zot/test/images

Build scripts for images used in tests

General instructions

This folder contains build files used to produce oci images used in zot tests. Build them using stacker, and copy them over to ghrc.io using skopeo.

For example in case of the java image:

stacker build -f stacker-java.yaml

Check the image is scanned correctly using a trivy binary, in order to make sure it does or does not contain expected vulnerabilities, in case the image is to be used for CVE scanning.

trivy image scan --input oci:java-test

Copy the new image over to ghcr.io using skopeo

skopeo copy --dest-creds=<user>:<token> oci:oci:java-test docker://ghcr.io/project-zot/test-images/java:0.0.1

Images

Java

The file stacker-java.yaml is used to produce the images in the repo at: ghcr.io/project-zot/test-images/java Basically we compile a simple java file and without any vulnerabilities. We can test the CVE scanning of Java images, including zot downloading the Java vulnerability DB.

Spring

The file stacker-spring.yaml is used to produce the images in the repo at: ghcr.io/project-zot/test-images/spring-web We just copy and download the already compiled spring jar file. It can be scanned to identify at least one Java specific vulnerability in zot tests.