feat: add govulcheck to suppress the go cves#361
Conversation
Signed-off-by: pohanhuang <pohan.huang@suse.com>
Signed-off-by: pohanhuang <pohan.huang@suse.com>
- Add govulndb.zip.local for local build - improve makefile, .gitignore - unzip the golvuldb in scanner Signed-off-by: pohanhuang <pohan.huang@suse.com>
There was a problem hiding this comment.
Thanks for implementing the review comments! Just a few minor comments.
Open question: Do you think there is a way to know the version of govulndb? I think that would be helpful to track the issue back to golang database, but I'm not sure if it's feasible.
| if info, err := os.Stat(scanUtils.GovulcheckDBPath); err == nil && info.IsDir() { | ||
| if entries, err := os.ReadDir(scanUtils.GovulcheckDBPath); err == nil && len(entries) > 0 { | ||
| log.WithFields(log.Fields{"path": scanUtils.GovulcheckDBPath}).Debug("govulndb already exists, skipping extraction") | ||
| return nil | ||
| } | ||
| } |
There was a problem hiding this comment.
Maybe you can just os.Stat() against the expected path? If the zip file doesn't contain the file it's probably an error too.
There was a problem hiding this comment.
I will just simply check if the extracted result path exist, what do you think?
There was a problem hiding this comment.
yes that's what I mean. As long as the end result isn't right we should always re-extract.
| if !strings.HasPrefix(filePath, filepath.Clean(targetPath)+string(os.PathSeparator)) { | ||
| return fmt.Errorf("illegal file path: %s", file.Name) | ||
| } |
There was a problem hiding this comment.
I'd hardcode the expected file path and ignore others.
Does this field works for you? |
yes that works for me, but please double check if the link of govulndb is valid. It returns 404 now. |
|
@holyspectral I create a fix in release https://github.com/neuvector/release/pulls already, please help check when you are available |
- simplify the implementation return nil when path is not correct - only check the folder exist to represent the extract is success Signed-off-by: pohanhuang <pohan.huang@suse.com>
|
@holyspectral I make some changes in this commits
|
|
@holyspectral about the cve version, will add it into report field like the implementation in https://github.com/neuvector/neuvector/pull/2295/changes WDYT? |
2 participants
Description
Test
Additional Information
Tradeoff
Potential improvement