Module ploigos_step_runner.step_implementers.container_image_static_vulnerability_scan.openscap

StepImplementer for the container-image-static-vulnerability-scan step using OpenSCAP.

Convenience wrapper for the OpenSCAPGeneric step implementer so that users can specify OpenSCAP for the container-image-static-compliance-scan.

Step Configuration

Step configuration expected as input to this step. Could come from:

  • static configuration
  • runtime configuration
  • previous step results
Configuration Key Required? Default Description
container-image-tag Yes Container image tag to scan.
oscap-input-definitions-uri Yes URI to the OpenSCAP definitions file to do the evaluation with. Must use protocol file://
oscap-profile No OpenSCAP profile to evaluate.
oscap-tailoring-uri No URI to OpenSCAP tailoring file to do the evaluation with. Must use protocol file://
oscap-fetch-remote-resources No True For Source DataStream and XCCDF files that have remote references fetch them if True, else don't.

WARNING: evaluations will not be complete if input defintions require remote resources and this is not True. For disconnected environments the remote internal mirror.
'oscap-severity' No Severity threshold for failing a step. Will fail step on any vulnerability at that severity or higher.. Will fail on any severity if unset. Valid severity: low

Result Artifacts

Results artifacts output by this step.

Result Artifact Key Description
html-report HTML report generated by oscap eval
xml-report XML report generated by oscap eval
stdout-report stdout report generated by oscap eval

Classes

class OpenSCAP (workflow_result, parent_work_dir_path, config, environment=None)

StepImplementer for the container-image-static-vulnerability-scan step using OpenSCAP.

Convenience wrapper for the OpenSCAPGeneric step implementer so that users can specify OpenSCAP for the container-image-static-compliance-scan.

Expand source code 
class OpenSCAP(OpenSCAPGeneric):
    """`StepImplementer` for the `container-image-static-vulnerability-scan` step using OpenSCAP.

    Convenience wrapper for the `OpenSCAPGeneric` step implementer so that users
    can specify `OpenSCAP` for the `container-image-static-compliance-scan`.
    """

Ancestors

Inherited members