search

project-copacetic / copacetic

🧵 CLI tool for directly patching container images using reports from vulnerability scanners
https://project-copacetic.github.io/copacetic/
Apache License 2.0
845 stars 59 forks source link

feat: add custom tooling repo support #628

Closed MiahaCybersec closed 1 month ago

MiahaCybersec commented 1 month ago

Closes #598

codecov[bot] commented 1 month ago

Codecov Report

Attention: Patch coverage is 23.80952% with 16 lines in your changes are missing coverage. Please review.

Project coverage is 33.85%. Comparing base (2602d59) to head (728df52). Report is 67 commits behind head on main.

Files Patch % Lines
pkg/patch/patch.go 0.00% 7 Missing :warning:
pkg/pkgmgr/dpkg.go 50.00% 4 Missing :warning:
pkg/pkgmgr/apk.go 0.00% 2 Missing :warning:
pkg/pkgmgr/rpm.go 0.00% 2 Missing :warning:
pkg/patch/cmd.go 50.00% 1 Missing :warning:
Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #628 +/- ## ========================================== + Coverage 32.51% 33.85% +1.34% ========================================== Files 17 18 +1 Lines 1621 1527 -94 ========================================== - Hits 527 517 -10 + Misses 1062 977 -85 - Partials 32 33 +1 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

sozercan commented 1 month ago

do we still need this with the source policies? https://project-copacetic.github.io/copacetic/website/faq#can-i-replace-the-package-repositories-in-the-image-with-my-own

MiahaCybersec commented 1 month ago

After taking a look, this could potentially be seen as redundant. Do we still want a user flag for this kind of behaviour, or do we want the user to pass in these custom values exclusively via BuildKit source policies?

If this PR is still wanted, please let me know so I can make the necessary changes before it gets merged. I noticed this morning that I forgot to add some logic in dpkg.go to pass the new variable into the appropriate functions if a custom tooling repo is passed in.