3 ################################################################################
4 # Copyright 2023 highstreet technologies GmbH
6 # Licensed under the Apache License, Version 2.0 (the 'License');
7 # you may not use this file except in compliance with the License.
8 # You may obtain a copy of the License at
10 # http://www.apache.org/licenses/LICENSE-2.0
12 # Unless required by applicable law or agreed to in writing, software
13 # distributed under the License is distributed on an 'AS IS' BASIS,
14 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15 # See the License for the specific language governing permissions and
16 # limitations under the License.
17 ################################################################################
19 # Excluded images is an array containing the name of the docker images we want to exclude from the analysis.
20 # Please modify it according to your needs.
23 # curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
26 # curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
29 if [ -z "$SYFT" ]; then
30 echo "unable to find syft. please install."
35 if [ -z "$GRYPE" ]; then
36 echo "unable to find grype. please install."
40 excluded_images=(nexus3.onap.org:10001/onap/dmaap/dmaap-mr:1.1.18 nexus3.onap.org:10001/onap/dmaap/kafka111:1.0.4 nexus3.onap.org:10001/onap/dmaap/zookeeper:6.0.3 nexus3.onap.org:10001/onap/org.onap.dcaegen2.collectors.ves.vescollector:1.10.1)
42 image_names=($(docker ps --format '{{.Image}}' | tr ' ' '\n' | sort -u | tr '\n' ' '))
44 for ele in "${excluded_images[@]}"; do
45 image_names=(${image_names[@]/*${ele}*/})
48 echo "Analysing following images: ${image_names[*]}"
50 for image in "${image_names[@]}"; do
51 image_name_no_repo="${image##*/}"
52 echo "Creating SBOM for ${image} in ${image_name_no_repo}.sbom.spdx.json..."
53 ${SYFT} -q ${image} -o spdx-json --file ${image_name_no_repo}.sbom.spdx.json
54 echo "Creating Vulnerabilities for ${image} in ${image_name_no_repo}.vulnerabilities.vex.json..."
55 ${GRYPE} -q ${image} -o embedded-cyclonedx-vex-json --file ${image_name_no_repo}.vulnerabilities.vex.json