jfrog / jfrog/jfrog-cli-security
Scan Dockerimage that was not build on artifactoy
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Hi,
I try to integrate XRay but I don't build my images on artifactory but on openshift.
After the build is complete it gets push to artifactory, but not as a stage in jenkins, but as part of the openshift build job.
When I tried to add the example code to my pipeline, I get the error "xray-test is not selected for indexing" what makes sense, because how would the XRay plugin know where the image was uploaded to?
do I have to add the image path to some env or can I add it to the scanConfig?
here is my JENKINSFILE
#!groovy
import java.util.regex.Pattern
def label = "docker-${UUID.randomUUID().toString()}"
pipeline {
options {
buildDiscarder(logRotator(numToKeepStr: '10', artifactNumToKeepStr: '10'))
}
agent {
kubernetes {
containerTemplate(
name: "jnlp",
image: "${PodTemplateImage}",
resourceRequestCpu: "200m",
resourceLimitCpu: "500m",
resourceRequestMemory: "100Mi",
resourceLimitMemory: "1500Mi",
workingDir: "/tmp",
command: "",
envVars: [
envVar(key: 'HOME', value: '/home/jenkins'),
],
args: '${computer.jnlpmac} ${computer.name}'
)
}
}
stages {
// copied from doku
stage('Setup') {
steps {
script {
rtServer = Artifactory.server 'repo01'
buildInfo = Artifactory.newBuildInfo()
rtDocker = Artifactory.docker server: rtServer
buildInfo.env.capture = true
scanConfig = [
'buildName' : buildInfo.name,
'buildNumber': buildInfo.number,
'failBuild' : true
]
}
}
}
stage('Repo Checkout') {
options { timeout (time: 5, unit:'MINUTES')}
steps{
script {
echo " ======================= Checkout Stage ================================"
checkout scm
}
}
}
stage('Openshift Build') {
options { timeout (time: 180, unit:'MINUTES')}
steps{
script {
openshift.withCluster("${OpenshiftCluster}" , "${OpenshiftClientName}") {
openshift.withProject ("${OpenshiftProject}") {
dir("openshift-build/${AppBuildName}/") {
openshift.raw('apply -f .')
openshift.raw("start-build bc/${AppBuildName}")
bc = openshift.selector("bc","${AppBuildName}").related('builds')
//wait for the build to finish
bc.watch {
if (it.count() == 0)
{
return false
}
echo "Detected new builds created by buildconfig: ${it.names()}"
return true
}
bc.untilEach {
return it.object().status.phase == "Complete"
}
}
}
}
}
}
}
stage('Xray Scan') {
steps {
script {
echo " ======================= XRay Stage ================================"
buildInfo.env.collect()
rtServer.publishBuildInfo buildInfo
scanResult = rtServer.xrayScan scanConfig
print scanResult
print rtServer
}
}
}
}
}
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Jenkinsfile's Setup and Xray Scan stages, especially scanConfig and the rtServer.xrayScan call, then review the referenced XRay pipeline example. Verify whether an image built by OpenShift and later pushed to Artifactory can be identified for scanning without the “not selected for indexing” error; done means the scan completes for that externally built image.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker
- Domain
- ci-cd, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100