search

anchore / ci-tools

Contains scripts for running anchore engine in CI pipelines
Apache License 2.0
34 stars 34 forks source link

CircleCI orb is not loading policy bundle #26

Open gubbin opened 4 years ago

gubbin commented 4 years ago

The problem

When I specify a path to a policy bundle using the policy_bundle_file_path param, I get "Failed to activate policy bundle" even though the policy bundle file is there.

Environment

CircleCI, anchore/anchore-engine@1.6.3 CircleCI Orb.

Details

I'm going to guess it's because of the missing Docker image name in this line: https://github.com/anchore/ci-tools/blob/e595ab4f4130c0b761cecc54d83b2be183e724bf/circleci-orbs/anchore-engine/src/commands/policy_evaluation.yml#L30 The surrounding output also implies that:

fetch http://dl-cdn.alpinelinux.org/alpine/v3.11/main/x86_64/APKINDEX.tar.gz
fetch http://dl-cdn.alpinelinux.org/alpine/v3.11/community/x86_64/APKINDEX.tar.gz
(1/2) Installing oniguruma (6.9.4-r0)
7  0%                                             8(2/2) Installing jq (1.6-r0)
7 49% #####################                       87 73% ################################            87100% ############################################8Executing busybox-1.31.1-r8.trigger
OK: 34 MiB in 28 packages
Error: No such container: bash

Failed to activate policy bundle /root/project/.anchore/anchore_default_bundle.json - using default policy.
^@Image Digest: sha256:47...
Full Tag: ****************************************************************:commit-61...
Image ID: 24...
Status: fail

Actual Behaviour

Anchore engine does not load the specified policy

Expected Behaviour

Anchore engine loads the specified policy

How do you reproduce the error?

Specify a policy

Btodhunter commented 4 years ago

@gubbin I've verified that the inline_scan is having issues with the -b option. Can you include a copy of the policy bundle you're trying to activate? I'm also curious about this error Error: No such container: bash, is this orb job running with the default executor?

gubbin commented 4 years ago

I was using the default policy bundle and the default executor. And look at the xargs docker to the right - there's no container image being specified here.