snyk-docker-plugin/dist/static.js

Snyk CLI docker plugin

"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.analyzeStatically = void 0;
const Debug = require("debug");
const analyzer = require("./analyzer");
const image_inspector_1 = require("./analyzer/image-inspector");
const dependency_tree_1 = require("./dependency-tree");
const error_utils_1 = require("./error-utils");
const image_1 = require("./extractor/image");
const fetch_registry_provenance_attestations_1 = require("./extractor/fetch-registry-provenance-attestations");
const oci_distribution_metadata_1 = require("./extractor/oci-distribution-metadata");
const option_utils_1 = require("./option-utils");
const parser_1 = require("./parser");
const response_builder_1 = require("./response-builder");
const types_1 = require("./types");
const debug = Debug("snyk");
async function analyzeStatically(targetImage, dockerfileAnalysis, imageType, imagePath, globsToFind, options, imageName) {
    var _a, _b;
    const totalStart = Date.now();
    const staticAnalysis = await analyzer.analyzeStatically(targetImage, dockerfileAnalysis, imageType, imagePath, globsToFind, options);
    const depTreeStart = Date.now();
    const parsedAnalysisResult = (0, parser_1.parseAnalysisResults)(targetImage, staticAnalysis);
    /** @deprecated Should try to build a dependency graph instead. */
    const dependenciesTree = (0, dependency_tree_1.buildTree)(targetImage, parsedAnalysisResult.packageFormat, parsedAnalysisResult.depInfosList, parsedAnalysisResult.targetOS);
    const analysis = {
        ...staticAnalysis,
        depTree: dependenciesTree,
        imageId: parsedAnalysisResult.imageId,
        imageLayers: parsedAnalysisResult.imageLayers,
        packageFormat: parsedAnalysisResult.packageFormat,
    };
    if (imageType === types_1.ImageType.Identifier &&
        (!analysis.attestations || analysis.attestations.length === 0)) {
        try {
            const { hostname, imageName: repo, tag, } = (0, image_inspector_1.extractImageDetails)(targetImage);
            analysis.attestations = await (0, fetch_registry_provenance_attestations_1.fetchAttestationsFromRegistry)({
                registryBase: hostname,
                repo,
                imageReference: tag,
                username: options.username,
                password: options.password,
                platform: (0, fetch_registry_provenance_attestations_1.parsePlatform)(options.platform),
            });
        }
        catch (error) {
            // Best-effort: provenance is optional; never fail the scan over it.
            debug(`[provenance] failed to fetch attestations from registry for ${targetImage}: ${(0, error_utils_1.getErrorMessage)(error)}`);
        }
    }
    const excludeBaseImageVulns = (0, option_utils_1.isTrue)(options["exclude-base-image-vulns"]);
    const names = (0, image_1.getImageNames)(options, imageName);
    let ociDistributionMetadata;
    if (options.imageNameAndTag && ((_a = options.digests) === null || _a === void 0 ? void 0 : _a.manifest)) {
        ociDistributionMetadata = (0, oci_distribution_metadata_1.constructOCIDisributionMetadata)({
            imageName: options.imageNameAndTag,
            manifestDigest: options.digests.manifest,
            indexDigest: options.digests.index,
        });
    }
    const response = await (0, response_builder_1.buildResponse)(analysis, dockerfileAnalysis, excludeBaseImageVulns, names, ociDistributionMetadata, options);
    const depTreeBuildingMs = Date.now() - depTreeStart;
    const totalMs = Date.now() - totalStart;
    const timings = {
        ...staticAnalysis.timings,
        depTreeBuildingMs,
        totalMs,
    };
    return {
        ...response,
        analytics: [
            ...((_b = response.analytics) !== null && _b !== void 0 ? _b : []),
            {
                name: "containerPluginTimings",
                data: timings,
            },
        ],
    };
}
exports.analyzeStatically = analyzeStatically;
//# sourceMappingURL=static.js.map