anchore / circleci-orbs

Repo for all Anchore circleci orb source code

This repository is deprecated and no longer maintained.

If you're looking for a host-local container vulnerability scanner see our new projects:

Software Bill of Materials for Containers: Syft

Container Vulnerability Scanning: Grype

circleci-orbs's Issues

Create orb for Grype scanning of a local directory for source-dep scanning

anchore/dependency-scan: use grype to perform vulnerability scan of directory dependencies (e.g. source dir)

Should support grype output formats

Create new directory-sbom orb for building sbom of project dependencies

anchore/directory-sbom: uses syft to build sbom of a working directory (e.g. source code dir after checkout)

Should support syft output formatting options.

Note: sbom = software bill of materials

outdated vuln feed

CircleCI caches the inline-scan image rather then attempting to pull the latest image every run. This causes the vulnerability database to get out of date if the cache persists for longer then 2 days.

The orb should ensure it pulls the newest tag of specified inline-scan image version before every run.

Migrate to orbs for Syft and Grype and deprecate inline-scan based version

Mark the existing orb deprecated and create new orbs using syft and grype for specific functions. Will link to individual issues for each orb.

1. container image sbom: #15
2. directory sbom: #16
3. image vulnerability scan: #17
4. directory vulnerability scan: #18

Create new container-image-sbom orb using Syft

anchore/container-image-sbom : uses syft to build sbom of container image

Should support output format options that syft exposes: cyclonedx, json, text, table

Note: sbom = software bill of materials

Create container-image-scan orb for Grype vuln scanning of a container image

anchore/container-image-scan: use grype to perform vulnerability scan of container image

Should support Grype output formats

policy_evaluation step fails with "Error: No such container: bash"

the following job fails with error Error: No such container: bash

  cve-scan:
    executor: anchore/anchore_engine
    environment:
      IMAGES: >-
        golang:1.14
    steps:
      - checkout
      - setup_remote_docker:
          docker_layer_caching: true
      - anchore/start_engine
      - anchore/add_private_regis
      - anchore/analyze_image:
          image_name: $IMAGES
      - anchore/policy_evaluation:
          image_name: $IMAGES
          policy_failure: true
          policy_bundle_file_path: .circleci/.anchore/policy_bundle.json
      - anchore/parse_reports
      - store_artifacts:
          path: anchore-reports

output from circleci

Error: No such container: bash
Failed to activate policy bundle .circleci/.anchore/policy_bundle.json - using default policy.