Skip to content

Commit aa1888b

Browse files
mocsharpmocsharp
authored
Track security scans & updates (#551)
* Update packages * Set container scans to continue-on-error * Update grype ignore list * Update CVE-2015-5237 to closed Signed-off-by: Victor Chang <[email protected]>
1 parent 3375b78 commit aa1888b

File tree

40 files changed

+3483
-3550
lines changed

40 files changed

+3483
-3550
lines changed

‎.github/workflows/build.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,7 @@ jobs:
9090

9191
- name: Dockle Container Scanner
9292
uses: erzz/dockle-action@v1
93+
continue-on-error: true
9394
if: ${{ contains(github.ref, 'refs/heads/main') || contains(github.head_ref, 'release/') }}
9495
with:
9596
image: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
@@ -100,12 +101,14 @@ jobs:
100101
# Disable upload due to bug https://github.com/erzz/dockle-action/issues/18
101102
# - name: Upload Dockle SARIF Report
102103
# uses: github/codeql-action/upload-sarif@v2
104+
# continue-on-error: true
103105
# if: ${{ contains(github.ref, 'refs/heads/main') || contains(github.head_ref, 'release/') }}
104106
# with:
105107
# sarif_file: dockle-report.sarif
106108

107109
- name: Trivy Vulnerability Scanner
108110
uses: aquasecurity/trivy-action@master
111+
continue-on-error: true
109112
if: ${{ contains(github.ref, 'refs/heads/main') || contains(github.head_ref, 'release/') }}
110113
with:
111114
image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
@@ -114,13 +117,15 @@ jobs:
114117

115118
- name: Upload Trivy SARIF Report
116119
uses: github/codeql-action/upload-sarif@v2
120+
continue-on-error: true
117121
if: ${{ contains(github.ref, 'refs/heads/main') || contains(github.head_ref, 'release/') }}
118122
with:
119123
sarif_file: 'trivy-results.sarif'
120124

121125
- name: Anchore Container Scan
122126
id: anchore-scan
123127
uses: anchore/[email protected]
128+
continue-on-error: true
124129
if: ${{ contains(github.ref, 'refs/heads/main') || contains(github.head_ref, 'release/') }}
125130
with:
126131
image: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
@@ -130,6 +135,7 @@ jobs:
130135

131136
- name: Upload Anchore Scan SARIF Report
132137
uses: github/codeql-action/upload-sarif@v2
138+
continue-on-error: true
133139
if: ${{ contains(github.ref, 'refs/heads/main') || contains(github.head_ref, 'release/') }}
134140
with:
135141
sarif_file: ${{ steps.anchore-scan.outputs.sarif }}

‎.grype.yaml‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,12 @@
1313
# limitations under the License.
1414

1515
ignore:
16-
- vulnerability: CVE-2022-37434 # https://github.com/Project-MONAI/monai-deploy-workflow-manager/issues/514
17-
- vulnerability: CVE-2015-5237 # https://github.com/Project-MONAI/monai-deploy-workflow-manager/issues/515
18-
- vulnerability: CVE-2016-20013 # https://github.com/Project-MONAI/monai-deploy-workflow-manager/issues/516
19-
- vulnerability: CVE-2017-11164 # https://github.com/Project-MONAI/monai-deploy-workflow-manager/issues/517
20-
- vulnerability: CVE-2020-16156 # https://github.com/Project-MONAI/monai-deploy-workflow-manager/issues/518
21-
- vulnerability: CVE-2022-29458 # https://github.com/Project-MONAI/monai-deploy-workflow-manager/issues/519
22-
16+
- vulnerability: CVE-2015-5237 # https://github.com/Project-MONAI/monai-deploy-workflow-manager/issues/515 CLOSED
17+
- vulnerability: CVE-2016-20013 # https://github.com/Project-MONAI/monai-deploy-workflow-manager/issues/516 CLOSED
18+
- vulnerability: CVE-2017-11164 # https://github.com/Project-MONAI/monai-deploy-workflow-manager/issues/517 CLOSED
19+
- vulnerability: CVE-2022-29458 # https://github.com/Project-MONAI/monai-deploy-workflow-manager/issues/519 CLOSED
20+
- vulnerability: CVE-2018-1000538 # https://github.com/Project-MONAI/monai-deploy-workflow-manager/issues/552 CLOSED
21+
- vulnerability: CVE-2020-11012 # https://github.com/Project-MONAI/monai-deploy-workflow-manager/issues/553 CLOSED
22+
- vulnerability: CVE-2021-21287 # https://github.com/Project-MONAI/monai-deploy-workflow-manager/issues/554 CLOSED
23+
- vulnerability: CVE-2021-43858 # https://github.com/Project-MONAI/monai-deploy-workflow-manager/issues/555 CLOSED
24+
- vulnerability: CVE-1999-1278 # https://github.com/Project-MONAI/monai-deploy-workflow-manager/issues/556 CLOSED

‎.licenserc.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ header:
3232
- 'src/.sonarlint/**'
3333
- 'src/coverlet.runsettings'
3434
- 'src/.vs'
35+
- 'doc/dependency_decisions.yml'
3536
- 'docs/templates/**'
3637

3738
comment: never

‎doc/dependency_decisions.yml‎

Lines changed: 71 additions & 147 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,17 @@
1-
# Copyright 2022 MONAI Consortium
2-
#
3-
# Licensed under the Apache License, Version 2.0 (the "License");
4-
# you may not use this file except in compliance with the License.
5-
# You may obtain a copy of the License at
6-
#
7-
# http://www.apache.org/licenses/LICENSE-2.0
8-
#
9-
# Unless required by applicable law or agreed to in writing, software
10-
# distributed under the License is distributed on an "AS IS" BASIS,
11-
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12-
# See the License for the specific language governing permissions and
13-
# limitations under the License.
14-
151
---
162
- - :approve
173
- AWSSDK.Core
184
- :who: mocsharp
195
:why: Apache-2.0 (http://aws.amazon.com/apache2.0/)
206
:versions:
21-
- 3.7.13.8
7+
- 3.7.100.6
228
:when: 2022-10-14 23:36:39.233755632 Z
239
- - :approve
2410
- AWSSDK.SecurityToken
2511
- :who: mocsharp
2612
:why: Apache-2.0 (http://aws.amazon.com/apache2.0/)
2713
:versions:
28-
- 3.7.1.203
14+
- 3.7.100.6
2915
:when: 2022-10-14 23:36:39.628260680 Z
3016
- - :approve
3117
- Ardalis.GuardClauses
@@ -116,7 +102,7 @@
116102
- :who: mocsharp
117103
:why: Apache-2.0 (https://github.com/fluentassertions/fluentassertions/raw/develop/LICENSE)
118104
:versions:
119-
- 6.7.0
105+
- 6.8.0
120106
:when: 2022-10-14 23:36:44.688882343 Z
121107
- - :approve
122108
- Fractions
@@ -490,14 +476,13 @@
490476
- :who: mocsharp
491477
:why: MIT (https://github.com/dotnet/aspnetcore/raw/main/LICENSE.txt)
492478
:versions:
493-
- 6.0.9
479+
- 6.0.10
494480
:when: 2022-10-14 23:37:05.589288760 Z
495481
- - :approve
496482
- Microsoft.Extensions.Diagnostics.HealthChecks.Abstractions
497483
- :who: mocsharp
498484
:why: MIT (https://github.com/dotnet/aspnetcore/raw/main/LICENSE.txt)
499485
:versions:
500-
- 6.0.9
501486
- 6.0.10
502487
:when: 2022-10-14 23:37:05.963687838 Z
503488
- - :approve
@@ -799,125 +784,8 @@
799784
- :who: mocsharp
800785
:why: Apache-2.0 (https://github.com/minio/minio-dotnet/raw/master/LICENSE)
801786
:versions:
802-
- 4.0.5
787+
- 4.0.6
803788
:when: 2022-10-14 23:37:22.726827733 Z
804-
- - :approve
805-
- Monai.Deploy.Messaging
806-
- &1
807-
:who: mocsharp
808-
:why: Apache-2.0 (https://github.com/Project-MONAI/monai-deploy-messaging/raw/main/LICENSE)
809-
:versions: []
810-
:when: 2022-10-14 23:37:23.125681503 Z
811-
- - :approve
812-
- version
813-
- *1
814-
- - :approve
815-
- 0.1.8
816-
- *1
817-
- - :approve
818-
- Monai.Deploy.Messaging.RabbitMQ
819-
- &2
820-
:who: mocsharp
821-
:why: Apache-2.0 (https://github.com/Project-MONAI/monai-deploy-messaging/raw/main/LICENSE)
822-
:versions: []
823-
:when: 2022-10-14 23:37:23.497395535 Z
824-
- - :approve
825-
- version
826-
- *2
827-
- - :approve
828-
- 0.1.8
829-
- *2
830-
- - :approve
831-
- Monai.Deploy.Storage
832-
- &3
833-
:who: mocsharp
834-
:why: Apache-2.0 (https://github.com/Project-MONAI/monai-deploy-storage/raw/main/LICENSE)
835-
:versions: []
836-
:when: 2022-10-14 23:37:23.855408783 Z
837-
- - :approve
838-
- version
839-
- *3
840-
- - :approve
841-
- 0.2.7
842-
- *3
843-
- - :approve
844-
- Monai.Deploy.Storage.MinIO
845-
- &4
846-
:who: mocsharp
847-
:why: Apache-2.0 (https://github.com/Project-MONAI/monai-deploy-storage/raw/main/LICENSE)
848-
:versions: []
849-
:when: 2022-10-14 23:37:24.258418409 Z
850-
- - :approve
851-
- version
852-
- *4
853-
- - :approve
854-
- 0.2.7
855-
- *4
856-
- - :approve
857-
- Monai.Deploy.Storage.S3Policy
858-
- &5
859-
:who: mocsharp
860-
:why: Apache-2.0 (https://github.com/Project-MONAI/monai-deploy-storage/raw/main/LICENSE)
861-
:versions: []
862-
:when: 2022-10-14 23:37:24.629387041 Z
863-
- - :approve
864-
- version
865-
- *5
866-
- - :approve
867-
- 0.2.7
868-
- *5
869-
- - :approve
870-
- MongoDB.Bson
871-
- &6
872-
:who: mocsharp
873-
:why: Apache-2.0 (https://github.com/mongodb/mongo-csharp-driver/raw/master/License.txt)
874-
:versions: []
875-
:when: 2022-10-14 23:37:25.061513979 Z
876-
- - :approve
877-
- version
878-
- *6
879-
- - :approve
880-
- 2.18.0
881-
- *6
882-
- - :approve
883-
- MongoDB.Driver
884-
- &7
885-
:who: mocsharp
886-
:why: Apache-2.0 (https://github.com/mongodb/mongo-csharp-driver/raw/master/License.txt)
887-
:versions: []
888-
:when: 2022-10-14 23:37:25.441147058 Z
889-
- - :approve
890-
- version
891-
- *7
892-
- - :approve
893-
- 2.18.0
894-
- *7
895-
- - :approve
896-
- MongoDB.Driver.Core
897-
- &8
898-
:who: mocsharp
899-
:why: Apache-2.0 (https://github.com/mongodb/mongo-csharp-driver/raw/master/License.txt)
900-
:versions: []
901-
:when: 2022-10-14 23:37:25.846975394 Z
902-
- - :approve
903-
- version
904-
- *8
905-
- - :approve
906-
- 2.18.0
907-
- *8
908-
- - :approve
909-
- MongoDB.Libmongocrypt
910-
- &9
911-
:who: mocsharp
912-
:why: Apache-2.0 (https://github.com/mongodb/mongo-csharp-driver/raw/master/License.txt)
913-
:versions: []
914-
:when: 2022-10-14 23:37:26.232580356 Z
915-
- - :approve
916-
- version
917-
- *9
918-
- - :approve
919-
- 1.6.0
920-
- *9
921789
- - :approve
922790
- Moq
923791
- :who: mocsharp
@@ -951,7 +819,7 @@
951819
- :who: mocsharp
952820
:why: MIT (https://github.com/nunit/nunit3-vs-adapter/raw/master/LICENSE)
953821
:versions:
954-
- 4.2.1
822+
- 4.3.0
955823
:when: 2022-10-14 23:37:28.273089349 Z
956824
- - :approve
957825
- Newtonsoft.Json
@@ -2053,7 +1921,7 @@
20531921
- :who: mocsharp
20541922
:why: MIT (https://github.com/coverlet-coverage/coverlet/raw/master/LICENSE)
20551923
:versions:
2056-
- 3.1.2
1924+
- 3.2.0
20571925
:when: 2022-10-14 23:38:33.099118125 Z
20581926
- - :approve
20591927
- prometheus-net
@@ -2319,21 +2187,21 @@
23192187
- :who: mocsharp
23202188
:why: BSD 3-Clause License (https://github.com/NLog/NLog/raw/dev/LICENSE.txt)
23212189
:versions:
2322-
- 5.0.4
2190+
- 5.0.5
23232191
:when: 2022-10-12 03:14:06.538744982 Z
23242192
- - :approve
23252193
- NLog.Extensions.Logging
23262194
- :who: mocsharp
23272195
:why: BSD 2-Clause Simplified License (https://github.com/NLog/NLog.Extensions.Logging/raw/master/LICENSE)
23282196
:versions:
2329-
- 5.0.4
2197+
- 5.1.0
23302198
:when: 2022-10-12 03:14:06.964203977 Z
23312199
- - :approve
23322200
- NLog.Web.AspNetCore
23332201
- :who: mocsharp
23342202
:why: BSD 3-Clause License (https://github.com/NLog/NLog.Web/raw/master/LICENSE)
23352203
:versions:
2336-
- 5.1.4
2204+
- 5.1.5
23372205
:when: 2022-10-12 03:14:07.396706995 Z
23382206
- - :approve
23392207
- AspNetCore.HealthChecks.MongoDb
@@ -2371,9 +2239,65 @@
23712239
- 6.23.1
23722240
:when: 2022-10-21 05:32:02.785856125 Z
23732241
- - :approve
2374-
- FluentAssertions
2375-
- :who: RemakingEden
2376-
:why: Apache-2.0 (https://github.com/fluentassertions/fluentassertions/raw/develop/LICENSE)
2242+
- Monai.Deploy.Messaging
2243+
- :who: mocsharp
2244+
:why: Apache-2.0 (https://github.com/Project-MONAI/monai-deploy-messaging/raw/main/LICENSE)
23772245
:versions:
2378-
- 6.8.0
2379-
:when: 2022-11-02 09:51:44.688882343 Z
2246+
- 0.1.9
2247+
:when: 2022-11-02 21:43:10.781625468 Z
2248+
- - :approve
2249+
- Monai.Deploy.Messaging.RabbitMQ
2250+
- :who: mocsharp
2251+
:why: Apache-2.0 (https://github.com/Project-MONAI/monai-deploy-messaging/raw/main/LICENSE)
2252+
:versions:
2253+
- 0.1.9
2254+
:when: 2022-11-02 21:43:20.975488411 Z
2255+
- - :approve
2256+
- Monai.Deploy.Storage
2257+
- :who: mocsharp
2258+
:why: Apache-2.0 (https://github.com/Project-MONAI/monai-deploy-messaging/raw/main/LICENSE)
2259+
:versions:
2260+
- 0.2.9
2261+
:when: 2022-11-02 21:43:46.964761113 Z
2262+
- - :approve
2263+
- Monai.Deploy.Storage.MinIO
2264+
- :who: mocsharp
2265+
:why: Apache-2.0 (https://github.com/Project-MONAI/monai-deploy-messaging/raw/main/LICENSE)
2266+
:versions:
2267+
- 0.2.9
2268+
:when: 2022-11-02 21:43:57.620687413 Z
2269+
- - :approve
2270+
- Monai.Deploy.Storage.S3Policy
2271+
- :who: mocsharp
2272+
:why: Apache-2.0 (https://github.com/Project-MONAI/monai-deploy-messaging/raw/main/LICENSE)
2273+
:versions:
2274+
- 0.2.9
2275+
:when: 2022-11-02 21:44:06.994266372 Z
2276+
- - :approve
2277+
- MongoDB.Bson
2278+
- :who: mocsharp
2279+
:why: Apache-2.0 (https://github.com/mongodb/mongo-csharp-driver/raw/master/License.txt)
2280+
:versions:
2281+
- 2.18.0
2282+
:when: 2022-11-02 21:44:41.801284907 Z
2283+
- - :approve
2284+
- MongoDB.Driver
2285+
- :who: mocsharp
2286+
:why: Apache-2.0 (https://github.com/mongodb/mongo-csharp-driver/raw/master/License.txt)
2287+
:versions:
2288+
- 2.18.0
2289+
:when: 2022-11-02 21:45:01.214220067 Z
2290+
- - :approve
2291+
- MongoDB.Driver.Core
2292+
- :who: mocsharp
2293+
:why: Apache-2.0 (https://github.com/mongodb/mongo-csharp-driver/raw/master/License.txt)
2294+
:versions:
2295+
- 2.18.0
2296+
:when: 2022-11-02 21:45:23.777282609 Z
2297+
- - :approve
2298+
- MongoDB.Libmongocrypt
2299+
- :who: mocsharp
2300+
:why: Apache-2.0 (https://github.com/mongodb/mongo-csharp-driver/raw/master/License.txt)
2301+
:versions:
2302+
- 1.6.0
2303+
:when: 2022-11-02 21:45:54.431951720 Z

0 commit comments

Comments
 (0)