aquasecurity / chain-bench

An open-source tool for auditing your software supply chain stack for security compliance based on a new CIS Software Supply Chain benchmark.
Apache License 2.0
712 stars 63 forks source link

chain-bench does not work with gitlab if user id 1 does not exist #124

Open 123Haynes opened 1 year ago

123Haynes commented 1 year ago

Description

I tried to use chain-bench with our private GitLab instance. Unfortunately, it fails with error in authenticated user data.
Starting in with -v reveals that the cause is: error in authenticated user data error="GET https://myinstance/api/v4/1: 404 {message: 404 User not Found}"

This makes sense because we deleted the default root user with the id 1.
The lowest User ID in our Instance is 2. I'm unsure why chain-bench requires the default user to work. Imho it is quite common to delete it for security reasons after you created different admin accounts.

What did you expect to happen?

I expected chain-bench to scan my repository

What happened instead?

error in authenticated user data error="GET https://myinstance/api/v4/1: 404 {message: 404 User not Found}"

Additional details (base image name, container registry info...):

Tested with Version 0.1.7