|
| 1 | +INSERT INTO plugin_metadata (id,name,description,type,icon,deleted,created_on,created_by,updated_on,updated_by) |
| 2 | +VALUES (nextval('id_seq_plugin_metadata'),'Copacetic v1.0.0','This plugin is used to patch the container image vulnerabilities (Patching for Multi Architecture Builds not supported currently).','PRESET','https://raw.githubusercontent.com/devtron-labs/devtron/main/assets/copa-plugin-icon.png',false,'now()',1,'now()',1); |
| 3 | + |
| 4 | +INSERT INTO "plugin_tag_relation" ("id", "tag_id", "plugin_id", "created_on", "created_by", "updated_on", "updated_by") VALUES (nextval('id_seq_plugin_tag_relation'), (SELECT id FROM plugin_tag WHERE name='Security'), (SELECT id FROM plugin_metadata WHERE name='Copacetic v1.0.0'),'now()', 1, 'now()', 1); |
| 5 | +INSERT INTO "plugin_tag_relation" ("id", "tag_id", "plugin_id", "created_on", "created_by", "updated_on", "updated_by") VALUES (nextval('id_seq_plugin_tag_relation'), (SELECT id FROM plugin_tag WHERE name='DevSecOps'), (SELECT id FROM plugin_metadata WHERE name='Copacetic v1.0.0'),'now()', 1, 'now()', 1); |
| 6 | + |
| 7 | +INSERT INTO plugin_stage_mapping (id,plugin_id,stage_type,created_on,created_by,updated_on,updated_by) |
| 8 | +VALUES (nextval('id_seq_plugin_stage_mapping'),(SELECT id from plugin_metadata where name='Copacetic v1.0.0'), 0,'now()',1,'now()',1); |
| 9 | + |
| 10 | +INSERT INTO "plugin_pipeline_script" ("id", "script","type","deleted","created_on", "created_by", "updated_on", "updated_by") |
| 11 | +VALUES ( |
| 12 | + nextval('id_seq_plugin_pipeline_script'), |
| 13 | + $$#!/bin/sh |
| 14 | + |
| 15 | +export appName=$(echo $CI_CD_EVENT | jq --raw-output .commonWorkflowRequest.appName) |
| 16 | +export registry=$(echo $CI_CD_EVENT | jq --raw-output .commonWorkflowRequest.dockerRegistryURL) |
| 17 | +export repo=$(echo $CI_CD_EVENT | jq --raw-output .commonWorkflowRequest.dockerRepository) |
| 18 | +export tag=$(echo $CI_CD_EVENT | jq --raw-output .commonWorkflowRequest.dockerImageTag) |
| 19 | +export platform=$(echo $CI_CD_EVENT | jq --raw-output .commonWorkflowRequest.ciBuildConfig.dockerBuildConfig.targetPlatform) |
| 20 | + |
| 21 | +if [[ $platform == "linux/arm64,linux/amd64" ]] ; then |
| 22 | + echo "platform = $platform" |
| 23 | + echo "------------------------------------------------------------------------------------------------------------------------" |
| 24 | + echo "######### Patching Multi Architecture Image not supported #########" |
| 25 | + echo "------------------------------------------------------------------------------------------------------------------------" |
| 26 | + echo "error: can't use copacetic plugin for muti-architecture builds" |
| 27 | + exit 1; |
| 28 | +else |
| 29 | + curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.46.1 |
| 30 | + |
| 31 | + uname_arch() { |
| 32 | + arch=$(uname -m) |
| 33 | + case $arch in |
| 34 | + x86_64) arch="amd64" ;; |
| 35 | + aarch64) arch="arm64" ;; |
| 36 | + esac |
| 37 | + echo ${arch} |
| 38 | + } |
| 39 | + os=$(uname | tr "[:upper:]" "[:lower:]") |
| 40 | + uname_arch |
| 41 | + wget https://github.com/project-copacetic/copacetic/releases/download/v0.5.1/copa_0.5.1_${os}_${arch}.tar.gz |
| 42 | + tar -xvzf copa_0.5.1_${os}_${arch}.tar.gz |
| 43 | + mv copa /usr/local/bin/ |
| 44 | + |
| 45 | + trivy image --vuln-type os --ignore-unfixed $registry/$repo:$tag | grep -i total |
| 46 | + trivy image --vuln-type os --ignore-unfixed -f json -o $appName.json $registry/$repo:$tag |
| 47 | + |
| 48 | + export BUILDKIT_VERSION=v0.12.0 |
| 49 | + docker run \ |
| 50 | + --detach \ |
| 51 | + --rm \ |
| 52 | + --privileged \ |
| 53 | + --name buildkitd \ |
| 54 | + --entrypoint buildkitd \ |
| 55 | + "moby/buildkit:$BUILDKIT_VERSION" |
| 56 | + |
| 57 | + copa patch -i $registry/$repo:$tag -r $appName.json -t $tag --addr docker-container://buildkitd --timeout "$CopaTimeout" |
| 58 | + if [ $? -eq 0 ] ; then |
| 59 | + trivy image --vuln-type os --ignore-unfixed $registry/$repo:$tag | grep -i total |
| 60 | + docker push $registry/$repo:$tag |
| 61 | + else |
| 62 | + echo "------------------------------------------------------------------------------------------------------------------------" |
| 63 | + echo "BUILD FAILED: non zero exit status during copa patch..." |
| 64 | + echo "------------------------------------------------------------------------------------------------------------------------" |
| 65 | + exit 1; |
| 66 | + fi |
| 67 | +fi |
| 68 | +$$, |
| 69 | + 'SHELL', |
| 70 | + 'f', |
| 71 | + 'now()', |
| 72 | + 1, |
| 73 | + 'now()', |
| 74 | + 1 |
| 75 | +); |
| 76 | + |
| 77 | +INSERT INTO "plugin_step" ("id", "plugin_id","name","description","index","step_type","script_id","deleted", "created_on", "created_by", "updated_on", "updated_by") |
| 78 | +VALUES (nextval('id_seq_plugin_step'), (SELECT id FROM plugin_metadata WHERE name='Copacetic v1.0.0'),'Step 1','Step 1 - Copacetic v1.0.0','1','INLINE',(SELECT last_value FROM id_seq_plugin_pipeline_script),'f','now()', 1, 'now()', 1); |
| 79 | + |
| 80 | +INSERT INTO plugin_step_variable (id,plugin_step_id,name,format,description,is_exposed,allow_empty_value,default_value,value,variable_type,value_type,previous_step_index,variable_step_index,variable_step_index_in_plugin,reference_variable_name,deleted,created_on,created_by,updated_on,updated_by) |
| 81 | +VALUES (nextval('id_seq_plugin_step_variable'),(SELECT ps.id FROM plugin_metadata p inner JOIN plugin_step ps on ps.plugin_id=p.id WHERE p.name='Copacetic v1.0.0' and ps."index"=1 and ps.deleted=false),'CopaTimeout','STRING','Timeout for copa patch command, default timeout is 5 minutes. For ex: 10m','t','t','5m',null,'INPUT','NEW',null,1,null,null,'f','now()',1,'now()',1); |
0 commit comments