secureCodeBox / secureCodeBox/secureCodeBox

[Consistency/Scanners] SCB scanners use different versioning system

Open
#716 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

maintenance scanner
Dominant language
Go
Stars
988
Forks
184
Avg merge
1d 23h
Merged PRs (30d)
42

Description

Working on the consistency of all scanner files, it was noticed that our own scanners (SCB scanners), that is test-scan, git-repo-scanner and zap-advanced, use a different versioning scheme which is linked to the scb releases. This leads to an inconsistent and potentially confusing use of Chart.Version vs. Chart.AppVersion in the scan-type.yaml file:

Git-Repo-Scanner (SCB) - Chart.Version (linked to SCB release):

 - name: git-repo-scanner
       image: "{{ .Values.scanner.image.repository }}:{{ .Values.scanner.image.tag | default .Chart.Version }}"

Nmap (Extern) - Chart.AppVersion (linked to current nmap release):

  - name: nmap
        image: "{{ .Values.scanner.image.repository }}:{{ .Values.scanner.image.tag | default .Chart.AppVersion }}"

Although this is a minor issue, it should probably kept in mind when new internally maintained scanners are added to the SCB.

Also affects scanner.image.tag in values.yaml.

The following scanners are affected:

  • git-repo-scanner
  • screenshooter
  • test-scan
  • zap-advanced

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the affected scanner chart files, especially scan-type.yaml and values.yaml, and compare how Chart.Version, Chart.AppVersion, and scanner.image.tag are used for zap-advanced and the other listed SCB scanners. Confirm the intended versioning convention with the project maintainers, then update the affected references consistently and verify the rendered scanner image tags.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes
Domain
devops, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.