feat: support docker hardened images

Author: parker-snyk

package-lock.json

@@ -117,7 +117,7 @@
     "semver": "^6.0.0",
     "snyk-config": "^5.0.0",
     "snyk-cpp-plugin": "2.24.1",
-    "snyk-docker-plugin": "8.10.2",
+    "snyk-docker-plugin": "8.12.0",
     "snyk-go-plugin": "1.23.0",
     "snyk-gradle-plugin": "5.1.0",
     "snyk-module": "3.1.0",

package.json

@@ -17,6 +17,7 @@ import { CocoapodsTests } from './cli-test/cli-test.cocoapods.spec';
 import { SwiftTests } from './cli-test/cli-test.swift.spec';
 import { ComposerTests } from './cli-test/cli-test.composer.spec';
 import { DockerTests } from './cli-test/cli-test.docker.spec';
+import { DockerDHITests } from './cli-test/cli-test.docker-dhi.spec';
 import { GoTests } from './cli-test/cli-test.go.spec';
 import { GradleTests } from './cli-test/cli-test.gradle.spec';
 import { MavenTests } from './cli-test/cli-test.maven.spec';
@@ -34,6 +35,7 @@ const languageTests: AcceptanceTests[] = [
   CocoapodsTests,
   ComposerTests,
   DockerTests,
+  DockerDHITests,
   GoTests,
   GradleTests,
   MavenTests,

test/tap/cli-test.acceptance.test.ts

@@ -0,0 +1,155 @@
+import { AcceptanceTests } from '../cli-test.acceptance.test';
+
+export const DockerDHITests: AcceptanceTests = {
+  language: 'Docker',
+  tests: {
+    '`test foo:latest --docker` with mixed DHI and non-DHI packages':
+      (params) => async (t) => {
+        const spyPlugin = stubDockerPluginResponse(
+          params.ecoSystemPlugins,
+          {
+            scanResults: [
+              {
+                facts: [
+                  {
+                    type: 'depGraph',
+                    data: {
+                      schemaVersion: '1.2.0',
+                      pkgManager: {
+                        name: 'deb',
+                        repositories: [{ alias: 'debian:12' }],
+                      },
+                      pkgs: [
+                        {
+                          id: 'docker-image|foo@latest',
+                          info: {
+                            name: 'docker-image|foo',
+                            version: 'latest',
+                          },
+                        },
+                        {
+                          id: '[email protected]+deb12u8',
+                          info: {
+                            name: 'curl',
+                            version: '7.88.1-10+deb12u8',
+                            purl: 'pkg:deb/dhi/[email protected]%2Bdeb12u8?distro=debian-bookworm',
+                          },
+                        },
+                        {
+                          id: '[email protected]+deb12u5',
+                          info: {
+                            name: 'base-files',
+                            version: '12.4+deb12u5',
+                            purl: 'pkg:deb/debian/[email protected]%2Bdeb12u5?distro=debian-bookworm',
+                          },
+                        },
+                      ],
+                      graph: {
+                        rootNodeId: 'root-node',
+                        nodes: [
+                          {
+                            nodeId: 'root-node',
+                            pkgId: 'docker-image|foo@latest',
+                            deps: [
+                              { nodeId: '[email protected]+deb12u8' },
+                              { nodeId: '[email protected]+deb12u5' },
+                            ],
+                          },
+                          {
+                            nodeId: '[email protected]+deb12u8',
+                            pkgId: '[email protected]+deb12u8',
+                            deps: [],
+                          },
+                          {
+                            nodeId: '[email protected]+deb12u5',
+                            pkgId: '[email protected]+deb12u5',
+                            deps: [],
+                          },
+                        ],
+                      },
+                    },
+                  },
+                  { type: 'dockerfileAnalysis', data: {} },
+                ],
+                identity: {
+                  type: 'deb',
+                },
+                target: {
+                  image: 'docker-image|foo',
+                },
+              },
+            ],
+          },
+          t,
+        );
+
+        await params.cli.test('foo:latest', {
+          docker: true,
+          org: 'explicit-org',
+        });
+
+        const req = params.server.popRequest();
+        t.equal(req.method, 'POST', 'makes POST request');
+        t.match(req.url, '/test-dependencies', 'posts to correct url');
+
+        const depGraphData = req.body.scanResult.facts.find(
+          (fact) => fact.type === 'depGraph',
+        )?.data;
+        t.ok(depGraphData, 'depGraph fact exists');
+
+        const curlPkg = depGraphData.pkgs.find(
+          (pkg) => pkg.id === '[email protected]+deb12u8',
+        );
+        t.ok(curlPkg, 'curl package exists in depGraph');
+        t.equal(
+          curlPkg?.info?.purl,
+          'pkg:deb/dhi/[email protected]%2Bdeb12u8?distro=debian-bookworm',
+          'DHI package has dhi namespace in PURL',
+        );
+
+        const baseFilesPkg = depGraphData.pkgs.find(
+          (pkg) => pkg.id === '[email protected]+deb12u5',
+        );
+        t.ok(baseFilesPkg, 'base-files package exists in depGraph');
+        t.equal(
+          baseFilesPkg?.info?.purl,
+          'pkg:deb/debian/[email protected]%2Bdeb12u5?distro=debian-bookworm',
+          'non-DHI package has debian namespace in PURL',
+        );
+
+        t.same(
+          spyPlugin.getCall(0).args,
+          [
+            {
+              docker: true,
+              org: 'explicit-org',
+              showVulnPaths: 'some',
+              maxVulnPaths: undefined,
+              'exclude-app-vulns': false,
+              path: 'foo:latest',
+              projectName: undefined,
+              packageManager: undefined,
+            },
+          ],
+          'calls docker plugin with expected arguments',
+        );
+      },
+  },
+};
+
+function stubDockerPluginResponse(plugins, fixture: string | object, t) {
+  const plugin = {
+    async scan() {
+      return typeof fixture === 'object' ? fixture : await import(fixture);
+    },
+    async display() {
+      return '';
+    },
+  };
+  const spyPlugin = require('sinon').spy(plugin, 'scan');
+  const loadPlugin = require('sinon').stub(plugins, 'getPlugin');
+  loadPlugin.withArgs(require('sinon').match.any).returns(plugin);
+  t.teardown(loadPlugin.restore);
+
+  return spyPlugin;
+}