diff --git a/restore.yml b/restore.yml index 7fecc7e..dfe14f5 100644 --- a/restore.yml +++ b/restore.yml @@ -7,7 +7,7 @@ parameters: steps: - ${{if parameters.nuGetServiceConnections}}: - - task: NuGetAuthenticate@0 + - task: NuGetAuthenticate@1 inputs: nuGetServiceConnections: ${{ parameters.nuGetServiceConnections }} diff --git a/scanBinaries.yml b/scanBinaries.yml index 7aad6fb..6e343cc 100644 --- a/scanBinaries.yml +++ b/scanBinaries.yml @@ -21,29 +21,7 @@ jobs: destinationFolder: $(System.DefaultWorkingDirectory)/Binaries cleanDestinationFolder: true overwriteExistingFiles: false - - script: | - retries=10 - count=0 - while [ $count -lt $retries ]; do - log_output=$(docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v /tmp:/tmp -v $(System.DefaultWorkingDirectory)/Binaries:/src aquasec/trivy:latest --exit-code 1 --format table --scanners vuln,misconfig,secret filesystem /src 2>&1) - result=$? - echo "$log_output" - if echo "$log_output" | grep -q "Fatal error init error: DB error: failed to download vulnerability DB: database download error"; then - count=$((count + 1)) - echo "Scan failed due to DB download error. Attempt $count/$retries. Retrying in 30 seconds..." - sleep 30 - else - if [ $result -eq 0 ]; then - echo "Scan completed successfully." - break - else - echo "Scan failed due to other errors." - exit 1 - fi - fi - done - if [ $count -eq $retries ]; then - echo "Scan failed after $retries attempts due to DB download error." - exit 1 - fi - displayName: Scan compiled code with Trivy \ No newline at end of file + - script: | + ./scan_with_retries.sh "docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v /tmp:/tmp -v $(System.DefaultWorkingDirectory)/Binaries:/src aquasec/trivy:latest --exit-code 1 --format table --scanners vuln,misconfig,secret filesystem /src" + displayName: Scan compiled code with Trivy + diff --git a/scanCompiledArtifacts.yml b/scanCompiledArtifacts.yml index b2cc12f..1ffc5b0 100644 --- a/scanCompiledArtifacts.yml +++ b/scanCompiledArtifacts.yml @@ -8,30 +8,6 @@ parameters: displayName: 'The directory to scan for vulnerabilities' steps: -- script: | - retries=10 - count=0 - while [ $count -lt $retries ]; do - log_output=$(docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v /tmp:/tmp -v ${{ parameters.directory }}:/src aquasec/trivy:latest --exit-code 1 --format table --scanners vuln,misconfig,secret filesystem /src 2>&1) - result=$? - echo "$log_output" - if echo "$log_output" | grep -q "Fatal error init error: DB error: failed to download vulnerability DB: database download error"; then - count=$((count + 1)) - echo "Scan failed due to DB download error. Attempt $count/$retries. Retrying in 30 seconds..." - sleep 30 - else - if [ $result -eq 0 ]; then - echo "Scan completed successfully." - break - else - echo "Scan failed due to other errors." - exit 1 - fi - fi - done - if [ $count -eq $retries ]; then - echo "Scan failed after $retries attempts due to DB download error." - exit 1 - fi - - displayName: Scan compiled code with Trivy \ No newline at end of file + - script: | + ./scan_with_retries.sh "docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v /tmp:/tmp -v ${{ parameters.directory }}:/src aquasec/trivy:latest --exit-code 1 --format table --scanners vuln,misconfig,secret filesystem /src" + displayName: Scan compiled code with Trivy \ No newline at end of file diff --git a/scanDockerImage.yml b/scanDockerImage.yml index 5079107..5d17037 100644 --- a/scanDockerImage.yml +++ b/scanDockerImage.yml @@ -30,40 +30,15 @@ jobs: inputs: command: login containerRegistry: ${{ parameters.dockerRegistryConnection }} - - task: Docker@0 + - task: Bash@3 displayName: 'Pull Docker image from private registry' inputs: - containerregistrytype: 'Container Registry' - dockerRegistryConnection: ${{ parameters.dockerRegistryConnection }} - action: 'Run a Docker command' - customCommand: 'pull ${{ parameters.dockerRegistryName }}/${{ parameters.dockerImageRepoName }}:${{ parameters.dockerImageRepoVersion }}' + targetType: inline + script: | + docker pull ${{ parameters.dockerRegistryName }}/${{ parameters.dockerImageRepoName }}:${{ parameters.dockerImageRepoVersion }} - - script: | - retries=10 - count=0 - while [ $count -lt $retries ]; do - log_output=$(docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v ${{ parameters.trivyIgnoreFile }}:/tmp/trivyignore aquasec/trivy:latest image --ignorefile /tmp/trivyignore --exit-code 1 --format table --scanners vuln,misconfig,secret ${{ parameters.dockerRegistryName }}/${{ parameters.dockerImageRepoName }}:${{ parameters.dockerImageRepoVersion }} 2>&1) - result=$? - echo "$log_output" - if echo "$log_output" | grep -q "Fatal error init error: DB error: failed to download vulnerability DB: database download error"; then - count=$((count + 1)) - echo "Scan failed due to DB download error. Attempt $count/$retries. Retrying in 30 seconds..." - sleep 30 - else - if [ $result -eq 0 ]; then - echo "Scan completed successfully." - break - else - echo "Scan failed due to other errors." - exit 1 - fi - fi - done - if [ $count -eq $retries ]; then - echo "Scan failed after $retries attempts due to DB download error." - exit 1 - fi - + - script: | + ./scan_with_retries.sh "docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -v ${{ parameters.trivyIgnoreFile }}:/tmp/trivyignore aquasec/trivy:latest image --ignorefile /tmp/trivyignore --exit-code 1 --format table --scanners vuln,misconfig,secret ${{ parameters.dockerRegistryName }}/${{ parameters.dockerImageRepoName }}:${{ parameters.dockerImageRepoVersion }}" displayName: Scan image with Trivy # The Trivy task does not work yet. diff --git a/scan_with_retries.sh b/scan_with_retries.sh new file mode 100755 index 0000000..b3dd911 --- /dev/null +++ b/scan_with_retries.sh @@ -0,0 +1,31 @@ +#!/bin/bash + +command=$1 +retries=10 +count=0 + +echo "Scan command: $command" +echo "Starting scan with retries..." + +while [ $count -lt $retries ]; do + log_output=$($command 2>&1) + echo "$log_output" + if echo "$log_output" | grep "Fatal" | grep "failed to download artifact from any source" | grep -q "failed to download vulnerability DB"; then + count=$((count + 1)) + echo "Scan failed due to DB download error. Attempt $count/$retries. Retrying in 30 seconds..." + sleep 30 + else + if [ $? -eq 0 ]; then + echo "Scan completed successfully." + break + else + echo "Scan failed due to other errors." + exit 1 + fi + fi +done + +if [ $count -eq $retries ]; then + echo "Scan failed after $retries attempts due to DB download error." + exit 1 +fi \ No newline at end of file