๐Ÿช„ Grype jq ํŠธ๋ฆญ: ์Šคํ”„๋ ˆ๋“œ์‹œํŠธ์šฉ csv ๐Ÿ“Š

4704 ๋‹จ์–ด dockersecurityinfosecdevops

โ” ์†Œ๊ฐœ



์ข…์ข… ์ด๋ฏธ์ง€ ์ทจ์•ฝ์ ์— ๋Œ€ํ•ด ์ด์•ผ๊ธฐํ•  ๋•Œ ์Šคํ”„๋ ˆ๋“œ์‹œํŠธ์—์„œ ๊ทธ๋Ÿฐ ์ข…๋ฅ˜์˜ ์ฐจํŠธ๋ฅผ ๊ฐ€์ ธ์™€์•ผ ํ•ฉ๋‹ˆ๋‹ค... ๊ทธ๋Ÿฐ ์ข…๋ฅ˜์˜ ๊ฒƒ์„ ์–ป๊ณ  ์‹ถ์Šต๋‹ˆ๋‹ค.



๋”ฐ๋ผ์„œ ๋‹ค์Œ๊ณผ ๊ฐ™์€ ๋ฌธ์ œ๋ฅผ ๋งŒ๋“ค์—ˆ์Šต๋‹ˆ๋‹ค.

๐Ÿช„ jq ํŠธ๋ฆญ์„ ๊ตฌํ˜„ํ•˜์—ฌ ์‹ฌ๊ฐ๋„๋ณ„๋กœ ๊ทธ๋ฃนํ™”ํ•˜๊ณ  ๊ณ„์‚ฐ #8







adriens
์— ๊ฒŒ์‹œ๋จ



jq ๋ช…๋ น์„ ์ž…๋ ฅํ•˜๊ณ  ๋ฐ˜ํ™˜ํ•˜๋Š” grype -o json ์ฟผ๋ฆฌ๋ฅผ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค.
"Negligible",0
"Low",4
"High",10
์ฐธ์กฐ Group vulnerabilities by severity
๐Ÿฆ
:



View on GitHub


๐Ÿช„ jq ํŠธ๋ฆญ



ํŠธ๋ฆญ์„ ์ฆ๊ธฐ๋ ค๋ฉด ๋‹ค์Œ ์ง€์นจ์„ ๋”ฐ๋ฅด์‹ญ์‹œ์˜ค.



๐Ÿฟ ์‡ผํƒ€์ž„



์ถฉ๋ถ„ํ•œ ์ด์•ผ๊ธฐ, ํ–‰๋™์— ํŠธ๋ฆญ์„ ๋ณด์ž :



๐Ÿ”– ๋ฆฌ์†Œ์Šค


  • The trick
  • jq



  • opt-nc / ๋ถˆํ‰-๊ธฐ์—ฌ


    Anchore์˜ grype ๋„๊ตฌ ์ฃผ๋ณ€ ๋ฆฌ์†Œ์Šค ์„ธํŠธ





    โ” ์†Œ๊ฐœ


    ์ด ์ €์žฅ์†Œ์˜ ๋ชฉ์ ์€ ์ฃผ๋ณ€์˜ ์ผ๋ถ€ ๋ฆฌ์†Œ์Šค๋ฅผ ์š”์•ฝํ•˜๋Š” ๊ฒƒ์ž…๋‹ˆ๋‹คGrype.
    ์ด ํ›Œ๋ฅญํ•œ ๋„๊ตฌ๋ฅผ ์ตœ๋Œ€ํ•œ ํ™œ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

    ๐Ÿ”– grype-contribs ์•Œ์•„๋ณด๊ธฐ


    ์ด ํ”„๋กœ์ ํŠธ์— ๋Œ€ํ•ด ์ž์„ธํžˆ ์•Œ์•„๋ณด๋ ค๋ฉด ๋‹ค์Œ์„ ์‚ดํŽด๋ณด์‹ญ์‹œ์˜ค.


  • ๐Ÿ“บ Youtbe demo


  • ๐Ÿงฐ ์ „์ œ ์กฐ๊ฑด


    ์ด๋Ÿฌํ•œ ๋ฆฌ์†Œ์Šค๋ฅผ ์ตœ์ ์œผ๋กœ ์‚ฌ์šฉํ•˜๋ ค๋ฉด ๋‹ค์Œ์ด ํ•„์š”ํ•ฉ๋‹ˆ๋‹ค.
  • git

  • brew ์„ค์น˜๋จ
  • python3 ๋ฐ pip

  • ๋„๊ตฌ ์„ค์น˜


    brew tap anchore/grype
    brew install grype
    
    termgraph , "ํ„ฐ๋ฏธ๋„์—์„œ ๊ธฐ๋ณธ ๊ทธ๋ž˜ํ”„๋ฅผ ๊ทธ๋ฆฌ๋Š” ๋ช…๋ น์ค„ ๋„๊ตฌ"๋ฅผ ์‚ฌ์šฉํ•ฉ๋‹ˆ๋‹ค.
    python3 -m pip install termgraph
    
    ๋งˆ์ง€๋ง‰์œผ๋กœ ์ด ์ €์žฅ์†Œ๋ฅผ ๋ณต์ œํ•ฉ๋‹ˆ๋‹ค.
    gh repo clone opt-nc/grype-contribs
    cd grype-contribs
    
    ๐Ÿ‘‰ ์ค€๋น„๋˜์—ˆ์Šต๋‹ˆ๋‹ค.

    ๐Ÿ“œ ํ…œํ”Œ๋ฆฟ


    ์ดํ›„ v0.42.0 , ๊ทธ๋ฆฌ๊ณ 
    ๋ฌธ์ œ #724
    templates์œผ๋กœ ๋ถ„์„ ๋ณด๊ณ ์„œ๋ฅผ ๋ณ€ํ™˜ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.
    ์ด ๊ธฐ๋Šฅ์„ ์‚ฌ์šฉํ•˜๋ฉด ์œ ์šฉํ•˜๊ณ  ๊ณ ๋„๋กœ ์‚ฌ์šฉ์ž ์ •์˜ ๊ฐ€๋Šฅํ•œ ๋ณด๊ณ ์„œ๋ฅผ ์ž‘์„ฑํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

    ๐Ÿ“Š ํ„ฐ๋ฏธ๋„์˜ ์ง‘๊ณ„ ๋ณด๊ณ ์„œ( termgraph )


    โ€ฆ


    View on GitHub

    ์ข‹์€ ์›นํŽ˜์ด์ง€ ์ฆ๊ฒจ์ฐพ๊ธฐ