Merge pull request #11 from aboutsource/update_dependencies

Update Dependencies and satisfy rubocop

Author: jonathanschlue-as

.rubocop.yml

@@ -1,14 +1,28 @@
 AllCops:
   TargetRubyVersion: 2.3
 
+Lint/RaiseException:
+  Enabled: true
+
+Lint/StructNewOverride:
+  Enabled: true
+
+
+Metrics:
+  Enabled: false
+
+
 Style/FrozenStringLiteralComment:
   Enabled: false
 
 Style/Documentation:
   Enabled: false
 
-Metrics/MethodLength:
-  Max: 50
+Style/HashEachMethods:
+  Enabled: true
+
+Style/HashTransformKeys:
+  Enabled: true
 
-Metrics/BlockLength:
-  Max: 200
+Style/HashTransformValues:
+  Enabled: true

Gemfile.lock

@@ -16,23 +16,23 @@ GEM
       multi_json
     domain_name (0.5.20190701)
       unf (>= 0.0.5, < 1.0.0)
-    excon (0.92.1)
+    excon (0.92.3)
     http-accept (1.7.0)
     http-cookie (1.0.4)
       domain_name (~> 0.5)
-    json (2.6.1)
+    jaro_winkler (1.5.4)
+    json (2.6.2)
     mime-types (3.4.1)
       mime-types-data (~> 3.2015)
     mime-types-data (3.2022.0105)
     mixlib-cli (1.7.0)
     multi_json (1.15.0)
     netrc (0.11.0)
     parallel (1.22.1)
-    parser (3.1.1.0)
+    parser (3.1.2.0)
       ast (~> 2.4.1)
     rainbow (3.1.1)
-    rake (10.5.0)
-    regexp_parser (2.2.1)
+    rake (13.0.6)
     rest-client (2.1.0)
       http-accept (>= 1.7.0, < 2.0)
       http-cookie (>= 1.0.2, < 2.0)
@@ -48,21 +48,18 @@ GEM
     rspec-expectations (3.11.0)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.11.0)
-    rspec-mocks (3.11.0)
+    rspec-mocks (3.11.1)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.11.0)
     rspec-support (3.11.0)
-    rubocop (0.93.1)
+    rubocop (0.81.0)
+      jaro_winkler (~> 1.5.1)
       parallel (~> 1.10)
-      parser (>= 2.7.1.5)
+      parser (>= 2.7.0.1)
       rainbow (>= 2.2.2, < 4.0)
-      regexp_parser (>= 1.8)
       rexml
-      rubocop-ast (>= 0.6.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 1.4.0, < 2.0)
-    rubocop-ast (1.16.0)
-      parser (>= 3.1.1.0)
     ruby-progressbar (1.11.0)
     sensu-plugin (4.0.0)
       json (< 3.0.0)
@@ -78,9 +75,9 @@ PLATFORMS
 DEPENDENCIES
   bundler (~> 2.1)
   quayio-scanner!
-  rake (~> 10.0)
+  rake (~> 13.0)
   rspec (~> 3.7)
-  rubocop (~> 0.49)
+  rubocop (~> 0.49, <= 0.81)
 
 BUNDLED WITH
-   2.2.23
+   2.1.4

README.md

@@ -1,6 +1,7 @@
 # Quayio::Scanner
 
-Scan quay.io for vulnerabilties in running docker containers. Implemented as sensu check.
+Quayio Scanner translates critical vulnerabilities in running docker containers
+into Sensu check results to transform vulnerability scans into actionable alerts.
 
 ## Installation
 
@@ -18,11 +19,26 @@ Or install it yourself as:
 
     $ gem install quayio-scanner
 
+## USAGE
+
+This plugin attempts to fetch vulnerabilities for all running containers
+
+### Parameters
+
+| Parameter     | Description             |
+|---------------|-------------------------|
+| -d URL        | Docker URL              |
+| -t TOKEN      | Quay.io oauth token     |
+| -w WHITELIST  | Vulnerability whitelist |
+
+### Example
+
+    $ check-container-vulnerabilities.rb --docker-url unix:///var/run/docker.sock --quayio-token AccessTokenGoesHere
+
 ## Contributing
 
 Bug reports and pull requests are welcome on GitHub at https://github.com/aboutsource/quayio-scanner.
 
-
 ## License
 
 The gem is available as open source under the terms of the [MIT License](http://opensource.org/licenses/MIT).
@@ -33,4 +49,4 @@ Copyright 2019 - present [Florian Frank](mailto:flori@ping.de) - The gem [json](
 
 ## Security
 
-* [Snyk](https://app.snyk.io/org/about-source/project/6eb2d381-87e7-49c4-a47f-ccad97f33ae3)
+- [Snyk](https://app.snyk.io/org/about-source/project/6eb2d381-87e7-49c4-a47f-ccad97f33ae3)

bin/check-container-vulnerabilities.rb

@@ -4,7 +4,7 @@
 #
 # DESCRIPTION:
 #
-#   This plugin attempts to fetch vulnerabilties for all running containers
+#   This plugin attempts to fetch vulnerabilities for all running containers
 #
 # OUTPUT:
 #   plain text
@@ -18,7 +18,8 @@
 #   gem: rest-client
 #
 # USAGE:
-#   ./check-container-vulnerabilities.rb -d <docker-url> -t <quay-io-oauth-token>
+#   ./check-container-vulnerabilities.rb \
+#     -d <docker-url> -t <quay-io-oauth-token>
 #
 
 require 'sensu-plugin/check/cli'

lib/quayio/scanner/check.rb

@@ -9,7 +9,10 @@ def run
         if vulnerable_images.empty?
           [:ok, "#{containers.size} Containers are ok"]
         else
-          [:critical, "The images are insecure: #{vulnerable_images.join(', ')}"]
+          [
+            :critical,
+            "The images are insecure: #{vulnerable_images.join(', ')}"
+          ]
         end
       end
 

lib/quayio/scanner/image.rb

@@ -2,7 +2,8 @@ module Quayio
   module Scanner
     class Image
       RELEVANT_SEVERITIES = %w[High Critical].freeze
-      QUAY_IO_REPO_NAME = %r{quay.io\/(?<org>[\w-]+)\/(?<repo>[\w-]+):(?<tag>[\w.-]+)}.freeze
+      QUAY_IO_REPO_NAME =
+        %r{quay.io\/(?<org>[\w-]+)\/(?<repo>[\w-]+):(?<tag>[\w.-]+)}.freeze
 
       attr_reader :name, :whitelist, :repository
 
@@ -24,19 +25,20 @@ def vulnerable?
 
       def quayio?
         # safe guard, do not trust QUAY_IO_REPO_NAME regex match
-        !!name.match(%r{^quay.io\/})
+        name.match?(%r{^quay.io\/})
       end
 
       def scanned?
         raw_scan['status'] == 'scanned'
       end
 
       def vulnerabilities_present?
-        !!raw_scan['data']['Layer']['Features'].detect do |f|
+        !raw_scan['data']['Layer']['Features'].detect do |f|
           f['Vulnerabilities']&.detect do |v|
-            RELEVANT_SEVERITIES.include?(v['Severity']) && !whitelist.include?(v['Name'])
+            RELEVANT_SEVERITIES.include?(v['Severity']) &&\
+            !whitelist.include?(v['Name'])
           end
-        end
+        end.nil?
       end
 
       def raw_scan

lib/quayio/scanner/repository.rb

@@ -18,7 +18,7 @@ def manifest_ref
 
       def fetch_manifest_ref
         result = api_call("/tag/?specificTag=#{tag}&onlyActiveTags=1")
-        (result['tags'].first)['manifest_digest']
+        result['tags'].first['manifest_digest']
       end
 
       def api_call(uri)

quayio-scanner.gemspec

@@ -8,7 +8,8 @@ Gem::Specification.new do |spec|
   spec.authors       = ['Benjamin Meichsner']
   spec.email         = ['benjamin.meichsner@aboutsource.net']
 
-  spec.summary       = 'Scan quay.io for vulnerabilties in running docker containers.'
+  spec.summary       = 'Scan quay.io for vulnerabilities in '\
+                       'running docker containers.'
   spec.homepage      = 'https://github.com/aboutsource/quayio-scanner'
   spec.license       = 'MIT'
 
@@ -17,14 +18,14 @@ Gem::Specification.new do |spec|
   spec.files = `git ls-files -z`.split("\x0").reject do |f|
     f.match(%r{^(test|spec|features)/})
   end
-  spec.executables   = Dir.glob('bin/**/*.rb').map { |file| File.basename(file) }
+  spec.executables   = Dir.glob('bin/**/*.rb').map { |f| File.basename(f) }
   spec.require_paths = ['lib']
 
   spec.add_dependency 'docker-api', '~> 1.33'
   spec.add_dependency 'rest-client', '~> 2.1'
   spec.add_dependency 'sensu-plugin', '~> 4.0'
   spec.add_development_dependency 'bundler', '~> 2.1'
-  spec.add_development_dependency 'rake', '~> 10.0'
+  spec.add_development_dependency 'rake', '~> 13.0'
   spec.add_development_dependency 'rspec', '~> 3.7'
-  spec.add_development_dependency 'rubocop', '~> 0.49'
+  spec.add_development_dependency 'rubocop', '~> 0.49', '<= 0.81'
 end