Skip to content

Commit 3e43555

Browse files
austinsongeraustinsonger
authored
Merge pull request #9 from Secure-Compliance-Solutions-LLC/dev
v21.4.2-v1
2 parents c32025f + bae1fda commit 3e43555

File tree

13 files changed

+428
-52
lines changed

13 files changed

+428
-52
lines changed

‎.github/ISSUE_TEMPLATE/bug_report.md

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
name: Bug report
3+
about: Create a report to help us improve
4+
title: "[Bug]"
5+
labels: bug
6+
assignees: Dexus, pixelsquared
7+
8+
---
9+
10+
**** Before you open a bug issue, please read the documentation. If you do not find an answer to your problem there, please look in the issues that have already been closed. Only if you still have not found an answer to your problem should you open a new issue. ****
11+
** https://securecompliance.gitbook.io/projects/openvas-greenbone-deployment-full-guide **
12+
13+
**Describe the bug**
14+
A clear and concise description of what the bug is.
15+
16+
**To Reproduce**
17+
Steps to reproduce the behavior:
18+
1. Go to '...'
19+
2. Click on '....'
20+
3. Scroll down to '....'
21+
4. See error
22+
23+
**Expected behavior**
24+
A clear and concise description of what you expected to happen.
25+
26+
**Screenshots**
27+
If applicable, add screenshots to help explain your problem.
28+
29+
**Host Device:**
30+
- OS:
31+
- Version:
32+
33+
**Image in use:**
34+
- Self build?
35+
- Output from `docker image inspect <image>` :
36+
```
37+
# docker image inspect <image>
38+
```
39+
40+
**Additional context**
41+
Add any other context about the problem here.

‎.github/ISSUE_TEMPLATE/feature_request.md

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
---
2+
name: Feature request
3+
about: Suggest an idea for this project
4+
title: "[Enhancement]"
5+
labels: ''
6+
assignees: austinsonger, Dexus
7+
8+
---
9+
10+
**Is your feature request related to a problem? Please describe.**
11+
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
12+
13+
**Describe the solution you'd like**
14+
A clear and concise description of what you want to happen.
15+
16+
**Describe alternatives you've considered**
17+
A clear and concise description of any alternative solutions or features you've considered.
18+
19+
**Additional context**
20+
Add any other context or screenshots about the feature request here.

‎.github/PULL_REQUEST_TEMPLATE.md

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
## Summary
2+
3+
Summarize your PR. If it involves visual changes, include a screenshot or GIF.
4+
5+
6+
### Checklist
7+
8+
Delete any items that are not applicable to this PR.
9+
10+
- [ ] [Update Documentation](https://github.com/Secure-Compliance-Solutions-LLC/gitbook) was added for features that require explanation or tutorials
11+
12+
### Enhancements:
13+
14+
15+
### Fixed Bug/Issues solved:
16+
17+
18+
### Breaking Changes:
19+

‎.github/workflows/docker-publish.yml

Lines changed: 258 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,258 @@
1+
name: Docker Image Build and Release
2+
3+
on:
4+
push:
5+
branches: [master]
6+
pull_request:
7+
branches: [master, dev]
8+
create:
9+
tags:
10+
11+
concurrency: ci-${{ github.ref }}
12+
13+
env:
14+
# Use docker.io for Docker Hub if empty
15+
REGISTRY: ghcr.io
16+
# github.repository as <account>/<repo>
17+
IMAGE_NAME: ${{ github.repository }}
18+
IMAGE_NAME_GHCR: ghcr.io/${{ github.repository }}
19+
IMAGE_NAME_DOCKER: securecompliance/openvas
20+
21+
permissions:
22+
contents: read
23+
packages: write
24+
25+
jobs:
26+
build_test_trivy:
27+
name: Build and Test - Trivy
28+
runs-on: ubuntu-latest
29+
steps:
30+
- uses: actions/checkout@v2
31+
32+
- name: PrepareReg Names
33+
run: |
34+
echo IMAGE_REPOSITORY_GHCR=$(echo "ghcr.io/${{ github.repository }}" | tr '[:upper:]' '[:lower:]') >> $GITHUB_ENV
35+
echo IMAGE_TAG=$(echo ${{ github.ref }} | tr '[:upper:]' '[:lower:]' | awk '{split($0,a,"/"); print a[3]}') >> $GITHUB_ENV
36+
37+
- name: Set tag var
38+
id: vars
39+
run: echo ::set-output name=docker_tag::$(echo ${GITHUB_REF} | cut -d'/' -f3)-${GITHUB_SHA}
40+
41+
- name: Download artifact
42+
uses: dawidd6/action-download-artifact@v2
43+
with:
44+
# Optional, GitHub token, a Personal Access Token with `public_repo` scope if needed
45+
# Required, if artifact is from a different repo
46+
github_token: ${{secrets.GITHUB_TOKEN}}
47+
# Required, workflow file name or ID
48+
workflow: build-apk.yml
49+
# Optional, will use the branch
50+
branch: master
51+
# Optional, uploaded artifact name,
52+
# will download all artifacts if not specified
53+
# and extract them in respective subdirectories
54+
# https://github.com/actions/download-artifact#download-all-artifacts
55+
name: apk-builds
56+
# Optional, directory where to extract artifact. Defaults to the artifact name (see `name` input)
57+
path: ${{ github.workspace }}/apk-build/
58+
# Optional, defaults to current repo
59+
repo: Secure-Compliance-Solutions-LLC/GVM-APK-build
60+
61+
- name: Build the Docker image
62+
run: docker build . --file Dockerfile --tag ${{ env.IMAGE_REPOSITORY_GHCR }}:${{ github.sha }}
63+
64+
- uses: actions/cache@v2.1.4
65+
with:
66+
path: .trivy
67+
key: ${{ runner.os }}-trivy-${{ github.run_id }}
68+
restore-keys: |
69+
${{ runner.os }}-trivy-
70+
71+
- name: Run Trivy vulnerability scanner
72+
uses: aquasecurity/trivy-action@master
73+
with:
74+
image-ref: "${{ env.IMAGE_REPOSITORY_GHCR }}:${{ github.sha }}"
75+
format: "table"
76+
exit-code: "1"
77+
ignore-unfixed: true
78+
vuln-type: "os,library"
79+
severity: "CRITICAL,HIGH"
80+
cache-dir: .trivy
81+
82+
- name: Run Trivy vulnerability scanner
83+
uses: aquasecurity/trivy-action@master
84+
if: always()
85+
with:
86+
image-ref: "${{ env.IMAGE_REPOSITORY_GHCR }}:${{ github.sha }}"
87+
format: "template"
88+
template: "@/contrib/sarif.tpl"
89+
output: "trivy-results.sarif"
90+
severity: "CRITICAL,HIGH"
91+
cache-dir: .trivy
92+
93+
- name: Upload Trivy scan results to GitHub Security tab
94+
uses: github/codeql-action/upload-sarif@v1
95+
if: always()
96+
with:
97+
sarif_file: "trivy-results.sarif"
98+
99+
- name: Correct Trivy cache permissions
100+
if: always()
101+
run: sudo chown -R $USER:$GROUP .trivy
102+
103+
build_test_anchore:
104+
name: Build and Test - Anchore
105+
runs-on: ubuntu-latest
106+
steps:
107+
- uses: actions/checkout@v2
108+
109+
- name: PrepareReg Names
110+
run: |
111+
echo IMAGE_REPOSITORY_GHCR=$(echo "ghcr.io/${{ github.repository }}" | tr '[:upper:]' '[:lower:]') >> $GITHUB_ENV
112+
echo IMAGE_TAG=$(echo ${{ github.ref }} | tr '[:upper:]' '[:lower:]' | awk '{split($0,a,"/"); print a[3]}') >> $GITHUB_ENV
113+
114+
- name: Set tag var
115+
id: vars
116+
run: echo ::set-output name=docker_tag::$(echo ${GITHUB_REF} | cut -d'/' -f3)-${GITHUB_SHA}
117+
118+
- name: Download artifact
119+
uses: dawidd6/action-download-artifact@v2
120+
with:
121+
# Optional, GitHub token, a Personal Access Token with `public_repo` scope if needed
122+
# Required, if artifact is from a different repo
123+
github_token: ${{secrets.GITHUB_TOKEN}}
124+
# Required, workflow file name or ID
125+
workflow: build-apk.yml
126+
# Optional, will use the branch
127+
branch: master
128+
# Optional, uploaded artifact name,
129+
# will download all artifacts if not specified
130+
# and extract them in respective subdirectories
131+
# https://github.com/actions/download-artifact#download-all-artifacts
132+
name: apk-builds
133+
# Optional, directory where to extract artifact. Defaults to the artifact name (see `name` input)
134+
path: ${{ github.workspace }}/apk-build/
135+
# Optional, defaults to current repo
136+
repo: Secure-Compliance-Solutions-LLC/GVM-APK-build
137+
138+
- name: Build the Docker image
139+
run: docker build . --file Dockerfile --tag ${{ env.IMAGE_REPOSITORY_GHCR }}:${{ github.sha }}
140+
141+
- uses: anchore/scan-action@v2
142+
if: always()
143+
id: scan
144+
with:
145+
image: "${{ env.IMAGE_REPOSITORY_GHCR }}:${{ github.sha }}"
146+
acs-report-enable: true
147+
148+
- name: upload Anchore scan SARIF report
149+
if: always()
150+
uses: github/codeql-action/upload-sarif@v1
151+
with:
152+
sarif_file: ${{ steps.scan.outputs.sarif }}
153+
154+
build_release:
155+
name: Build and Release
156+
runs-on: ubuntu-latest
157+
158+
outputs:
159+
labels: ${{ steps.meta.outputs.labels }}
160+
tags: ${{ steps.meta.outputs.tags }}
161+
162+
steps:
163+
- name: Checkout repository
164+
uses: actions/checkout@v2
165+
with:
166+
submodules: recursive
167+
168+
- uses: docker/setup-buildx-action@v1
169+
id: buildx
170+
with:
171+
install: true
172+
173+
# Login against a Docker registry except on PR
174+
# https://github.com/docker/login-action
175+
- name: Login to GitHub Container Registry ${{ env.REGISTRY }}
176+
uses: docker/login-action@v1
177+
with:
178+
registry: ${{ env.REGISTRY }}
179+
username: ${{ github.repository_owner }}
180+
password: ${{ secrets.GITHUB_TOKEN }}
181+
182+
- name: Login to DockerHub
183+
if: github.event_name != 'pull_request'
184+
uses: docker/login-action@v1
185+
with:
186+
username: ${{ secrets.DOCKERHUB_USERNAME }}
187+
password: ${{ secrets.DOCKERHUB_TOKEN }}
188+
189+
- name: Relase Prepare for latest Tag
190+
id: releasePreareLatestTag
191+
shell: bash
192+
run: |
193+
if [[ "$GITHUB_EVENT_NAME" == "create" ]] && [[ "$GITHUB_REF" =~ ^refs/tags/v.* ]]; then
194+
echo -n "::set-output name=latest::true"
195+
else
196+
echo -n "::set-output name=latest::false"
197+
fi
198+
199+
- name: Relase Prepare
200+
id: releasePreare
201+
run: |
202+
echo -n "::set-output name=images::"
203+
if [ "${GITHUB_EVENT_NAME}" != "pull_request" ]; then
204+
echo -n "${IMAGE_NAME_DOCKER}"
205+
echo -n ","
206+
fi
207+
echo -n "${IMAGE_NAME_GHCR}"
208+
209+
- name: Download artifact
210+
uses: dawidd6/action-download-artifact@v2
211+
with:
212+
# Optional, GitHub token, a Personal Access Token with `public_repo` scope if needed
213+
# Required, if artifact is from a different repo
214+
github_token: ${{secrets.GITHUB_TOKEN}}
215+
# Required, workflow file name or ID
216+
workflow: build-apk.yml
217+
# Optional, will use the branch
218+
branch: master
219+
# Optional, uploaded artifact name,
220+
# will download all artifacts if not specified
221+
# and extract them in respective subdirectories
222+
# https://github.com/actions/download-artifact#download-all-artifacts
223+
name: apk-builds
224+
# Optional, directory where to extract artifact. Defaults to the artifact name (see `name` input)
225+
path: ${{ github.workspace }}/apk-build/
226+
# Optional, defaults to current repo
227+
repo: Secure-Compliance-Solutions-LLC/GVM-APK-build
228+
229+
# Extract metadata (tags, labels) for Docker
230+
# https://github.com/docker/metadata-action
231+
- name: Extract Docker metadata
232+
id: meta2
233+
uses: docker/metadata-action@v3
234+
with:
235+
github-token: ${{ secrets.GITHUB_TOKEN }}
236+
images: ${{ steps.releasePreare.outputs.images }}
237+
flavor: |
238+
latest=${{ steps.releasePreareLatestTag.outputs.latest}}
239+
prefix=
240+
suffix=
241+
tags: |
242+
type=ref,event=branch
243+
type=ref,event=pr
244+
type=semver,pattern={{version}}
245+
type=semver,pattern={{raw}}
246+
type=semver,pattern={{major}}.{{minor}}
247+
248+
# Build and push Docker image with Buildx (don't push on PR)
249+
# https://github.com/docker/build-push-action
250+
- name: Build and push Docker image
251+
uses: docker/build-push-action@v2
252+
with:
253+
context: .
254+
push: true
255+
tags: ${{ steps.meta2.outputs.tags }}
256+
labels: ${{ steps.meta2.outputs.labels }}
257+
build-args: |
258+
SETUP=0

‎.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
apk-build/
2+
storage/

‎.gitmodules

Lines changed: 0 additions & 4 deletions
This file was deleted.

‎Dockerfile

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ CMD ["/usr/bin/supervisord", "-n", "-c", "/etc/supervisord.conf"]
55

66
ARG SUPVISD=supervisorctl
77
ARG DEBUG=N
8+
ARG AUTOSSH_DEBUG=${AUTOSSH_DEBUG:-0}
89
ARG TZ=UTC
910
ARG SETUP=0
1011

@@ -16,6 +17,7 @@ COPY apk-build/user.abuild/*.pub /etc/apk/keys/
1617

1718
ENV SUPVISD=${SUPVISD:-supervisorctl} \
1819
DEBUG=${DEBUG:-N} \
20+
AUTOSSH_DEBUG=${AUTOSSH_DEBUG:-0} \
1921
TZ=${TZ:-UTC} \
2022
SETUP=${SETUP:-0}
2123

@@ -30,11 +32,9 @@ RUN { \
3032
} >/etc/apk/repositories \
3133
&& cat /etc/apk/repositories \
3234
&& sleep 5 \
33-
&& apk update --update-cache \
35+
&& apk upgrade --no-cache --available \
3436
&& sleep 5 \
35-
&& apk upgrade --available \
36-
&& sleep 5 \
37-
&& apk add --allow-untrusted curl su-exec tzdata bash openssh supervisor openvas@custcom openvas-smb@custcom openvas-config@custcom gvm-libs@custcom ospd-openvas@custcom \
37+
&& apk add --no-cache --allow-untrusted curl wget rsync autossh su-exec tzdata bash openssh supervisor openvas@custcom openvas-smb@custcom openvas-config@custcom gvm-libs@custcom ospd-openvas@custcom \
3838
&& mkdir -p /var/log/supervisor/ \
3939
&& sync
4040

@@ -43,13 +43,15 @@ COPY scripts/* /
4343
COPY config/supervisord.conf /etc/supervisord.conf
4444
COPY config/redis-openvas.conf /etc/redis.conf
4545

46-
VOLUME [ "/var/lib/openvas/plugins" ]
46+
VOLUME [ "/var/lib/openvas/plugins", "/var/lib/gvm" ]
4747

4848
RUN if [ "${SETUP}" == "1" ]; then \
4949
ln -snf "/usr/share/zoneinfo/$TZ" /etc/localtime && echo "$TZ" >/etc/timezone \
5050
&& /usr/bin/supervisord -c /etc/supervisord.conf || true ; \
5151
unset SETUP ;\
5252
fi \
53+
&& apk upgrade --no-cache --available \
54+
&& chmod +x /*.sh \
5355
&& rm /etc/localtime || true\
5456
&& echo "UTC" >/etc/timezone \
5557
&& rm -rf /tmp/* /var/cache/apk/* \

0 commit comments

Comments
 (0)