Scanning oc-mirror content before transfer to disconnected environment

README.md

Scanning oc-mirror artifacts

This procedure details how to scan container content created during the oc-mirror process for vulnerabilities with tools like grype.

This procedure applies only to oc-mirror v2 and does not support v1 which has been deprecated.

This procedure centers around the oc-mirror v2 "mirror-to-disk" method which generates tar archive(s) for transfer into a disconnected environment.

This procedure assume a clean RHEL 9 environment prior to run-1 and that the cache registry created by oc-mirror remains in tact and complete for all subsequent runs.

This procedure requires oc-mirror version 4.22.4 or newer and assumes all commands run in userspace with enough storage.

oc-mirror has 2 phases, initial run and subsequent runs. This procedure describes scanning the content in both phases. The "subsequent runs" phase is the primary focus.

oc-mirror to disk

oc-mirror --v2 --config ./imageset-config.yaml --authfile ~/.docker/config.json 'file:///home/danclark/workspace/oc-mirror-scanning/mirror1' 2>&1 | tee oc-mirror-to-disk.log

Extract the list of images that were mirrored

Extract the list of images mirrored by oc-mirror. The command will create a file with content like:

openshift-update-service/cincinnati-operator-bundle@sha256:50e9c88ca31182c54f9c4bc6682642a5115fa280044e6c125f99626c69d999ad
redhat/redhat-operator-index@sha256:e3d7dd17247ade4d0e2aacd81d33ba3120417b4509017a6a999dc75027ec1cb7
openshift-update-service/openshift-update-service-rhel8-operator@sha256:759f4de107a5b429933c5e44046ffb4ed75c674aea75440513a6df8fa93a83a3
openshift-update-service/openshift-update-service-rhel8@sha256:a9468a662babb272917df92bc9c827535b4b37883edb440b6d2d7c32ffb2145e

grep --no-filename -oP 'Success copying docker://\K.*' mirror1/working-dir/logs/* | grep -oP '(?<=/)[^ ]+' > images-to-scan.txt

Start a docker registry

• Start a docker registry using oc-mirror's cache directory as the base.

podman run -d --rm --name mirror-registry -p 5000:5000 -v /home/danclark/.oc-mirror/.cache:/var/lib/registry:z docker.io/library/registry:2

Scan the container images

• This procedure uses the grype cli based container scanner. Other tools may work but must be tested.

echo "[]" > combined_report.json

while IFS= read -r line || [[ -n "$line" ]]; do

    echo "Scanning image: $line"

    grype "${line}" -o json > temp.json
    jq --arg img "$img" '. + {image: $img}' temp.json > temp_labeled.json
    jq '. += [inputs]' combined_report.json temp_labeled.json > temp_combined.json
    mv temp_combined.json combined_report.json

done < "images-to-scan.txt"

# Cleanup temp files
rm temp.json temp_labeled.json