blob: 28c92d50722a3a14233a433f5c4aed04b89b08a2 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
|
{
stdenv,
lib,
fetchurl,
writeShellScript,
}:
let
versionMetadata = import ./sysdig-cli-scanner.versions.nix;
fetchForSystem = versionMetadata.${stdenv.system} or (throw "unsupported system ${stdenv.system}");
wrapper = writeShellScript "sysdig-cli-scanner-wrapper" ''
for arg in "$@"; do
# We must not pass --dbpath to the cli in case it has been called with --iac
# IaC Scanning does not make use of the vulnerability database
if [ "$arg" = "--iac" ]; then
exec @out@/libexec/sysdig-cli-scanner-unwrapped "$@"
fi
done
# --dbpath argument is needed for vulnerability scanning mode, otherwise it tries to download
# the vulnerability database in the same path as the binary, which is read-only in the case of the
# nix store
exec @out@/libexec/sysdig-cli-scanner-unwrapped \
--dbpath="$HOME/.cache/sysdig-cli-scanner/" "$@"
'';
in
stdenv.mkDerivation {
pname = "sysdig-cli-scanner";
version = versionMetadata.version;
src = fetchurl { inherit (fetchForSystem) url hash; };
dontUnpack = true;
installPhase = ''
runHook preInstall
install -Dm755 -T $src $out/libexec/sysdig-cli-scanner-unwrapped
install -Dm755 -T ${wrapper} $out/bin/sysdig-cli-scanner
substituteInPlace $out/bin/sysdig-cli-scanner --subst-var out
runHook postInstall
'';
passthru.updateScript = ./update.sh;
meta = {
description = "Tool for scanning container images and directories using Sysdig";
longDescription = ''
The Sysdig Vulnerability CLI Scanner, sysdig-cli-scanner, is a versatile tool designed to
manually scan container images and directories, whether they are located locally or remotely.
Depending on your specific use case, you have the flexibility to execute sysdig-cli-scanner
in Vulnerability Management (VM) mode for image scanning or Infrastructure as Code (IaC) mode
for scanning directories.
'';
homepage = "https://docs.sysdig.com/en/docs/installation/sysdig-secure/install-vulnerability-cli-scanner/";
mainProgram = "sysdig-cli-scanner";
license = lib.licenses.unfreeRedistributable;
maintainers = with lib.maintainers; [ tembleking ];
platforms = [
"x86_64-linux"
"aarch64-linux"
"aarch64-darwin"
];
sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
};
}
|
