public/alpine-packages
5
0
Fork 0
Code Issues Pull Requests Actions Packages Releases Activity

Parallel builds and package updates and source build for SeaweedFS (#11)
Build Alpine Packages / preflight (push) Successful in 16s
Details
Build Alpine Packages / build (gitea) (push) Successful in 18s
Details
Build Alpine Packages / build (lavinmq) (push) Successful in 2m51s
Details
Build Alpine Packages / build (seaweedfs) (push) Successful in 21m35s
Details
Build Alpine Packages / build (greptimedb) (push) Successful in 1h20m0s
Details
Build Alpine Packages / verify-and-publish (push) Successful in 2m3s
Details

Browse Source 
Reviewed-on: #11
This commit was merged in pull request #11.
This commit is contained in:
fspjo
2026-09-29 11:00:07 +02:00
parent e8333709a5
commit b94463642a
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/apk/security-report.sh
+7 -2
View File
@@ -10,6 +10,11 @@ alpine_version="${ALPINE_VERSION:-3.24}"
arches="${ALPINE_SECURITY_ARCHES:-${ALPINE_ARCHES:-x86_64}}" arches="${ALPINE_SECURITY_ARCHES:-${ALPINE_ARCHES:-x86_64}}"
reports_dir="${APK_SECURITY_REPORTS_DIR:-${repo_root}/packages/security-reports}" reports_dir="${APK_SECURITY_REPORTS_DIR:-${repo_root}/packages/security-reports}"
trivy_bin="${TRIVY_BIN:-trivy}" trivy_bin="${TRIVY_BIN:-trivy}"
# The GCR pull-through mirror can serve a manifest whose layer has already
# expired, returning 404 rather than letting Trivy continue to its fallback.
# Use the publisher's registry directly; callers may still select an internal
# mirror by setting TRIVY_DB_REPOSITORY.
trivy_db_repository="${TRIVY_DB_REPOSITORY:-ghcr.io/aquasecurity/trivy-db:2}"
require_command() { require_command() {
command -v "$1" >/dev/null 2>&1 || { command -v "$1" >/dev/null 2>&1 || {
@@ -166,9 +171,9 @@ while IFS= read -r package_dir; do
install_rootfs_docker "${rootfs}" "${arch}" "${specs[@]}" install_rootfs_docker "${rootfs}" "${arch}" "${specs[@]}"
fi fi
"${trivy_bin}" filesystem --distro "alpine/${alpine_version}" --scanners vuln --format json --no-progress \ "${trivy_bin}" filesystem --db-repository "${trivy_db_repository}" --distro "alpine/${alpine_version}" --scanners vuln --format json --no-progress \
--output "${report_dir}/trivy.json" "${rootfs}/installed" --output "${report_dir}/trivy.json" "${rootfs}/installed"
"${trivy_bin}" filesystem --distro "alpine/${alpine_version}" --scanners vuln --format cyclonedx --no-progress \ "${trivy_bin}" filesystem --db-repository "${trivy_db_repository}" --distro "alpine/${alpine_version}" --scanners vuln --format cyclonedx --no-progress \
--output "${report_dir}/sbom.cdx.json" "${rootfs}/installed" --output "${report_dir}/sbom.cdx.json" "${rootfs}/installed"
jq -e 'type == "object" and has("ArtifactName")' "${report_dir}/trivy.json" >/dev/null jq -e 'type == "object" and has("ArtifactName")' "${report_dir}/trivy.json" >/dev/null
jq -e '.bomFormat == "CycloneDX"' "${report_dir}/sbom.cdx.json" >/dev/null jq -e '.bomFormat == "CycloneDX"' "${report_dir}/sbom.cdx.json" >/dev/null