Skip to content

Commit 7e92d3a

Browse files
temblekingtembleking
authored
feat(scanner): Add checksum verification for scanner download (#90)
1 parent 4e3e3c5 commit 7e92d3a

File tree

15 files changed

+426
-57
lines changed

15 files changed

+426
-57
lines changed

‎.github/workflows/ci-scan.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -180,3 +180,55 @@ jobs:
180180
echo "Scan failed but it should have succeeded."
181181
exit 1
182182
fi
183+
184+
scan-with-correct-checksum:
185+
runs-on: ubuntu-latest
186+
187+
steps:
188+
- name: Check out repository
189+
uses: actions/checkout@v4
190+
191+
- name: Scan with correct checksum
192+
id: scan
193+
uses: ./
194+
with:
195+
cli-scanner-version: '1.22.6'
196+
cli-scanner-sha256sum: '68ec2fc48c6ad61eba60a2469c5548153700fedab40ac79e34b7baa5f2e86e42'
197+
image-tag: sysdiglabs/dummy-vuln-app:latest
198+
sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
199+
stop-on-failed-policy-eval: false
200+
201+
- name: Check that the scan has succeeded
202+
run: |
203+
if [ "${{ steps.scan.outcome }}" == "success" ]; then
204+
echo "Scan succeeded as expected."
205+
else
206+
echo "Scan failed but it should have succeeded."
207+
exit 1
208+
fi
209+
210+
scan-with-incorrect-checksum:
211+
runs-on: ubuntu-latest
212+
213+
steps:
214+
- name: Check out repository
215+
uses: actions/checkout@v4
216+
217+
- name: Scan with incorrect checksum
218+
id: scan
219+
uses: ./
220+
continue-on-error: true
221+
with:
222+
cli-scanner-version: '1.22.6'
223+
cli-scanner-sha256sum: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
224+
image-tag: sysdiglabs/dummy-vuln-app:latest
225+
sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
226+
227+
- name: Check that the scan has failed
228+
run: |
229+
if [ "${{ steps.scan.outcome }}" == "failure" ]; then
230+
echo "Scan failed as expected."
231+
else
232+
echo "Scan succeeded but it should have failed due to incorrect checksum."
233+
exit 1
234+
fi

‎README.md‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ This action performs analysis on a specific container image and posts the result
1111
| `cli-scanner-url` | URL to `sysdig-cli-scanner` binary download. The action will detect the runner OS and architecture. For more info about the Sysdig CLI Scanner download visit [the official documentation](https://docs.sysdig.com/en/docs/installation/sysdig-secure/install-vulnerability-cli-scanner/). | |
1212
| `mode` | Mode of operation. Can be "vm" or "iac". | `vm` |
1313
| `cli-scanner-version` | Custom sysdig-cli-scanner version to download. Minimum required version is 1.18.0. Please note that for VM mode the Action has only been tested with the current default version and it is not guaranteed that it will work as expected with other versions. | `1.22.6` |
14+
| `cli-scanner-sha256sum` | SHA256 sum of the Sysdig CLI scanner binary to verify the download. If not provided, the action will automatically download the official checksum from Sysdig for verification. The scanner download is always verified. | |
1415
| `registry-user` | Registry username to authenticate to while pulling the image to scan. | |
1516
| `registry-password` | Registry password to authenticate to while pulling the image to scan. | |
1617
| `stop-on-failed-policy-eval` | Fail the job if the Policy Evaluation is Failed. | |
@@ -33,7 +34,14 @@ This action performs analysis on a specific container image and posts the result
3334
| `extra-parameters` | Additional parameters to be added to the CLI Scanner. Note that these may not be supported with the current Action. | |
3435
| `recursive` | Recursively scan all folders within the folder specified in the iacScanPath. | |
3536
| `minimum-severity` | Minimum severity to fail when scanning in IaC mode. | |
36-
| `iac-scan-path` | Path to the IaC files to scan. | |
37+
| `iac-scan-path` | Path to the IaC files to scan. | |
38+
39+
### Checksum Verification
40+
41+
The action always verifies the SHA256 checksum of the `sysdig-cli-scanner` binary to ensure its integrity. This process is handled as follows:
42+
43+
- **When `cli-scanner-sha256sum` is provided:** The downloaded binary is compared against the checksum you specified. The action will fail if they do not match.
44+
- **When `cli-scanner-sha256sum` is not provided:** The action automatically downloads the official checksum file from Sysdig. The downloaded binary is then compared against this official checksum. The action will fail if they do not match.
3745

3846
### Filtering Examples
3947

‎action.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,9 @@ inputs:
88
description: Custom sysdig-cli-scanner version to download. Oldest supported version is 1.18.0.
99
default: "1.22.6"
1010
required: false
11+
cli-scanner-sha256sum:
12+
description: 'SHA256 sum of the Sysdig CLI scanner binary to verify the download.'
13+
required: false
1114
registry-user:
1215
description: Registry username.
1316
required: false

0 commit comments

Comments
 (0)