mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
137 lines
3.6 KiB
Markdown
137 lines
3.6 KiB
Markdown
# Workflows - Docker Image Scanning with Trivy
|
|
|
|
## Workflow 1: Developer Local Scan
|
|
|
|
```
|
|
[Developer builds image] --> [trivy image myapp:latest]
|
|
| |
|
|
v v
|
|
Fix Dockerfile Review findings
|
|
Update deps |
|
|
| +------+------+
|
|
| | |
|
|
v v v
|
|
Rebuild image CRITICAL/HIGH MEDIUM/LOW
|
|
| found? found?
|
|
| | |
|
|
v v v
|
|
Re-scan Fix immediately Add to backlog
|
|
before commit or .trivyignore
|
|
```
|
|
|
|
## Workflow 2: CI/CD Gate Scan
|
|
|
|
```yaml
|
|
# Pipeline stages
|
|
Build --> Scan --> Gate Decision --> Deploy/Block
|
|
|
|
# Gate policy
|
|
CRITICAL: Block deployment, fail pipeline (exit-code 1)
|
|
HIGH: Block deployment to production
|
|
MEDIUM: Warn, allow deployment to staging
|
|
LOW: Informational only
|
|
```
|
|
|
|
## Workflow 3: Registry Continuous Scanning
|
|
|
|
```
|
|
[Images in Registry]
|
|
|
|
|
v
|
|
[Scheduled Trivy Scan (daily/weekly)]
|
|
|
|
|
+--> [New CVE detected in existing image]
|
|
| |
|
|
| v
|
|
| [Create JIRA/GitHub issue]
|
|
| |
|
|
| v
|
|
| [Rebuild and push patched image]
|
|
|
|
|
+--> [No new CVEs]
|
|
|
|
|
v
|
|
[Log clean scan result]
|
|
```
|
|
|
|
## Workflow 4: Full SBOM + Vulnerability Pipeline
|
|
|
|
```bash
|
|
#!/bin/bash
|
|
IMAGE="myapp:v1.0.0"
|
|
|
|
# Step 1: Generate SBOM
|
|
trivy image --format cyclonedx --output sbom.cdx.json "$IMAGE"
|
|
|
|
# Step 2: Vulnerability scan
|
|
trivy image --format json --output vuln-report.json "$IMAGE"
|
|
|
|
# Step 3: License scan
|
|
trivy image --scanners license --format json --output license-report.json "$IMAGE"
|
|
|
|
# Step 4: Secret scan
|
|
trivy image --scanners secret --format json --output secret-report.json "$IMAGE"
|
|
|
|
# Step 5: Config scan (if Dockerfile available)
|
|
trivy config --format json --output config-report.json Dockerfile
|
|
|
|
# Step 6: Generate HTML report
|
|
trivy image --format template \
|
|
--template "@contrib/html.tpl" \
|
|
--output report.html "$IMAGE"
|
|
|
|
# Step 7: Upload to dependency tracking (e.g., Dependency-Track)
|
|
curl -X POST "https://dtrack.example.com/api/v1/bom" \
|
|
-H "X-Api-Key: $DTRACK_API_KEY" \
|
|
-F "project=$PROJECT_UUID" \
|
|
-F "bom=@sbom.cdx.json"
|
|
```
|
|
|
|
## Workflow 5: Multi-Image Fleet Scanning
|
|
|
|
```bash
|
|
#!/bin/bash
|
|
# Scan all images in a Kubernetes cluster
|
|
|
|
# Get unique images
|
|
IMAGES=$(kubectl get pods --all-namespaces -o jsonpath='{range .items[*]}{range .spec.containers[*]}{.image}{"\n"}{end}{end}' | sort -u)
|
|
|
|
echo "Scanning $(echo "$IMAGES" | wc -l) unique images..."
|
|
|
|
for IMAGE in $IMAGES; do
|
|
echo "=== Scanning: $IMAGE ==="
|
|
trivy image --severity CRITICAL,HIGH --exit-code 0 \
|
|
--format json --output "scan_$(echo $IMAGE | tr '/:' '_').json" \
|
|
"$IMAGE" 2>/dev/null
|
|
done
|
|
|
|
# Aggregate results
|
|
echo "Generating aggregate report..."
|
|
python3 aggregate_trivy_results.py scan_*.json > fleet_report.json
|
|
```
|
|
|
|
## Workflow 6: Trivy Operator for Kubernetes
|
|
|
|
```yaml
|
|
# Install Trivy Operator via Helm
|
|
# helm install trivy-operator aquasecurity/trivy-operator \
|
|
# --namespace trivy-system --create-namespace
|
|
|
|
# VulnerabilityReport is created automatically for each workload
|
|
apiVersion: aquasecurity.github.io/v1alpha1
|
|
kind: VulnerabilityReport
|
|
metadata:
|
|
name: pod-myapp-myapp
|
|
namespace: default
|
|
spec:
|
|
scanner:
|
|
name: Trivy
|
|
version: 0.50.0
|
|
report:
|
|
summary:
|
|
criticalCount: 2
|
|
highCount: 5
|
|
mediumCount: 12
|
|
lowCount: 8
|
|
```
|