From: Martin Skorupski <martin.skorupski@highstreet-technologies.com>
Date: Fri, 24 Mar 2023 12:40:36 +0000 (+0100)
Subject: Create script for SBOM and Vulnerabilities
X-Git-Url: https://gerrit.o-ran-sc.org/r/gitweb?a=commitdiff_plain;h=013453c7fdfa031eff560869cb9a64f9d89e0b5f;hp=e7d099ed2bdafd337c53a72fceecbd13ecac7a9a;p=oam.git

Create script for SBOM and Vulnerabilities
analysis of the solution docker images

- create own directory and
- sum output in 'out' directory

Issue-ID: OAM-318
Change-Id: I82d60c816cfcfa13a3b9facdb14ab3f7da218d7c
Signed-off-by: Martin Skorupski <martin.skorupski@highstreet-technologies.com>
---

diff --git a/code/container-analysis.sh b/code/container-analysis/container-analysis.sh
similarity index 66%
rename from code/container-analysis.sh
rename to code/container-analysis/container-analysis.sh
index 087675c..880d7a0 100755
--- a/code/container-analysis.sh
+++ b/code/container-analysis/container-analysis.sh
@@ -27,32 +27,35 @@
 
 SYFT=$(which syft)
 if [ -z "$SYFT" ]; then
-    echo "unable to find syft. please install."
+    echo "Unable to find syft. Please install."
     exit 1
 fi
 
 GRYPE=$(which grype)
 if [ -z "$GRYPE" ]; then
-    echo "unable to find grype. please install."
+    echo "Unable to find grype. Please install."
     exit 1
 fi
 
-excluded_images=(nexus3.onap.org:10001/onap/dmaap/dmaap-mr:1.1.18 nexus3.onap.org:10001/onap/dmaap/kafka111:1.0.4 nexus3.onap.org:10001/onap/dmaap/zookeeper:6.0.3 nexus3.onap.org:10001/onap/org.onap.dcaegen2.collectors.ves.vescollector:1.10.1)
+mkdir -p out
+
+excluded_images=()
 
 image_names=($(docker ps --format '{{.Image}}' | tr ' ' '\n' | sort -u | tr '\n' ' '))
 
+# avoid doublicates
 for ele in "${excluded_images[@]}"; do
-image_names=(${image_names[@]/*${ele}*/})
+ image_names=(${image_names[@]/*${ele}*/})
 done
 
 echo "Analysing following images: ${image_names[*]}"
 
 for image in "${image_names[@]}"; do
-image_name_no_repo="${image##*/}"
-echo "Creating SBOM for ${image} in ${image_name_no_repo}.sbom.spdx.json..."
-${SYFT} -q ${image} -o spdx-json --file ${image_name_no_repo}.sbom.spdx.json
-echo "Creating Vulnerabilities for ${image} in ${image_name_no_repo}.vulnerabilities.vex.json..."
-${GRYPE} -q ${image} -o embedded-cyclonedx-vex-json --file ${image_name_no_repo}.vulnerabilities.vex.json
+  image_name_no_repo="${image##*/}"
+  echo "Creating SBOM for ${image} in ${image_name_no_repo}.sbom.spdx.json..."
+  ${SYFT} -q ${image} -o spdx-json --file out/${image_name_no_repo}.sbom.spdx.json
+  echo "Creating Vulnerabilities for ${image} in ${image_name_no_repo}.vulnerabilities.vex.json..."
+  ${GRYPE} -q ${image} -o embedded-cyclonedx-vex-json --file out/${image_name_no_repo}.vulnerabilities.vex.json
 done
 
 echo "Done!"