quayio-scanner 0.3.1 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5c3eabc5c737c5a7e3e6c104f221de20f4dc1be4e91bb54241f308f5367b84c5
-  data.tar.gz: 457e6d878eb67842929377ffe54589efe832335275c4a0ef0ea5845ea9d68fd0
+  metadata.gz: de92233c0413236dfeb715ffc2bdf3b0355a7cd7a6cbf1bb8ba1507381b71ac5
+  data.tar.gz: 9903c847f82a53e14db535eaced022c774288e89b53ffaf765b3abfa4d40df11
 SHA512:
-  metadata.gz: a89b445dfb42e088056cfa4b07634eb7fab13b5d7a5d342a39188f660e8b7da7f521d04b76540c084f59b364b7af322ae3718d017c56c100a556e9baffa8231c
-  data.tar.gz: e459485a56218b2305bfe7294f2936fba44cb1d063ac0951060290a5c77e6ad8aaa341e2ffa1dd4e0dcab13583ff64cda96e861ccac0ed6f3be030fdb308e2e0
+  metadata.gz: 4c216489fe912aa1a7ec9e6fc504aa241c872b809502c47bdcb72565b8d3ab8dc33504072d5037ab43a06b9a5abf7564db28b7a3ffe7908f1230b2483cf8fefa
+  data.tar.gz: a9e5c35ed78d30da1ef5ea51881ae5ad42fec33af3a5d04cf44bf598fd74a8b45555d4cc367d4f710d97099298223ff69fe9d1670e104608f94fa83889271dd5

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    quayio-scanner (0.3.1)
+    quayio-scanner (0.3.2)
       docker-api (~> 1.33)
       rest-client (~> 2.1)
       sensu-plugin (~> 4.0)

data/bin/check-container-vulnerabilities.rb

@@ -44,10 +44,18 @@ class CheckContainerVulnerabilities < Sensu::Plugin::Check::CLI
          default: '',
          proc: proc { |w| w.split(',') }
 
+  option :ignore_namespace_names,
+         description: 'Namespace names to ignore',
+         short: '-n NAMESPACE_NAME[,NAMESPACE_NAME]',
+         long: '--ignore-namespace-names NAMESPACE_NAME[,NAMESPACE_NAME]',
+         default: '',
+         proc: proc { |w| w.split(',') }
+
   def run
     status, message = Quayio::Scanner::Check.new(config[:docker_url],
                                                  config[:quayio_token],
-                                                 config[:whitelist]).run
+                                                 config[:whitelist],
+                                                 config[:ignore_namespace_names]).run
 
     if status == :ok
       ok message

data/lib/quayio/scanner/check.rb

@@ -2,7 +2,7 @@ require 'docker'
 
 module Quayio
   module Scanner
-    Check = Struct.new(:docker_url, :quayio_token, :whitelist) do
+    Check = Struct.new(:docker_url, :quayio_token, :whitelist, :ignore_namespace_names) do
       def run
         Docker.url = docker_url
 
@@ -27,7 +27,7 @@ module Quayio
 
       def vulnerable_images
         containers
-          .map { |container| Image.new(container, quayio_token, whitelist) }
+          .map { |container| Image.new(container, quayio_token, whitelist, ignore_namespace_names) }
           .select(&:vulnerable?)
           .map(&:name)
       end

data/lib/quayio/scanner/image.rb

@@ -5,11 +5,12 @@ module Quayio
       QUAY_IO_REPO_NAME =
         %r{quay.io\/(?<org>[\w-]+)\/(?<repo>[\w-]+):(?<tag>[\w.-]+)}.freeze
 
-      attr_reader :name, :whitelist, :repository
+      attr_reader :name, :whitelist, :repository, :ignore_namespace_names
 
-      def initialize(name, quayio_token, whitelist)
+      def initialize(name, quayio_token, whitelist, ignore_namespace_names)
         @name = name
         @whitelist = whitelist
+        @ignore_namespace_names = ignore_namespace_names
 
         @name.match(QUAY_IO_REPO_NAME) do |r|
           org, repo, tag = r.captures
@@ -25,7 +26,7 @@ module Quayio
 
       def quayio?
         # safe guard, do not trust QUAY_IO_REPO_NAME regex match
-        name.match?(%r{^quay.io\/})
+        !name.match(%r{^quay.io\/}).nil?
       end
 
       def scanned?
@@ -35,8 +36,9 @@ module Quayio
       def vulnerabilities_present?
         !raw_scan['data']['Layer']['Features'].detect do |f|
           f['Vulnerabilities']&.detect do |v|
-            RELEVANT_SEVERITIES.include?(v['Severity']) &&\
-            !whitelist.include?(v['Name'])
+            RELEVANT_SEVERITIES.include?(v['Severity']) && \
+              !whitelist.include?(v['Name']) && \
+              !ignore_namespace_names.include?(v['NamespaceName'])
           end
         end.nil?
       end

data/lib/quayio/scanner/version.rb

@@ -1,5 +1,5 @@
 module Quayio
   module Scanner
-    VERSION = '0.3.1'.freeze
+    VERSION = '0.4.0'.freeze
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: quayio-scanner
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.4.0
 platform: ruby
 authors:
 - Benjamin Meichsner
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-05-31 00:00:00.000000000 Z
+date: 2023-02-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: docker-api
@@ -114,7 +114,7 @@ dependencies:
     - - "<="
       - !ruby/object:Gem::Version
         version: '0.81'
-description: 
+description:
 email:
 - benjamin.meichsner@aboutsource.net
 executables:
@@ -142,7 +142,7 @@ homepage: https://github.com/aboutsource/quayio-scanner
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -157,8 +157,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.2
-signing_key: 
+rubygems_version: 3.3.25
+signing_key:
 specification_version: 4
 summary: Scan quay.io for vulnerabilities in running docker containers.
 test_files: []