mirror of
https://github.com/project-zot/zot.git
synced 2025-01-06 22:40:28 -05:00
bcdd9988f5
1. Only scan CVEs for images returned by graphql calls Since pagination was refactored to account for image indexes, we had started to run the CVE scanner before pagination was applied, resulting in decreased ZOT performance if CVE information was requested 2. Increase in medory-cache of cve results to 1m, from 10k digests. 3. Update CVE model to use CVSS severity values in our code. Previously we relied upon the strings returned by trivy directly, and the sorting they implemented. Since CVE severities are standardized, we don't need to pass around an adapter object just for pagination and sorting purposes anymore. This also improves our testing since we don't mock the sorting functions anymore. 4. Fix a flaky CLI test not waiting for the zot service to start. 5. Add the search build label on search/cve tests which were missing it. 6. The boltdb update method was used in a few places where view was supposed to be called. 7. Add logs for start and finish of parsing MetaDB. 8. Avoid unmarshalling twice to obtain annotations for multiarch images. Signed-off-by: Andrei Aaron <aaaron@luxoft.com>
93 lines
2 KiB
Go
93 lines
2 KiB
Go
package model
|
|
|
|
import (
|
|
"time"
|
|
|
|
godigest "github.com/opencontainers/go-digest"
|
|
)
|
|
|
|
type ImageCVESummary struct {
|
|
Count int
|
|
MaxSeverity string
|
|
}
|
|
|
|
//nolint:tagliatelle // graphQL schema
|
|
type CVE struct {
|
|
ID string `json:"Id"`
|
|
Description string `json:"Description"`
|
|
Severity string `json:"Severity"`
|
|
Title string `json:"Title"`
|
|
PackageList []Package `json:"PackageList"`
|
|
}
|
|
|
|
//nolint:tagliatelle // graphQL schema
|
|
type Package struct {
|
|
Name string `json:"Name"`
|
|
InstalledVersion string `json:"InstalledVersion"`
|
|
FixedVersion string `json:"FixedVersion"`
|
|
}
|
|
|
|
const (
|
|
unScanned = iota
|
|
none
|
|
unknown
|
|
low
|
|
medium
|
|
high
|
|
critical
|
|
)
|
|
|
|
// Values from https://www.first.org/cvss/v3.0/specification-document
|
|
const (
|
|
SeverityNotScanned = "" // scanning was not done or was not complete
|
|
SeverityNone = "NONE" // no vulnerabilities were detected at all
|
|
SeverityUnknown = "UNKNOWN" // coresponds to CVSS 3 score NONE
|
|
SeverityLow = "LOW" // coresponds to CVSS 3 score LOW
|
|
SeverityMedium = "MEDIUM" // coresponds to CVSS 3 score MEDIUM
|
|
SeverityHigh = "HIGH" // coresponds to CVSS 3 score HIGH
|
|
SeverityCritical = "CRITICAL" // coresponds to CVSS 3 score CRITICAL
|
|
)
|
|
|
|
func severityInt(severity string) int {
|
|
sevMap := map[string]int{
|
|
SeverityNotScanned: unScanned,
|
|
SeverityNone: none,
|
|
SeverityUnknown: unknown,
|
|
SeverityLow: low,
|
|
SeverityMedium: medium,
|
|
SeverityHigh: high,
|
|
SeverityCritical: critical,
|
|
}
|
|
|
|
severityInt, ok := sevMap[severity]
|
|
|
|
if !ok {
|
|
// In the unlikely case the key is not in the map we
|
|
// return the unknown severity level
|
|
return unknown
|
|
}
|
|
|
|
return severityInt
|
|
}
|
|
|
|
func CompareSeverities(sev1, sev2 string) int {
|
|
return severityInt(sev2) - severityInt(sev1)
|
|
}
|
|
|
|
type Descriptor struct {
|
|
Digest godigest.Digest
|
|
MediaType string
|
|
}
|
|
|
|
type DescriptorInfo struct {
|
|
Descriptor
|
|
|
|
Timestamp time.Time
|
|
}
|
|
|
|
type TagInfo struct {
|
|
Tag string
|
|
Descriptor Descriptor
|
|
Manifests []DescriptorInfo
|
|
Timestamp time.Time
|
|
}
|