1 ##############################################################################
2 # Copyright (c) 2019 AT&T, ENEA AB, Nokia and others #
4 # Licensed under the Apache License, Version 2.0 (the "License"); #
5 # you maynot use this file except in compliance with the License. #
7 # You may obtain a copy of the License at #
8 # http://www.apache.org/licenses/LICENSE-2.0 #
10 # Unless required by applicable law or agreed to in writing, software #
11 # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT #
12 # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. #
13 # See the License for the specific language governing permissions and #
14 # limitations under the License. #
15 ##############################################################################
17 # ref: https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#use-multi-stage-builds
20 # Install dependencies
21 COPY pip-requirements.txt /wheels/requirements/pip-requirements.txt
22 RUN apt-get update && apt-get -y install \
27 linux-headers-generic \
39 RUN pip3 install wheel
40 RUN pip3 wheel -r /wheels/requirements/pip-requirements.txt
41 RUN git clone https://gerrit.akraino.org/r/validation /opt/akraino/validation
44 RUN mkdir -p /opt/akraino /root/src
46 RUN git clone https://github.com/linux-test-project/ltp.git
48 RUN make autotools && \
49 ./configure --prefix=/opt/ltp && \
50 make -j $(getconf _NPROCESSORS_ONLN) 2>&1 | tee ../build-log.txt && \
51 make install 2>&1 | tee ../install-log.txt
52 RUN tar czvf /opt/akraino/ltp.tar.gz /opt/ltp
54 RUN git clone https://github.com/CISOfy/lynis && tar czvf /opt/akraino/lynis-remote.tar.gz ./lynis
56 # Fetches vuls databases (invalidate cache using unique timestamp)
57 SHELL ["/bin/bash", "-c"]
58 RUN if [ $(uname -m) == 'aarch64' ]; then HOST_ARCH=arm64; else HOST_ARCH=amd64; fi && \
59 wget https://dl.google.com/go/go1.14.linux-$HOST_ARCH.tar.gz -P /root/ --progress=dot:giga && \
61 tar -xzf go1.14.linux-$HOST_ARCH.tar.gz -C /root/ && \
62 rm go1.14.linux-$HOST_ARCH.tar.gz && \
63 export GOROOT=/root/go && \
64 export GOPATH=/root/go/src/github.com && \
65 export PATH=$PATH:/root/go/bin:/root/go/src/github.com/bin && \
66 mkdir -p /root/go/src/github.com/future-architect && \
67 cd /root/go/src/github.com/future-architect && \
68 git clone https://github.com/future-architect/vuls -b v0.10.0 && \
71 mkdir -p /root/go/src/github.com/kotakanbe && \
72 git -C /root/go/src/github.com/kotakanbe clone https://github.com/kotakanbe/go-cve-dictionary.git -b v0.5.0 && \
73 cd /root/go/src/github.com/kotakanbe/go-cve-dictionary/ && \
75 git -C /root/go/src/github.com/kotakanbe clone https://github.com/kotakanbe/goval-dictionary.git -b v0.2.8 && \
76 cd /root/go/src/github.com/kotakanbe/goval-dictionary && \
78 mkdir -p /root/go/src/github.com/knqyf263 && \
79 git -C /root/go/src/github.com/knqyf263 clone https://github.com/knqyf263/gost.git -b v0.1.3 && \
80 cd /root/go/src/github.com/knqyf263/gost && \
83 ADD db.tar.gz /opt/akraino/validation/tests/os/vuls/
84 ADD db.tar.gz.timestamp /root/
86 export GOROOT=/root/go && \
87 export GOPATH=/root/go/src/github.com && \
88 export PATH=$PATH:/root/go/bin:/root/go/src/github.com/bin && \
89 for i in $(seq 2002 "$(date +"%Y")"); do go-cve-dictionary fetchnvd -quiet -http-proxy=${HTTP_PROXY} -dbpath /opt/akraino/validation/tests/os/vuls/cve.sqlite3 -years "$i"; done && \
90 goval-dictionary fetch-ubuntu -http-proxy=${HTTP_PROXY} -dbpath=/opt/akraino/validation/tests/os/vuls/oval_ubuntu_16.sqlite3 16 && \
91 goval-dictionary fetch-ubuntu -http-proxy=${HTTP_PROXY} -dbpath=/opt/akraino/validation/tests/os/vuls/oval_ubuntu_18.sqlite3 18 && \
92 goval-dictionary fetch-redhat -http-proxy=${HTTP_PROXY} -dbpath=/opt/akraino/validation/tests/os/vuls/oval_centos_7.sqlite3 7 && \
93 goval-dictionary fetch-redhat -http-proxy=${HTTP_PROXY} -dbpath=/opt/akraino/validation/tests/os/vuls/oval_centos_8.sqlite3 8 && \
94 gost fetch redhat --http-proxy=${HTTP_PROXY} --dbpath=/opt/akraino/validation/tests/os/vuls/gost_centos.sqlite3 --threads=$(nproc) && \
95 cd /opt/akraino/validation/tests/os/vuls && \
96 tar cvzf db.tar.gz *.sqlite3 && \
99 # Copy binaries into the final container and install robot framework, bluval dependencies
101 COPY --from=build /wheels /wheels
102 COPY --from=build /opt/akraino/validation /opt/akraino/validation
103 COPY --from=build /opt/akraino/ltp.tar.gz /opt/akraino/ltp.tar.gz
104 COPY --from=build /opt/akraino/lynis-remote.tar.gz /opt/akraino/lynis-remote.tar.gz
105 COPY --from=build /root/go/bin /root/go/bin
106 COPY --from=build /root/go/src/github.com/bin /root/go/src/github.com/bin
108 RUN apt-get update && apt-get -y install \
111 python3-pip python3.6 && \
112 cd /usr/bin && ln -s python3 python && \
113 pip3 install -r /wheels/requirements/pip-requirements.txt \
115 pip3 install -r /opt/akraino/validation/bluval/requirements.txt && \
117 rm -rf /root/.cache/pip/* && \
118 rm -rf /var/cache/apt/* && \
119 rm -rf /var/lib/apt/lists/*