diff --git a/.github/workflows/insights-scanner-image.yaml b/.github/workflows/insights-scanner-image.yaml index 12b3ff9b..7734973f 100644 --- a/.github/workflows/insights-scanner-image.yaml +++ b/.github/workflows/insights-scanner-image.yaml @@ -1,8 +1,6 @@ name: Publish insights-scanner image on: - schedule: - - cron: "1 0 * * *" push: branches: - 'main' diff --git a/insights-scanner/Dockerfile b/insights-scanner/Dockerfile index e01593f5..9c77fd51 100644 --- a/insights-scanner/Dockerfile +++ b/insights-scanner/Dockerfile @@ -2,7 +2,8 @@ ARG UPSTREAM_REPO ARG UPSTREAM_TAG ARG GO_VER FROM ${UPSTREAM_REPO:-uselagoon}/commons:${UPSTREAM_TAG:-latest} AS commons -FROM aquasec/trivy:0.68.2 AS trivy +FROM anchore/syft:v1.42.1 AS syft + FROM docker:28.5.2 @@ -38,15 +39,7 @@ RUN architecture=$(case $(uname -m) in x86_64 | amd64) echo "amd64" ;; aarch64 | && curl -Lo /usr/bin/kubectl https://dl.k8s.io/release/$KUBECTL_VERSION/bin/linux/${architecture}/kubectl \ && chmod +x /usr/bin/kubectl -COPY --from=trivy /usr/local/bin/trivy /usr/local/bin/trivy - -# Here we want to pull the trivy java DB -# This needs to be rebuilt daily, since we would like to be able to avoid pulling the javaDB on every scan -# This will increase the overall size of the -ENV TRIVY_CACHE_DIR=/ - -RUN trivy image --cache-dir ${TRIVY_CACHE_DIR} --download-db-only && \ - trivy image --cache-dir ${TRIVY_CACHE_DIR} --download-java-db-only +COPY --from=syft /syft /usr/local/bin/syft WORKDIR /app diff --git a/insights-scanner/insights-scan.sh b/insights-scanner/insights-scan.sh index 164d1651..b91bdac5 100644 --- a/insights-scanner/insights-scan.sh +++ b/insights-scanner/insights-scan.sh @@ -62,12 +62,10 @@ processImageInspect() { processImageInspect -echo "Running sbom scan using trivy" +echo "Running sbom scan using syft" echo "Image being scanned: ${IMAGE_FULL}" -# Setting JAVAOPT to skip the java db update, as the upstream image comes with a pre-populated database -JAVAOPT="--skip-java-db-update" -trivy image ${JAVAOPT} ${IMAGE_FULL} --format ${SBOM_OUTPUT} --skip-version-check | gzip > ${SBOM_OUTPUT_FILE} +syft -o cyclonedx-json ${IMAGE_FULL} | gzip > ${SBOM_OUTPUT_FILE} FILESIZE=$(stat -c%s "$SBOM_OUTPUT_FILE") echo "Size of ${SBOM_OUTPUT_FILE} = $FILESIZE bytes." diff --git a/renovate.json b/renovate.json index a33cc9a6..661367a0 100644 --- a/renovate.json +++ b/renovate.json @@ -58,7 +58,7 @@ "patch" ], "matchPackageNames": [ - "aquasec/trivy", + "anchore/syft", "docker" ] }