hyperledger / firefly

Hyperledger FireFly is the first open source Supernode: a complete stack for enterprises to build and scale secure Web3 applications. The FireFly API for digital assets, data flows, and blockchain transactions makes it radically faster to build production-ready apps on popular chains and protocols.
https://hyperledger.github.io/firefly
Apache License 2.0
508 stars 209 forks source link

adding vuln checks for high/critical severity #1462

Closed ssmirr closed 9 months ago

ssmirr commented 9 months ago

This Pull request:

  1. updates the Dockerfile to check dependencies of this source code, and fail to build if high/critical severity vulnerabilities are detected
  2. use trap in docker_build.sh to ensure make docker has a non-zero exist code when the build fails, and handle clean up the builder

Both of the changes above are implemented with the help of Trivy, an open source scanning tool from Aquasec. Trivy is RedHat certified, and is being used as the default container scanner on GitLab (according to this link)

nguyer commented 9 months ago

@ssmirr Thank you for these changes! I believe all of the issues identified by the tool are fixed in this branch: https://github.com/hyperledger/firefly/pull/1454

If you want to merge that branch into this one, I can approve and merge this branch.

codecov-commenter commented 9 months ago

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Comparison is base (d6578db) 99.99% compared to head (e8b32fa) 99.99%.

Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #1462 +/- ## ======================================= Coverage 99.99% 99.99% ======================================= Files 322 322 Lines 23300 23300 ======================================= Hits 23298 23298 Misses 1 1 Partials 1 1 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

ssmirr commented 9 months ago

@nguyer changes from https://github.com/hyperledger/firefly/pull/1454 are now merged into this branch. Thanks for the review!

ssmirr commented 9 months ago

issues that tool initially found seem to be fixed now 🎉 https://github.com/hyperledger/firefly/actions/runs/7921236477/job/21626078565?pr=1462#step:4:306