39 lines
1.7 KiB
Bash
Executable File
39 lines
1.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
|
|
SCAN="$CASAN_HARNESS_ROOT/scripts/bash/live-supply-chain-scan.sh"
|
|
W="$(mktemp -d)"; trap 'rm -rf "$W"' EXIT
|
|
PASS=0; FAIL=0
|
|
pass() { echo "PASS: $1"; PASS=$((PASS+1)); }
|
|
fail() { echo "FAIL: $1"; FAIL=$((FAIL+1)); }
|
|
rc() { set +e; "$@" >/dev/null 2>&1; local c=$?; set -e; echo "$c"; }
|
|
mkdir -p "$W/bin"
|
|
cat > "$W/bin/npm" <<'SH'
|
|
#!/usr/bin/env bash
|
|
printf '%s\n' "$*" >> "$FAKE_LOG"
|
|
if [[ "$1" == sbom ]]; then printf '%s\n' '{"bomFormat":"CycloneDX"}'; fi
|
|
exit 0
|
|
SH
|
|
cat > "$W/bin/osv-scanner" <<'SH'
|
|
#!/usr/bin/env bash
|
|
printf '%s\n' "osv $*" >> "$FAKE_LOG"
|
|
for ((i=1; i<=$#; i++)); do [[ "${!i}" == --output-file ]] && { j=$((i+1)); printf '{}' > "${!j}"; }; done
|
|
exit 0
|
|
SH
|
|
cat > "$W/bin/trivy" <<'SH'
|
|
#!/usr/bin/env bash
|
|
printf '%s\n' "trivy $*" >> "$FAKE_LOG"
|
|
for ((i=1; i<=$#; i++)); do [[ "${!i}" == --output ]] && { j=$((i+1)); printf '{}' > "${!j}"; }; done
|
|
exit 0
|
|
SH
|
|
chmod +x "$W/bin/"*
|
|
FAKE_LOG="$W/log" PATH="$W/bin:$PATH" CASAN_REQUIRE_LIVE_SCANNERS=1 bash "$SCAN" "$W/out" casan-test:image >/dev/null \
|
|
&& [[ -s "$W/out/npm.cyclonedx.json" ]] && grep -q 'osv scan image' "$W/log" && grep -q 'trivy image' "$W/log" \
|
|
&& pass "live gate invokes SBOM, OSV and Trivy source/image scans" || fail "live scanner contract failed"
|
|
mkdir -p "$W/npm-only"; cp "$W/bin/npm" "$W/npm-only/npm"
|
|
[[ "$(rc env PATH="$W/npm-only:/usr/bin:/bin" CASAN_REQUIRE_LIVE_SCANNERS=1 bash "$SCAN" "$W/missing")" -ne 0 ]] \
|
|
&& pass "missing required scanner fails closed" || fail "missing scanner accepted"
|
|
echo "===== LIVE SUPPLY CHAIN SUMMARY: PASS=$PASS FAIL=$FAIL ====="
|
|
[[ "$FAIL" -eq 0 ]]
|