1
+
+echo ["$(date "+%H:%M:%S")"] "==> Running setup…"
+bin/setup
+
+echo ["$(date "+%H:%M:%S")"] "==> Running tests…"
+if [[ $# -eq 0 ]]; then
+  bundle exec rake spec
+else
+  bundle exec rspec "$1"
+fi

data/examine.gemspec

@@ -1,31 +1,35 @@
+# frozen_string_literal: true
 
-lib = File.expand_path("../lib", __FILE__)
+lib = File.expand_path('lib', __dir__)
 $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
-require "examine/version"
+require 'examine/version'
 
 Gem::Specification.new do |spec|
-  spec.name          = "examine"
+  spec.name          = 'examine'
   spec.version       = Examine::VERSION
-  spec.authors       = ["mo"]
-  spec.email         = ["mo@mokhan.ca"]
+  spec.authors       = ['mo']
+  spec.email         = ['mo@mokhan.ca']
 
-  spec.summary       = %q{Examine your software.}
-  spec.description   = %q{Examine your software.}
-  spec.homepage      = "https://www.mokhan.ca/"
-  spec.license       = "MIT"
+  spec.summary       = 'Examine your software.'
+  spec.description   = 'Examine your software.'
+  spec.homepage      = 'https://gitlab.com/xlgmokha/examine/'
+  spec.license       = 'MIT'
 
   # Specify which files should be added to the gem when it is released.
   # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
-  spec.files         = Dir.chdir(File.expand_path('..', __FILE__)) do
+  spec.files         = Dir.chdir(File.expand_path(__dir__)) do
     `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
   end
-  spec.bindir        = "exe"
+  spec.bindir        = 'exe'
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
-  spec.require_paths = ["lib"]
+  spec.require_paths = ['lib']
 
-  spec.add_dependency "down", "~> 4.8"
-  spec.add_dependency "thor", "~> 0.20"
-  spec.add_development_dependency "bundler", "~> 2.0"
-  spec.add_development_dependency "rake", "~> 10.0"
-  spec.add_development_dependency "rspec", "~> 3.0"
+  spec.add_dependency 'down', '~> 4.8'
+  spec.add_dependency 'thor', '~> 0.20'
+  spec.add_development_dependency 'bundler', '~> 2.0'
+  spec.add_development_dependency 'bundler-audit', '~> 0.6'
+  spec.add_development_dependency 'rake', '~> 10.0'
+  spec.add_development_dependency 'rspec', '~> 3.0'
+  spec.add_development_dependency 'rubocop', '~> 0.52'
+  spec.add_development_dependency 'rubocop-rspec', '~> 1.22'
 end

data/exe/examine

@@ -1,5 +1,6 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
-require "examine"
+require 'examine'
 
 Examine::CLI::Application.start(ARGV)

data/lib/examine.rb

@@ -1,5 +1,7 @@
-require "examine/cli"
-require "examine/version"
+# frozen_string_literal: true
+
+require 'examine/cli'
+require 'examine/version'
 
 module Examine
   class Error < StandardError; end

data/lib/examine/cli.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'down'
 require 'socket'
 require 'thor'
@@ -5,8 +7,3 @@ require 'timeout'
 
 require 'examine/cli/clair'
 require 'examine/cli/application'
-
-module Examine
-  module CLI
-  end
-end

data/lib/examine/cli/application.rb

@@ -1,5 +1,8 @@
+# frozen_string_literal: true
+
 module Examine
   module CLI
+    # Entrypoint to the CLI.
     class Application < Thor
       package_name 'examine'
 

data/lib/examine/cli/clair.rb

@@ -1,52 +1,55 @@
+# frozen_string_literal: true
+
 module Examine
   module CLI
+    # Entrypoint into the `examine clair` subcommand.
     class Clair < Thor
-      DOWNLOAD_PATH = 'https://github.com/arminc/clair-scanner/releases/download/v12/'
+      DOWNLOAD_PATH = 'https://github.com/arminc/clair-scanner/releases/download/'
+      EXECUTABLES = {
+        'x86-darwin' => 'clair-scanner_darwin_386',
+        'x86-linux' => 'clair-scanner_linux_386',
+        'x86_64-darwin' => 'clair-scanner_darwin_amd64',
+        'x86_64-linux' => 'clair-scanner_linux_amd64'
+      }.freeze
+
+      class_option :local_scan_version, desc: 'Version of the arminc/clair-local-scan image', default: 'latest', type: :string
+      class_option :scanner_version, desc: 'Version of the clair-scanner', default: 'v12', type: :string
+      class_option :url, desc: 'clair url', default: 'http://localhost:6060', type: :string
 
-      method_option :clair_url, desc: 'clair url', default: 'http://localhost:6060', type: :string
       desc 'start', 'start a clair server'
       def start
         ensure_docker_installed!
-        spawn 'docker run -d --name clair-db arminc/clair-db:latest'
-        wait_until('docker ps --filter="name=clair-db" --filter="status=running" --filter="expose=5432/tcp" | grep -v CONT')
+        return if started?
+
+        spawn clair_db
+        wait_until clair_db_running?
 
-        spawn 'docker run --restart=unless-stopped -p 6060:6060 --link clair-db:postgres -d --name clair arminc/clair-local-scan:latest'
-        wait_until('docker ps --filter="name=clair" --filter="status=running" --filter="expose=6060/tcp" | grep -v CONT')
-        wait_until("curl -s #{options[:clair_url]}/v1/namespaces > /dev/null")
+        spawn clair_local_scan(options[:local_scan_version])
+        wait_until clair_local_scan_running?
+        wait_until clair_local_scan_api_reachable?
       end
 
       method_option :ip, desc: 'ip address', default: nil, type: :string
-      method_option :clair_url, desc: 'clair url', default: 'http://localhost:6060', type: :string
       method_option :report, desc: 'report file', default: 'report.json', type: :string
       method_option :log, desc: 'log file', default: 'clair.log', type: :string
       method_option :whitelist, desc: 'whitelist file', default: nil, type: :string
-      desc 'scan <image>', 'scan a specific image'
+      desc 'scan <image>', 'scan a specific docker image. E.g mokhan/minbox:latest'
       def scan(image)
-        start unless started?
+        start
 
-        ip = options[:ip] || Socket.ip_address_list[1].ip_address
         system "docker pull #{image}"
-        command = [
-          clair_exe,
-          "-c #{options[:clair_url]}",
-          "--ip #{ip}",
-          "-r #{options[:report]}",
-          "-l #{options[:log]}",
-          image,
-        ]
-        command.insert(-2, "-w #{options[:whitelist]}") if options[:whitelist]
-        system command.join(' ')
+        system scan_command_for(image, options)
       end
 
       desc 'status', 'status of clair server'
       def status
-        system "docker ps -a | grep clair"
+        system 'docker ps -a | grep clair'
       end
 
       desc 'stop', 'stop all clair servers'
       def stop
         system "docker stop $(docker ps | grep -v CONT | grep clair- | awk '{ print $1 }')"
-        system "docker system prune -f"
+        system 'docker system prune -f'
       end
 
       private
@@ -59,29 +62,34 @@ module Examine
         @clair_exe ||= executable_exists?('clair-scanner') || download_clair
       end
 
+      def scan_command_for(image, options)
+        command = [
+          clair_exe, "-c #{options[:url]}",
+          "--ip #{clair_ip}",
+          "-r #{options[:report]}", "-l #{options[:log]}", image
+        ]
+        command.insert(-2, "-w #{options[:whitelist]}") if options[:whitelist]
+        command.join(' ')
+      end
+
+      def clair_ip
+        options[:ip] || Socket.ip_address_list[1].ip_address
+      end
+
       def executable_exists?(exe)
-        found = ENV['PATH'].split(':').find do |x|
-          File.exist?(File.join(x, exe))
-        end
-        return File.join(found, exe) if found
+        ENV['PATH'].split(':').map { |x| File.join(x, exe) }.find { |x| File.exist?(x) }
       end
 
       def download_clair
         File.join(Dir.tmpdir, 'clair-scanner').tap do |exe|
-          Down.download(clair_download_path, destination: exe)
+          Down.download(clair_download_url, destination: exe)
           `chmod +x #{exe}`
         end
       end
 
-      def clair_download_path
-        platform = Gem::Platform.local
-        exe = {
-          'x86-darwin' => 'clair-scanner_darwin_386',
-          'x86-linux' => 'clair-scanner_linux_386',
-          'x86_64-darwin' => 'clair-scanner_darwin_amd64',
-          'x86_64-linux' => 'clair-scanner_linux_amd64',
-        }["#{platform.cpu}-#{platform.os}"]
-        return URI.join(DOWNLOAD_PATH, exe).to_s if exe
+      def clair_download_url
+        exe = EXECUTABLES["#{Gem::Platform.local.cpu}-#{Gem::Platform.local.os}"]
+        return File.join(DOWNLOAD_PATH, options[:scanner_version], exe) if exe
 
         raise 'clair-scanner could not be found in your PATH. Download from https://github.com/arminc/clair-scanner/releases'
       end
@@ -100,6 +108,26 @@ module Examine
       def ensure_docker_installed!
         raise 'docker was not detected on the system' unless executable_exists?('docker')
       end
+
+      def clair_db_running?
+        'docker ps --filter="name=clair-db" --filter="status=running" --filter="expose=5432/tcp" | grep -v CONT'
+      end
+
+      def clair_db
+        'docker run -d --name clair-db arminc/clair-db:latest'
+      end
+
+      def clair_local_scan(version)
+        "docker run --restart=unless-stopped -p 6060:6060 --link clair-db:postgres -d --name clair arminc/clair-local-scan:#{version}"
+      end
+
+      def clair_local_scan_running?
+        'docker ps --filter="name=clair" --filter="status=running" --filter="expose=6060/tcp" | grep -v CONT'
+      end
+
+      def clair_local_scan_api_reachable?(url = options[:url])
+        "curl -s #{url}/v1/namespaces > /dev/null"
+      end
     end
   end
 end

data/lib/examine/version.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Examine
-  VERSION = "0.1.1"
+  VERSION = '0.1.2'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: examine
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors:
 - mo
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-07-24 00:00:00.000000000 Z
+date: 2019-07-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: down
@@ -52,6 +52,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: bundler-audit
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.6'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.6'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -80,6 +94,34 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3.0'
+- !ruby/object:Gem::Dependency
+  name: rubocop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.52'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.52'
+- !ruby/object:Gem::Dependency
+  name: rubocop-rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.22'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.22'
 description: Examine your software.
 email:
 - mo@mokhan.ca
@@ -91,6 +133,7 @@ files:
 - ".gitignore"
 - ".gitlab-ci.yml"
 - ".rspec"
+- ".rubocop.yml"
 - Dockerfile
 - Gemfile
 - Gemfile.lock
@@ -98,7 +141,9 @@ files:
 - README.md
 - Rakefile
 - bin/console
+- bin/lint
 - bin/setup
+- bin/test
 - examine.gemspec
 - exe/examine
 - lib/examine.rb
@@ -106,7 +151,7 @@ files:
 - lib/examine/cli/application.rb
 - lib/examine/cli/clair.rb
 - lib/examine/version.rb
-homepage: https://www.mokhan.ca/
+homepage: https://gitlab.com/xlgmokha/examine/
 licenses:
 - MIT
 metadata: {}