quayio-scanner 0.2.1 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 668671ffe57f1e5b1f27d5d6f6ace098e89f5aeb3dc5999d0f091c8f9fa05bb3
-  data.tar.gz: 5dd2530e763c2807b2dc36355b4787d201512e3d899924232768cd91653ba3bf
+  metadata.gz: 1eacf83494b11fb31f062ba8e916628d2477ba13ec76cc83ef8f98091c2b0313
+  data.tar.gz: 3bdf57c972fa6e1aa5e500cc3e887e7f4ea33498644dcd7b8a90ed0e93d9d24a
 SHA512:
-  metadata.gz: b55a1e1ad424c964f8a29540317dc6f8107e2dcc5f1b7724a45df76f5a40e87fb6405d0d273f58ea3eec3dd0afe29904dfeb3ef77a65950bc6614bb444389f59
-  data.tar.gz: 920b574586ed4ac4428076a8593aca5914cefbeb6c7909472517905830e01319a4dca816f9038c12c6bb1a6cfbe926dc1f4d1df8631cba34058a81b9f7d46f1f
+  metadata.gz: b7ffabd2e0523bce627fd779519c25828546e6591c6cbdbbc536ffcd783b1898f3c88eab366d84bca14b1ed6b51f62cafd258bad6ab83e1cc5364db22c92c5b5
+  data.tar.gz: 4dc30215d24326a4494cc06edd31cfb226682060c819d1d972c5bf114e569ca9978871072ab20382bdc7126d84050e027dd2c2bbe9b8e538546fc2d3b5a36484

data/.gitignore

@@ -1,6 +1,5 @@
 /.bundle/
 /.yardoc
-/Gemfile.lock
 /_yardoc/
 /coverage/
 /doc/

data/.rubocop.yml

@@ -1,3 +1,6 @@
+AllCops:
+  TargetRubyVersion: 2.3
+
 Style/FrozenStringLiteralComment:
   Enabled: false
 

data/.ruby-version

@@ -0,0 +1 @@
+2.7.0

data/Gemfile.lock

@@ -0,0 +1,86 @@
+PATH
+  remote: .
+  specs:
+    quayio-scanner (0.3.0)
+      docker-api (~> 1.33)
+      rest-client (~> 2.1)
+      sensu-plugin (~> 4.0)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    ast (2.4.2)
+    diff-lcs (1.5.0)
+    docker-api (1.34.2)
+      excon (>= 0.47.0)
+      multi_json
+    domain_name (0.5.20190701)
+      unf (>= 0.0.5, < 1.0.0)
+    excon (0.92.1)
+    http-accept (1.7.0)
+    http-cookie (1.0.4)
+      domain_name (~> 0.5)
+    json (2.6.1)
+    mime-types (3.4.1)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2022.0105)
+    mixlib-cli (1.7.0)
+    multi_json (1.15.0)
+    netrc (0.11.0)
+    parallel (1.22.1)
+    parser (3.1.1.0)
+      ast (~> 2.4.1)
+    rainbow (3.1.1)
+    rake (10.5.0)
+    regexp_parser (2.2.1)
+    rest-client (2.1.0)
+      http-accept (>= 1.7.0, < 2.0)
+      http-cookie (>= 1.0.2, < 2.0)
+      mime-types (>= 1.16, < 4.0)
+      netrc (~> 0.8)
+    rexml (3.2.5)
+    rspec (3.11.0)
+      rspec-core (~> 3.11.0)
+      rspec-expectations (~> 3.11.0)
+      rspec-mocks (~> 3.11.0)
+    rspec-core (3.11.0)
+      rspec-support (~> 3.11.0)
+    rspec-expectations (3.11.0)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.11.0)
+    rspec-mocks (3.11.0)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.11.0)
+    rspec-support (3.11.0)
+    rubocop (0.93.1)
+      parallel (~> 1.10)
+      parser (>= 2.7.1.5)
+      rainbow (>= 2.2.2, < 4.0)
+      regexp_parser (>= 1.8)
+      rexml
+      rubocop-ast (>= 0.6.0)
+      ruby-progressbar (~> 1.7)
+      unicode-display_width (>= 1.4.0, < 2.0)
+    rubocop-ast (1.16.0)
+      parser (>= 3.1.1.0)
+    ruby-progressbar (1.11.0)
+    sensu-plugin (4.0.0)
+      json (< 3.0.0)
+      mixlib-cli (~> 1.5)
+    unf (0.1.4)
+      unf_ext
+    unf_ext (0.0.8.1)
+    unicode-display_width (1.8.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  bundler (~> 2.1)
+  quayio-scanner!
+  rake (~> 10.0)
+  rspec (~> 3.7)
+  rubocop (~> 0.49)
+
+BUNDLED WITH
+   2.2.23

data/README.md

@@ -26,3 +26,7 @@ Bug reports and pull requests are welcome on GitHub at https://github.com/abouts
 ## License
 
 The gem is available as open source under the terms of the [MIT License](http://opensource.org/licenses/MIT).
+
+## Security
+
+* [Snyk](https://app.snyk.io/org/about-source/project/6eb2d381-87e7-49c4-a47f-ccad97f33ae3)

data/lib/quayio/scanner/image.rb

@@ -2,7 +2,7 @@ module Quayio
   module Scanner
     class Image
       RELEVANT_SEVERITIES = %w[High Critical].freeze
-      QUAY_IO_REPO_NAME = %r{quay.io\/(?<org>[\w-]+)\/(?<repo>[\w-]+):(?<tag>[\w\.-]+)}.freeze
+      QUAY_IO_REPO_NAME = %r{quay.io\/(?<org>[\w-]+)\/(?<repo>[\w-]+):(?<tag>[\w.-]+)}.freeze
 
       attr_reader :name, :whitelist, :repository
 

data/lib/quayio/scanner/repository.rb

@@ -6,19 +6,19 @@ module Quayio
     Repository = Struct.new(:quayio_token, :org, :repo, :tag) do
       MAX_ATTEMPTS = 5
 
-      def id
-        @id ||= fetch_id
-      end
-
       def scan
-        api_call("/image/#{id}/security?vulnerabilities=true")
+        api_call("/manifest/#{manifest_ref}/security?vulnerabilities=true")
       end
 
       private
 
-      def fetch_id
-        result = api_call("/tag/#{tag}/images")
-        (result['images'].first)['id']
+      def manifest_ref
+        @manifest_ref ||= fetch_manifest_ref
+      end
+
+      def fetch_manifest_ref
+        result = api_call("/tag/?specificTag=#{tag}&onlyActiveTags=1")
+        (result['tags'].first)['manifest_digest']
       end
 
       def api_call(uri)

data/lib/quayio/scanner/version.rb

@@ -1,5 +1,5 @@
 module Quayio
   module Scanner
-    VERSION = '0.2.1'.freeze
+    VERSION = '0.3.0'.freeze
   end
 end

data/quayio-scanner.gemspec

@@ -12,7 +12,7 @@ Gem::Specification.new do |spec|
   spec.homepage      = 'https://github.com/aboutsource/quayio-scanner'
   spec.license       = 'MIT'
 
-  spec.required_ruby_version = '>= 2.4.0'
+  spec.required_ruby_version = '>= 2.3.0'
 
   spec.files = `git ls-files -z`.split("\x0").reject do |f|
     f.match(%r{^(test|spec|features)/})
@@ -21,9 +21,9 @@ Gem::Specification.new do |spec|
   spec.require_paths = ['lib']
 
   spec.add_dependency 'docker-api', '~> 1.33'
-  spec.add_dependency 'rest-client', '~> 2.0'
-  spec.add_dependency 'sensu-plugin', '~> 2.1'
-  spec.add_development_dependency 'bundler'
+  spec.add_dependency 'rest-client', '~> 2.1'
+  spec.add_dependency 'sensu-plugin', '~> 4.0'
+  spec.add_development_dependency 'bundler', '~> 2.1'
   spec.add_development_dependency 'rake', '~> 10.0'
   spec.add_development_dependency 'rspec', '~> 3.7'
   spec.add_development_dependency 'rubocop', '~> 0.49'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: quayio-scanner
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.0
 platform: ruby
 authors:
 - Benjamin Meichsner
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-10-27 00:00:00.000000000 Z
+date: 2022-03-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: docker-api
@@ -30,42 +30,42 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.1'
 - !ruby/object:Gem::Dependency
   name: sensu-plugin
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.1'
+        version: '4.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.1'
+        version: '4.0'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '2.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '2.1'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -108,7 +108,7 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.49'
-description:
+description: 
 email:
 - benjamin.meichsner@aboutsource.net
 executables:
@@ -118,7 +118,9 @@ extra_rdoc_files: []
 files:
 - ".gitignore"
 - ".rubocop.yml"
+- ".ruby-version"
 - Gemfile
+- Gemfile.lock
 - LICENSE.txt
 - README.md
 - Rakefile
@@ -133,7 +135,7 @@ homepage: https://github.com/aboutsource/quayio-scanner
 licenses:
 - MIT
 metadata: {}
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -141,15 +143,15 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.4.0
+      version: 2.3.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.4
-signing_key:
+rubygems_version: 3.1.2
+signing_key: 
 specification_version: 4
 summary: Scan quay.io for vulnerabilties in running docker containers.
 test_files: []