Open killianmuldoon opened 11 months ago
/help
@killianmuldoon: This request has been marked as needing help from a contributor.
Please ensure that the issue body includes answers to the following questions:
For more details on the requirements of such an issue, please see here and ensure that they are met.
If this request no longer meets these requirements, the label can be removed
by commenting with the /remove-help
command.
Thx for all the research that went into this so far and writing up a very clear summary.
Did you mean controller & clusterctl images? I think the clusterctl binaries should be covered by the "code-level" scan.
I think if someone has time to take this on, it would be probably best invested in pushing the community discussion forward, so that Cluster API can eventually just share a solution with the wider community.
Did you mean controller & clusterctl images? I think the clusterctl binaries should be covered by the "code-level" scan.
I also mean the binary, though I basically agree it should be covered by the code level scan. It wouldn't hurt to find something that covers all of our release artifacts.
q: does this cover both binaries (clusterctl) and images?
does this cover both binaries (clusterctl) and images?
The issue does, but the tooling may or may not.
ACK, let's keep this in mind while we assess different tools
/triage accepted
/kind feature /priority important-soon
This issue is labeled with priority/important-soon
but has not been updated in over 90 days, and should be re-triaged.
Important-soon issues must be staffed and worked on either currently, or very soon, ideally in time for the next release.
You can:
/triage accepted
(org members only)/priority important-longterm
or /priority backlog
/close
For more details on the triage process, see https://www.kubernetes.dev/docs/guide/issue-triage/
/remove-triage accepted
/priority important-soon /triage accepted
Another option to consider https://github.com/google/go-licenses
Following on from https://github.com/kubernetes-sigs/cluster-api/issues/9181 there may be a need in CAPI to find a good way to scan for forbidden licenses in our release artifacts - namely our controller images and the clusterctl binaries.
There are a few tools out there that can do such a scan:
Trivy
distroless:nonroot
. These are not being picked up by the other scanners.Snyk
Fossa
There's still ongoing conversation in the Kubernetes community about this.
My preference would be to defer the conversation for CAPI until we have some idea of the preferred direction from the community. None of the tools above seem to be a great fit for now. If someone has time to take this on though it could be really helpful for CAPI and the broader community.