Add Vuls security test for x86_64

[validation.git] / docker / os / Dockerfile

diff --git a/docker/os/Dockerfile b/docker/os/Dockerfile
index 58bed23..95d8cfe 100644 (file)
--- a/docker/os/Dockerfile
+++ b/docker/os/Dockerfile
@@ -28,6 +28,9 @@ RUN apt-get update && apt-get -y install \
     libffi-dev \
     make \
     libssl-dev \
+    golint \
+    sqlite3 \
+    debian-goodies \
     build-essential \
     autoconf automake autotools-dev m4 \
     linux-headers-generic \
@@ -60,8 +63,16 @@ COPY --from=build /opt/akraino/ltp.tar.gz /opt/akraino/ltp.tar.gz
 COPY --from=build /opt/akraino/lynis-remote.tar.gz /opt/akraino/lynis-remote.tar.gz
 
 
-RUN apt-get update && apt-get -y install \
-    python3-pip python3.6 && \
+RUN apt-get update && apt-get -y upgrade && apt-get -y install \
+    python3-pip python3.6 \
+    sqlite \
+    debian-goodies \
+    wget \
+    curl apt-transport-https ca-certificates software-properties-common && \
+    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add - && \
+    add-apt-repository "deb https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" && \
+    apt-get update && \
+    apt-get install -y docker-ce && \
     cd /usr/bin && ln -s python3 python && \
     pip3 install -r /wheels/requirements/pip-requirements.txt \
                  -f /wheels && \
@@ -70,6 +81,33 @@ RUN apt-get update && apt-get -y install \
     rm -rf /var/cache/apt/* && \
     rm -rf /var/lib/apt/lists/*
 
+# Fetches vuls databases
+SHELL ["/bin/bash", "-c"]
+RUN wget https://dl.google.com/go/go1.12.6.linux-amd64.tar.gz -P /root/ && \
+    cd /root/ && \
+    tar -xzf go1.12.6.linux-amd64.tar.gz -C /root/ && \
+    export GOROOT=/root/go && \
+    export GOPATH=/root/go/src && \
+    export PATH=$PATH:/root/go/bin:/root/go/src/bin && \
+    mkdir -p /root/go/src/github.com/future-architect && \
+    cd /root/go/src/github.com/future-architect && \
+    git clone https://github.com/future-architect/vuls && \
+    cd vuls && \
+    make install && \
+    mkdir -p /root/go/src/github.com/kotakanbe && \
+    git -C /root/go/src/github.com/kotakanbe clone https://github.com/kotakanbe/go-cve-dictionary.git && \
+    cd /root/go/src/github.com/kotakanbe/go-cve-dictionary/ && \
+    make install && \
+    mkdir /opt/akraino/validation/tests/os/vuls/ && \
+    for i in $(seq 2002 "$(date +"%Y")"); do go-cve-dictionary fetchnvd -http-proxy=${HTTP_PROXY} -dbpath /opt/akraino/validation/tests/os/vuls/cve.sqlite3 -years "$i"; done && \
+    git -C /root/go/src/github.com/kotakanbe clone https://github.com/kotakanbe/goval-dictionary.git && \
+    cd /root/go/src/github.com/kotakanbe/goval-dictionary && \
+    make install && \
+    goval-dictionary fetch-ubuntu -http-proxy=${HTTP_PROXY} -dbpath=/opt/akraino/validation/tests/os/vuls/oval.sqlite3 16 && \
+    cd /opt/akraino/validation/tests/os/vuls && \
+    tar cvzf db.tar.gz *.sqlite3 && \
+    rm *.sqlite3
+
 # Install bluval dependencies
 RUN pip3 install -r /opt/akraino/validation/bluval/requirements.txt
 ENV LC_ALL=C.UTF-8