|
| 1 | +from pathlib import Path |
| 2 | +from typing import Dict |
| 3 | + |
| 4 | +import luigi |
| 5 | + |
| 6 | +import tarfile |
| 7 | + |
| 8 | +from exasol_integration_test_docker_environment.lib.base.flavor_task import FlavorsBaseTask |
| 9 | +from exasol_integration_test_docker_environment.lib.config.build_config import build_config |
| 10 | +from exasol_integration_test_docker_environment.lib.docker import ContextDockerClient |
| 11 | + |
| 12 | +from exasol_script_languages_container_tool.lib.tasks.build.docker_flavor_build_base import DockerFlavorBuildBase |
| 13 | + |
| 14 | +from exasol_script_languages_container_tool.lib.tasks.security_scan.security_scan_parameter import SecurityScanParameter |
| 15 | + |
| 16 | +from docker.models.containers import Container |
| 17 | + |
| 18 | + |
| 19 | +class ScanResult: |
| 20 | + def __init__(self, is_ok: bool, summary: str, report_dir: Path): |
| 21 | + self.is_ok = is_ok |
| 22 | + self.summary = summary |
| 23 | + self.report_dir = report_dir |
| 24 | + |
| 25 | + |
| 26 | +class SecurityScan(FlavorsBaseTask, SecurityScanParameter): |
| 27 | + |
| 28 | + def __init__(self, *args, **kwargs): |
| 29 | + self.security_scanner_futures = None |
| 30 | + super().__init__(*args, **kwargs) |
| 31 | + report_path = self.report_path.joinpath("security_report") |
| 32 | + self.security_report_target = luigi.LocalTarget(str(report_path)) |
| 33 | + |
| 34 | + def register_required(self): |
| 35 | + tasks = self.create_tasks_for_flavors_with_common_params( |
| 36 | + SecurityScanner, report_path=self.report_path) # type: Dict[str,SecurityScanner] |
| 37 | + self.security_scanner_futures = self.register_dependencies(tasks) |
| 38 | + |
| 39 | + def run_task(self): |
| 40 | + security_scanner_results = self.get_values_from_futures( |
| 41 | + self.security_scanner_futures) |
| 42 | + |
| 43 | + self.write_report(security_scanner_results) |
| 44 | + all_result = AllScanResult(security_scanner_results) |
| 45 | + if not all_result.scans_are_ok: |
| 46 | + raise RuntimeError(f"Not all security scans were successful.:\n{all_result.get_error_scans_msg()}") |
| 47 | + |
| 48 | + def write_report(self, security_scanner: Dict[str, ScanResult]): |
| 49 | + with self.security_report_target.open("w") as out_file: |
| 50 | + |
| 51 | + for key, value in security_scanner.items(): |
| 52 | + out_file.write("\n") |
| 53 | + out_file.write(f"============ START SECURITY SCAN REPORT - <{key}> ====================") |
| 54 | + out_file.write("\n") |
| 55 | + out_file.write(f"Successful:{value.is_ok}\n") |
| 56 | + out_file.write(f"Full report:{value.report_dir}\n") |
| 57 | + out_file.write(f"Summary:\n") |
| 58 | + out_file.write(value.summary) |
| 59 | + out_file.write("\n") |
| 60 | + out_file.write(f"============ END SECURITY SCAN REPORT - <{key}> ====================") |
| 61 | + out_file.write("\n") |
| 62 | + |
| 63 | + |
| 64 | +class SecurityScanner(DockerFlavorBuildBase, SecurityScanParameter): |
| 65 | + |
| 66 | + def get_goals(self): |
| 67 | + return {"security_scan"} |
| 68 | + |
| 69 | + def get_release_task(self): |
| 70 | + return self.create_build_tasks(not build_config().force_rebuild) |
| 71 | + |
| 72 | + def run_task(self): |
| 73 | + tasks = self.get_release_task() |
| 74 | + |
| 75 | + tasks_futures = yield from self.run_dependencies(tasks) |
| 76 | + task_results = self.get_values_from_futures(tasks_futures) |
| 77 | + flavor_path = Path(self.flavor_path) |
| 78 | + report_path = self.report_path.joinpath(flavor_path.name) |
| 79 | + report_path.mkdir(parents=True, exist_ok=True) |
| 80 | + report_path_abs = report_path.absolute() |
| 81 | + result = ScanResult(is_ok=False, summary="", report_dir=report_path_abs) |
| 82 | + assert len(task_results.values()) == 1 |
| 83 | + for task_result in task_results.values(): |
| 84 | + self.logger.info(f"Running security run on image: {task_result.get_target_complete_name()}, report path: " |
| 85 | + f"{report_path_abs}") |
| 86 | + |
| 87 | + report_local_path = "/report" |
| 88 | + with ContextDockerClient() as docker_client: |
| 89 | + result_container = docker_client.containers.run(task_result.get_target_complete_name(), |
| 90 | + command=report_local_path, |
| 91 | + detach=True, stderr=True) |
| 92 | + try: |
| 93 | + logs = result_container.logs(follow=True).decode("UTF-8") |
| 94 | + result_container_result = result_container.wait() |
| 95 | + #We don't use mount binding here to exchange the report files, but download them from the container |
| 96 | + #Thus we avoid that the files are created by root |
| 97 | + self._write_report(result_container, report_path_abs, report_local_path) |
| 98 | + result = ScanResult(is_ok=(result_container_result["StatusCode"] == 0), |
| 99 | + summary=logs, report_dir=report_path_abs) |
| 100 | + finally: |
| 101 | + result_container.remove() |
| 102 | + |
| 103 | + self.return_object(result) |
| 104 | + |
| 105 | + def _write_report(self, container: Container, report_path_abs: Path, report_local_path: str): |
| 106 | + tar_file_path = report_path_abs / 'report.tar' |
| 107 | + with open(tar_file_path, 'wb') as tar_file: |
| 108 | + bits, stat = container.get_archive(report_local_path) |
| 109 | + for chunk in bits: |
| 110 | + tar_file.write(chunk) |
| 111 | + with tarfile.open(tar_file_path) as tar_file: |
| 112 | + tar_file.extractall(path=report_path_abs) |
| 113 | + |
| 114 | + |
| 115 | +class AllScanResult: |
| 116 | + def __init__(self, scan_results_per_flavor: Dict[str, ScanResult]): |
| 117 | + self.scan_results_per_flavor = scan_results_per_flavor |
| 118 | + self.scans_are_ok = all(scan_result.is_ok |
| 119 | + for scan_result |
| 120 | + in scan_results_per_flavor.values()) |
| 121 | + |
| 122 | + def get_error_scans_msg(self): |
| 123 | + return [f"{key}: '{value.summary}'" for key, value in self.scan_results_per_flavor.items() if not value.is_ok] |
0 commit comments