Versions Compared

Old Version 3

changes.mady.by.user Dyuti.Sengupta

Saved on

compared with

New Version Current

changes.mady.by.user Dyuti.Sengupta

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

This operation will scan a docker image using Grype and return the scan results as plugin outputs. The scan report will also be saved in the reports directory as ScanResults.json so it can be viewed later on. It supports execution on both WINDOWS and LINUX endpoints. Scanning can be done for both locally built and remote images.

...

Property Name

Property Code

Required

Description

Registry Account

FDANCRFDDKR_REGISTRY_ACCOUNT_CODE

No

The Docker Registry account to use. Please refer to the link to set up the Docker Registry Account: Docker Registry Setup For Cloud Providers

Grype Home

FDANCR_GRYPE_HOME

No

If it is desired to use an external Grype, fill in the Grype Home here. Otherwise, Grype will be installed automatically for Linux. For Windows this path needs to be specified, if not already set in system Path.

Note: For auto installation one must be connected to internet for the plugin operation to be able to download the grype utility.

Grype Version

FDANCR_GRYPE_VERSION

No

In case of auto install of Grype, the specified version will be considered. If nothing specified, the latest version will be installed. Note: Only valid for Linux.

...

Input Name

Input Code

Required

Description

Docker Registry Account

FDDKR_INP_REGISTRY_ACCOUNT_CODE

No

The Registry to pull the image to be scanned from.

There are a couple different spots to specify this for convenience.

In order of precedence:

  • This plugin input.

  • Target Property

Please refer to the link to set up the Docker Registry Account: Docker Registry Setup For Cloud Providers

Docker Image Name

FDANCR_INP_IMAGE_NAME

Yes

The full name of the image in the format: <ImageName>:<Tag>.

Example: alpine:latest.

  • For Remote images it should be the image name include registry name.

  • For Local images, please ensure you don’t have Registry Account code anywhere specified in either Target Property or Plugin Input, otherwise Grype will try to fetch the image from Remote registry, which is not applicable for local images at that moment.

Panel
panelIconIdatlassian-info
panelIcon:info:
bgColor#E6FCFF

Note: If FDANCR_INP_IMAGE_NAME is specified with preceding “/”, then the registry address from FDDKR_REGISTRY_ACCOUNT_CODE or FDDKR_INP_REGISTRY_ACCOUNT_CODE will get auto prepended to FDANCR_INP_IMAGE_NAME to form the full image name.

Example: If FDANCR_INP_IMAGE_NAME=/nginximage and the registry address corresponding to the FDDKR_REGISTRY_ACCOUNT_CODE is 898334.dkr.ecr.us-east-1.amazonaws.com, then plugin will consider the image name as 898334.dkr.ecr.us-east-1.amazonaws.com/nginximage.

Scan Fail Condition

FDANCR_INP_SCAN_SEV_FAIL_CONDITION

No

Specify the severity levels in CSV format for which the scan status should show as Fail.e.g: critical,high. Note: it is case-insensitive.

Single or multiple values in comma separated format is supported.

Grype Configuration File

FDANCR_INP_CONFIG

No

Specify the path for an optional configuration yaml file to use when scanning. If absolute paths are not provided, then it is relative to the FD_ARTIFACTS_DIR directory.

Show Output in log

FDANCR_INP_SHOW_OUTPUT

No

Show scan result in tabular format in plugin execution log.

Default: True

Additional Arguments

FDANCR_INP_ADDITIONAL_ARGS

No

If any other arguments need to be passed for Grype execution. e.g: --scope all-layers.

...

  • Severity: CVE Id severity.

  • Message: The code paths affected by the CVE.

  • Scan Rule: Concatenated value of CVE Id and CVE namespace (found in the scan-results.json file under vulnerability segment).

  • Scan Component: Concatenated and colon separated value of Artifact name, artifact Id and artifact version (found in the scan-results.json file under artifacts segment).

...