[WIP] Anchore CI security checks

.circleci/config.yml

@@ -0,0 +1,79 @@
+version: 2.1
+orbs:
+  anchore: anchore/[email protected]
+jobs:
+  "test":
+    docker:
+      - image: circleci/golang:1.12.4
+    working_directory: ~/fdk-go
+    steps:
+      - checkout
+      - setup_remote_docker:
+          docker_layer_caching: true
+      - run: docker pull fnproject/fnserver
+      - run:
+          command: go test -v ./...
+      - deploy:
+          command: |
+            if [[ "${CIRCLE_BRANCH}" == "master" && -z "${CIRCLE_PR_REPONAME}" ]]; then
+              printenv DOCKER_PASS | docker login -u ${DOCKER_USER} --password-stdin
+              git config --global user.email "[email protected]"
+              git config --global user.name "CI"
+              git branch --set-upstream-to=origin/${CIRCLE_BRANCH} ${CIRCLE_BRANCH}
+            fi
+
+  "go1_stretch_security_check":
+    executor: anchore/anchore_engine
+    working_directory: ~/fdk-go
+    steps:
+      - setup_remote_docker:
+          docker_layer_caching: true
+      - checkout
+      - run:
+          name: Golang 1 Stretch build
+          command: |
+            apk add bash
+            ./build-images.sh 1 stretch
+      - anchore/analyze_local_image:
+          image_name: "fnproject/go:1-stretch fnproject/go:1-stretch-dev"
+          timeout: '500'
+          policy_failure: true
+          policy_bundle_file_path: .circleci/.anchore/policy_bundle.json
+      - anchore/parse_reports
+
+  "go1_alpine_security_check":
+    executor: anchore/anchore_engine
+    working_directory: ~/fdk-go
+    steps:
+      - setup_remote_docker:
+          docker_layer_caching: true
+      - checkout
+      - run:
+          name: Golang 1 Alpine 3.8 build
+          command: |
+            apk add bash
+            ./build-images.sh 1 alpine
+      - anchore/analyze_local_image:
+          image_name: "fnproject/go:1-alpine fnproject/go:1-alpine-dev"
+          timeout: '500'
+          policy_failure: true
+          policy_bundle_file_path: .circleci/.anchore/policy_bundle.json
+      - anchore/parse_reports
+
+workflows:
+  version: 2
+  build:
+    jobs:
+      - "test"
+  nightly:
+    triggers:
+      - schedule:
+          cron: "0 0 * * *"
+          filters:
+            branches:
+              only:
+                - master
+    jobs:
+      - "test"
+      - "go1_stretch_security_check"
+      - "go1_alpine_security_check"

build-images.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+set -xe
+
+goversion=${1:-"1"}
+ostype=${2:-"alpine"}
+
+pushd images/${goversion}/${ostype}/build-stage && docker build -t fnproject/go:${goversion}-${ostype}-dev . && popd
+pushd images/${goversion}/${ostype}/runtime && docker build -t fnproject/go:${goversion}-${ostype} . && popd

images/1/alpine/build-stage/Dockerfile

@@ -0,0 +1,4 @@
+FROM golang:1-alpine3.8
+
+RUN apk update && apk upgrade && \
+    apk add --no-cache wget curl git bzr mercurial build-base

images/runtime/Dockerfile → images/1/alpine/runtime/Dockerfile

@@ -3,5 +3,4 @@ FROM alpine:3.8
 RUN apk update && apk upgrade \
   && apk add ca-certificates \
   && rm -rf /var/cache/apk/*
-
 RUN addgroup -g 1000 -S fn && adduser -S -u 1000 -G fn fn

images/1/stretch/build-stage/Dockerfile

@@ -0,0 +1,5 @@
+FROM golang:1-stretch
+
+RUN apt-get update && apt-get upgrade -qy && \
+    apt-get install wget curl mercurial build-essential gcc -qy && \
+    apt-get clean

images/1/stretch/runtime/Dockerfile

@@ -0,0 +1,4 @@
+FROM debian:stretch-slim
+
+RUN apt-get update && apt-get upgrade -qy && apt-get clean
+RUN addgroup --system --gid 1000 --system fn && adduser --system --uid 1000 --ingroup fn fn

release_images.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+user="fnproject"
+image="go"
+goversion="1"
+stretch="stretch"
+alpine="alpine"
+
+
+docker push ${user}/${image}:${goversion}-${stretch}
+docker push ${user}/${image}:${goversion}-${stretch}-dev
+
+docker push ${user}/${image}:${goversion}-${alpine}
+docker push ${user}/${image}:${goversion}-${alpine}-dev