feat: add oracle support #706
Conversation
Signed-off-by: Miaha Cybersec <[email protected]>
MiahaCybersec
requested review from
jeremyrickard,
sozercan and
ashnamehrotra
as code owners
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #706 +/- ##
==========================================
- Coverage 34.22% 34.21% -0.01%
==========================================
Files 18 18
Lines 1578 1584 +6
==========================================
+ Hits 540 542 +2
- Misses 1007 1011 +4
Partials 31 31 ☔ View full report in Codecov by Sentry. |
Signed-off-by: Miaha Cybersec <[email protected]>
Signed-off-by: Miaha Cybersec <[email protected]>
Signed-off-by: Miaha Cybersec <[email protected]>
|
can we fast fail if scanner input is specified with a descriptive error message? yes please add to docs. thanks! |
Signed-off-by: Miaha Cybersec <[email protected]>
Signed-off-by: Miaha Cybersec <[email protected]>
Signed-off-by: Miaha Cybersec <[email protected]>
Signed-off-by: Miaha Cybersec <[email protected]>
Signed-off-by: Miaha Cybersec <[email protected]>
Signed-off-by: Miaha Cybersec <[email protected]>
Signed-off-by: Miaha Cybersec <[email protected]>
Co-authored-by: Ashna Mehrotra <[email protected]> Signed-off-by: Miaha <[email protected]>
|
@MiahaCybersec for codecov coverage, maybe we can modify the getOSType() to check for Oracle? |
Signed-off-by: Miaha Cybersec <[email protected]>
Signed-off-by: Miaha Cybersec <[email protected]>
Signed-off-by: Miaha Cybersec <[email protected]>
Signed-off-by: Miaha Cybersec <[email protected]>
Signed-off-by: Miaha Cybersec <[email protected]>
Signed-off-by: Miaha Cybersec <[email protected]>
Signed-off-by: Miaha Cybersec <[email protected]>
Signed-off-by: Miaha Cybersec <[email protected]>
Signed-off-by: Miaha Cybersec <[email protected]>
Signed-off-by: Miaha Cybersec <[email protected]>
Signed-off-by: Miaha Cybersec <[email protected]>
Signed-off-by: Miaha Cybersec <[email protected]>
website/docs/troubleshooting.md
Outdated
| With a vulnerability scan, `--ignore-errors` must be passed in: | ||
|
|
||
| ```bash | ||
| patch -r /oracle-7.9-vulns.json -i docker.io/library/oraclelinux:7.9 --ignore-errors |
There was a problem hiding this comment.
i don't think this is going to patch all vulns, is that right? can we add a note or should we fail completely (including ignore-errors) for vuln report scenarios?
There was a problem hiding this comment.
It is referring to copa patch.
This will patch all vulnerabilities, but --ignore-errors must be passed in due to how Oracle handles CVEs.
Even if an Oracle image is fully patched, Trivy scans will complain about _fips. This is known upstream but has unfortunately remained unfixed for a couple years.
There was a problem hiding this comment.
we can add a note that this will patch all errors aside from the false positives due to Oracle CVE
website/docs/troubleshooting.md
Outdated
| Without a vulnerability scan, Copa will update all packages in the image: | ||
|
|
||
| ```bash | ||
| patch -i docker.io/library/oraclelinux:7.9 |
There was a problem hiding this comment.
This would be referencing copa patch
There was a problem hiding this comment.
lets change it to copa patch to be consistent with other parts of the doc and avoid confusion
website/docs/troubleshooting.md
Outdated
| With a vulnerability scan, `--ignore-errors` must be passed in: | ||
|
|
||
| ```bash | ||
| patch -r /oracle-7.9-vulns.json -i docker.io/library/oraclelinux:7.9 --ignore-errors |
There was a problem hiding this comment.
i don't think this is going to patch all vulns, is that right? can we add a note or should we fail completely (including ignore-errors) for vuln report scenarios?
Signed-off-by: Miaha Cybersec <[email protected]>
Signed-off-by: Miaha Cybersec <[email protected]>
Closes #190
Did we want to add some docs that Oracle is only supported without a vulnerability scan?