feat(cve): implement CVE scanning as background tasks #1833
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
In today's implementation the scanner populates the cache, but the API calls are still blocking. |
Codecov Report
@@ Coverage Diff @@
## main #1833 +/- ##
==========================================
+ Coverage 91.72% 91.79% +0.06%
==========================================
Files 143 145 +2
Lines 26127 26275 +148
==========================================
+ Hits 23965 24119 +154
+ Misses 1597 1594 -3
+ Partials 565 562 -3
... and 3 files with indirect coverage changes 📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more |
|
Related to #1815 |
andaaron
requested review from
shimish2,
rchincha and
eusebiu-constantin-petu-dbk
as code owners
andaaron
force-pushed
the
cve-bg-2
branch
4 times, most recently
from
a4d9c01
to
3f029a8
Compare
1. Move existing CVE DB download generator/task login under the cve package 2. Add a new CVE scanner task generator and task type to run in the background, as well as tests for it 3. Move the CVE cache in its own package 4. Add a CVE scanner methods to check if an entry is present in the cache, and to retreive the results 5. Modify the FilterTags MetaDB method to not exit on first error This is needed in order to pass all tags to the generator, instead of the generator stopping at the first set of invalid data 6. Integrate the new scanning task generator with the existing zot code. 7. Fix an issue where the CVE scan results for multiarch images was not cached 8. Rewrite some of the older CVE tests to use the new image-utils test package 9. Use the CVE scanner as attribute of the controller instead of CveInfo. Remove functionality of CVE DB update from CveInfo, it is now responsible, as the name states, only for providing CVE information. 10. The logic to get maximum severity and cve count for image sumaries now uses only the scanner cache. 11. Removed the GetCVESummaryForImage method from CveInfo as it was only used in tests Signed-off-by: Andrei Aaron <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is needed in order to pass all tags to the generator,
instead of the generator stopping at the first set of invalid data
Remove functionality of CVE DB update from CveInfo, it is now responsible,
as the name states, only for providing CVE information.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.