secureCodeBox / secureCodeBox/secureCodeBox
[Consistency/Scanners] SCB scanners use different versioning system
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 988
- Forks
- 184
- Avg merge
- 1d 23h
- Merged PRs (30d)
- 42
Description
Working on the consistency of all scanner files, it was noticed that our own scanners (SCB scanners), that is test-scan, git-repo-scanner and zap-advanced, use a different versioning scheme which is linked to the scb releases. This leads to an inconsistent and potentially confusing use of Chart.Version vs. Chart.AppVersion in the scan-type.yaml file:
Git-Repo-Scanner (SCB) - Chart.Version (linked to SCB release):
- name: git-repo-scanner
image: "{{ .Values.scanner.image.repository }}:{{ .Values.scanner.image.tag | default .Chart.Version }}"
Nmap (Extern) - Chart.AppVersion (linked to current nmap release):
- name: nmap
image: "{{ .Values.scanner.image.repository }}:{{ .Values.scanner.image.tag | default .Chart.AppVersion }}"
Although this is a minor issue, it should probably kept in mind when new internally maintained scanners are added to the SCB.
Also affects scanner.image.tag in values.yaml.
The following scanners are affected:
- git-repo-scanner
- screenshooter
- test-scan
- zap-advanced
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the affected scanner chart files, especially scan-type.yaml and values.yaml, and compare how Chart.Version, Chart.AppVersion, and scanner.image.tag are used for zap-advanced and the other listed SCB scanners. Confirm the intended versioning convention with the project maintainers, then update the affected references consistently and verify the rendered scanner image tags.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- helm, kubernetes
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100