Security scanners

Functions of the tools module at v0.3.2. Each returns what a command runs in; import it with import * as tools from "tools".

trivy

Trivy, aquasec/trivy:0.74.0 by default: vulnerabilities, misconfigurations and secrets in a filesystem, a repository or an image. It prints no progress bar (TRIVY_NO_PROGRESS=true).

trivy(
  --image: Environment = #aquasec/trivy:0.74.0,
  --severity: String | Null = null,
  --exit_code: String | Null = null,
  --cache_dir: String | Null = null,
  --with: Array<Record<env: Map<String>, volumes: Array<String>>> = [],
  --extra_env: Map<String> = {}
): Runnable

Without --cache_dir, every run downloads the vulnerability database.

Parameters

• --image The image to run; another release is passed as image = #aquasec/trivy:<tag>.
• --severity TRIVY_SEVERITY, e.g. "HIGH,CRITICAL".
• --exit_code TRIVY_EXIT_CODE: the exit code when something is found, e.g. "1" to fail a build.
• --cache_dir Host directory mounted at /cache; the databases are kept in /cache/trivy (TRIVY_CACHE_DIR).
• --with Setups of other tools this environment should also carry: registry_setup, docker_setup.
• --extra_env Any other variable; below --with and the named parameters.

Returns Runnable: The environment, for command { "trivy" } on ... or $[...].

Image aquasec/trivy:0.74.0

Command words trivy: import command { "trivy" } from "tools"

lask eval trivy --severity HIGH,CRITICAL --exit_code 1

lib/security.lask

gitleaks

Gitleaks, zricethezav/gitleaks:v8.30.1 by default: secrets in the project's files and Git history. The mounted project is trusted by Git (safe.directory), so its history can be read.

gitleaks(
  --image: Environment = #zricethezav/gitleaks:v8.30.1,
  --with: Array<Record<env: Map<String>, volumes: Array<String>>> = [],
  --extra_env: Map<String> = {}
): Runnable

Parameters

• --image The image to run; another release is passed as image = #zricethezav/gitleaks:<tag>.
• --with Setups of other tools this environment should also carry.
• --extra_env Any other variable; below --with.

Returns Runnable: The environment, for command { "gitleaks" } on ... or $[...].

Image zricethezav/gitleaks:v8.30.1

Command words gitleaks: import command { "gitleaks" } from "tools"

lask eval gitleaks

lib/security.lask

checkov

Checkov, bridgecrew/checkov:3.3.19 by default: misconfigurations in Terraform, CloudFormation, Kubernetes manifests, Dockerfiles and workflows.

checkov(
  --image: Environment = #bridgecrew/checkov:3.3.19,
  --api_key: String | Null = <secret>,
  --with: Array<Record<env: Map<String>, volumes: Array<String>>> = [],
  --extra_env: Map<String> = {}
): Runnable

Parameters

• --image The image to run; another release is passed as image = #bridgecrew/checkov:<tag>.
• --api_key!! BC_API_KEY, for the Prisma Cloud platform; masked in the command log.
• --with Setups of other tools this environment should also carry.
• --extra_env Any other variable; below --with and the named parameters.

Returns Runnable: The environment, for command { "checkov" } on ... or $[...].

Image bridgecrew/checkov:3.3.19

Command words checkov: import command { "checkov" } from "tools"

lask eval checkov

lib/security.lask

grype

Grype, Anchore's vulnerability scanner.

grype(
  --cache_dir: String | Null = null,
  --with: Array<Record<env: Map<String>, volumes: Array<String>>> = [],
  --extra_env: Map<String> = {}
): Runnable

Anchore's images have no shell, so the image is built from lib/images/anchore/Dockerfile, which copies grype v0.119.0 and syft v1.52.0 onto Alpine: it takes no --image, and lask sync builds it. Grype checks for no update (GRYPE_CHECK_FOR_APP_UPDATE=false).

Without --cache_dir, every run downloads the vulnerability database.

Parameters

• --cache_dir Host directory mounted at /cache; the database is kept in /cache/grype (GRYPE_DB_CACHE_DIR).
• --with Setups of other tools this environment should also carry: registry_setup, docker_setup.
• --extra_env Any other variable; below --with and the named parameters.

Returns Runnable: The environment, for command { "grype" } on ... or $[...].

Image recipe lib/images/anchore/Dockerfile

Command words grype, syft: import command { "grype", "syft" } from "tools"

lask eval grype --cache_dir /tmp/cache

lib/security.lask

syft

Syft, Anchore's SBOM generator, in the image of grype. It checks for no update (SYFT_CHECK_FOR_APP_UPDATE=false).

syft(
  --with: Array<Record<env: Map<String>, volumes: Array<String>>> = [],
  --extra_env: Map<String> = {}
): Runnable

Parameters

• --with Setups of other tools this environment should also carry: registry_setup, docker_setup.
• --extra_env Any other variable; below --with.

Returns Runnable: The environment, for command { "syft" } on ... or $[...].

Image recipe lib/images/anchore/Dockerfile

Command words grype, syft: import command { "grype", "syft" } from "tools"

lask eval syft

lib/security.lask

semgrep

Semgrep, semgrep/semgrep:1.178.0 by default. It sends no metrics and checks for no update (SEMGREP_SEND_METRICS=off, SEMGREP_ENABLE_VERSION_CHECK=0). The mounted project is trusted by Git (safe.directory), since Semgrep lists the files to scan through it.

semgrep(
  --image: Environment = #semgrep/semgrep:1.178.0,
  --app_token: String | Null = <secret>,
  --with: Array<Record<env: Map<String>, volumes: Array<String>>> = [],
  --extra_env: Map<String> = {}
): Runnable

Parameters

• --image The image to run; another release is passed as image = #semgrep/semgrep:<tag>.
• --app_token!! SEMGREP_APP_TOKEN, for Semgrep AppSec Platform; masked in the command log.
• --with Setups of other tools this environment should also carry.
• --extra_env Any other variable; below --with and the named parameters.

Returns Runnable: The environment, for command { "semgrep" } on ... or $[...].

Image semgrep/semgrep:1.178.0

Command words semgrep: import command { "semgrep" } from "tools"

lask eval semgrep

lib/security.lask