blob: 05298c004285e4b2ffac234ee9e76e7a3b017b6c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
|
{
lib,
pkgs,
...
}:
{
name = "owasp dep-scan test";
meta.maintainers =
with lib;
[
maintainers.ethancedwards8
]
++ teams.ngi.members;
containers.machine = {
environment.systemPackages = with pkgs; [
dep-scan
jq
];
# code repo to scan for vulnerabilites, could be anything
# I just happened to pick the source of the package
environment.etc."dep-scan-source".source = pkgs.dep-scan.src;
# we need to download the database before the vm starts, otherwise
# the program will try to download them at runtime.
# https://github.com/owasp-dep-scan/dep-scan/issues/443
environment.etc."vdb/data.index.vdb6".source = pkgs.fetchurl {
url = "https://huggingface.co/datasets/AppThreat/vdb/resolve/40609f230dd7c83178e054e0219c367b49a2c920/app-2y/data.index.vdb6";
hash = "sha256-UyE0xiLT0T4ygBdEvDi4VQW/vxwalN6YV9EJ9RoLYy4=";
};
environment.etc."vdb/data.vdb6".source = pkgs.fetchurl {
url = "https://huggingface.co/datasets/AppThreat/vdb/resolve/40609f230dd7c83178e054e0219c367b49a2c920/app-2y/data.vdb6";
hash = "sha256-k5QIowFD8H/hwaRz1p8RXlFEIrKjnFUtxtZTfD67B+U=";
};
environment.etc."vdb/vdb.meta".source = pkgs.fetchurl {
url = "https://huggingface.co/datasets/AppThreat/vdb/resolve/40609f230dd7c83178e054e0219c367b49a2c920/app-2y/vdb.meta";
hash = "sha256-eQB0dHlNw31sKsRcVUByhIfuIN35+m3VAcBHIfusNPY=";
};
environment.variables = {
VDB_HOME = "/tmp/vdb";
# the cache will try to auto refresh if the age is met (requires internet access)
VDB_AGE_HOURS = 999999;
};
};
testScript =
{ nodes, ... }:
''
start_all()
# vdb needs to be copied to tmp as it needs to write to dir
# and etc is RO
machine.succeed('cp -rL /etc/vdb /tmp/vdb')
machine.succeed('depscan --src /etc/dep-scan-source --reports-dir /tmp/reports')
machine.succeed('jq . /tmp/reports/*.json')
'';
}
|
