jfrog / jfrog/jfrog-cli-security

Scan Dockerimage that was not build on artifactoy

Open
#443 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

question
Dominant language
Go
Stars
13
Forks
50
Avg merge
3d 48m
Merged PRs (30d)
26

Description

Hi,
I try to integrate XRay but I don't build my images on artifactory but on openshift.
After the build is complete it gets push to artifactory, but not as a stage in jenkins, but as part of the openshift build job.
When I tried to add the example code to my pipeline, I get the error "xray-test is not selected for indexing" what makes sense, because how would the XRay plugin know where the image was uploaded to?

do I have to add the image path to some env or can I add it to the scanConfig?

here is my JENKINSFILE

#!groovy
import java.util.regex.Pattern
 
def label = "docker-${UUID.randomUUID().toString()}"
 
pipeline {
    options {
        buildDiscarder(logRotator(numToKeepStr: '10', artifactNumToKeepStr: '10'))
    }
    agent {
        kubernetes {
            containerTemplate(
                name: "jnlp",
                image: "${PodTemplateImage}",
                resourceRequestCpu: "200m",
                resourceLimitCpu: "500m",
                resourceRequestMemory: "100Mi",
                resourceLimitMemory: "1500Mi",
                workingDir: "/tmp",
                command: "",
                envVars: [
                    envVar(key: 'HOME', value: '/home/jenkins'),
                ],
                args: '${computer.jnlpmac} ${computer.name}'
            )
        }
    }
    stages {
		// copied from doku
        stage('Setup') {
            steps {
                script {
                    rtServer = Artifactory.server 'repo01'
                    buildInfo = Artifactory.newBuildInfo()
                    rtDocker = Artifactory.docker server: rtServer
                    buildInfo.env.capture = true
                    scanConfig = [
                            'buildName'  : buildInfo.name,
                            'buildNumber': buildInfo.number,
                            'failBuild'  : true
                    ]
                }
            }
        }
        stage('Repo Checkout') {
            options { timeout (time: 5, unit:'MINUTES')}
            steps{
                script {
                    echo " ======================= Checkout Stage ================================"
                    checkout scm
                }
            }
        }
        stage('Openshift Build') {
            options { timeout (time: 180, unit:'MINUTES')}
            steps{
                script {
                    openshift.withCluster("${OpenshiftCluster}" , "${OpenshiftClientName}") {
                        openshift.withProject ("${OpenshiftProject}") {
                            dir("openshift-build/${AppBuildName}/") {
                                openshift.raw('apply -f .')
                                openshift.raw("start-build bc/${AppBuildName}")
                                bc = openshift.selector("bc","${AppBuildName}").related('builds')                               
                                //wait for the build to finish
                                bc.watch {
                                    if (it.count() == 0)
                                    {
                                        return false
                                    }
                                        echo "Detected new builds created by buildconfig: ${it.names()}"
                                        return true
                                }
                                bc.untilEach {
                                    return it.object().status.phase == "Complete"                
                                }
                            }
                        }
                    }
                }
            }
        }
        stage('Xray Scan') {
            steps {
                script {
                    echo " ======================= XRay Stage ================================"
                    buildInfo.env.collect()
                    rtServer.publishBuildInfo buildInfo
                    scanResult = rtServer.xrayScan scanConfig
                    print scanResult
                    print rtServer
                }
            }
        }
    }
}

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the Jenkinsfile's Setup and Xray Scan stages, especially scanConfig and the rtServer.xrayScan call, then review the referenced XRay pipeline example. Verify whether an image built by OpenShift and later pushed to Artifactory can be identified for scanning without the “not selected for indexing” error; done means the scan completes for that externally built image.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker
Domain
ci-cd, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.