├── .github ├── CODEOWNERS ├── dependabot.yml └── workflows │ └── jenkins-security-scan.yml ├── docs └── images │ ├── workflow.png │ ├── build_options.png │ ├── build_report.png │ ├── build_summary.png │ └── freestyle_build_step.png ├── src └── main │ ├── webapp │ ├── images │ │ └── anchore.png │ ├── help │ │ ├── help-Annotations.html │ │ ├── help-OverrideAEURL.html │ │ ├── help-OverrideAEAccount.html │ │ └── help-OverrideAECredentials.html │ ├── css │ │ └── anchore.css │ └── js │ │ └── renderOutput.js │ ├── resources │ ├── com │ │ └── anchore │ │ │ └── jenkins │ │ │ └── plugins │ │ │ └── anchore │ │ │ ├── AnchoreBuilder │ │ │ ├── help-engineurl.html │ │ │ ├── help-engineaccount.html │ │ │ ├── help-enginepass.html │ │ │ ├── help-engineuser.html │ │ │ ├── help-anchoreioPass.html │ │ │ ├── help-debug.html │ │ │ ├── help-engineRetryInterval.html │ │ │ ├── help-anchoreioUser.html │ │ │ ├── help-engineRetries.html │ │ │ ├── help-forceAnalyze.html │ │ │ ├── help-bailOnFail.html │ │ │ ├── help-bailOnPluginFail.html │ │ │ ├── help-policyBundleId.html │ │ │ ├── help-anchoreui.html │ │ │ ├── help-autoSubscribeTagUpdates.html │ │ │ ├── help-name.html │ │ │ ├── help-excludeFromBaseImage.html │ │ │ ├── global.jelly │ │ │ └── config.jelly │ │ │ ├── Annotation │ │ │ └── config.jelly │ │ │ ├── AnchoreAction │ │ │ ├── summary.jelly │ │ │ └── index.jelly │ │ │ └── AnchoreProjectAction │ │ │ ├── detailGraph.jelly │ │ │ ├── jobMain.jelly │ │ │ └── floatingBox.jelly │ └── index.jelly │ └── java │ └── com │ └── anchore │ └── jenkins │ └── plugins │ └── anchore │ ├── Util.java │ ├── Annotation.java │ ├── ConsoleLog.java │ ├── BuildConfig.java │ ├── AnchoreAction.java │ ├── AnchoreProjectAction.java │ ├── AnchoreBuilder.java │ └── BuildWorker.java ├── .gitignore ├── Makefile ├── TESTING.md ├── pom.xml ├── README.md └── LICENSE /.github/CODEOWNERS: -------------------------------------------------------------------------------- 1 | * @bradleyjones 2 | -------------------------------------------------------------------------------- /docs/images/workflow.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jenkinsci/anchore-container-scanner-plugin/master/docs/images/workflow.png -------------------------------------------------------------------------------- /docs/images/build_options.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jenkinsci/anchore-container-scanner-plugin/master/docs/images/build_options.png -------------------------------------------------------------------------------- /docs/images/build_report.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jenkinsci/anchore-container-scanner-plugin/master/docs/images/build_report.png -------------------------------------------------------------------------------- /docs/images/build_summary.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jenkinsci/anchore-container-scanner-plugin/master/docs/images/build_summary.png -------------------------------------------------------------------------------- /src/main/webapp/images/anchore.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jenkinsci/anchore-container-scanner-plugin/master/src/main/webapp/images/anchore.png -------------------------------------------------------------------------------- /docs/images/freestyle_build_step.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jenkinsci/anchore-container-scanner-plugin/master/docs/images/freestyle_build_step.png -------------------------------------------------------------------------------- /src/main/resources/com/anchore/jenkins/plugins/anchore/AnchoreBuilder/help-engineurl.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | Anchore Enterprise URL 4 | 5 |
6 | -------------------------------------------------------------------------------- /src/main/resources/com/anchore/jenkins/plugins/anchore/AnchoreBuilder/help-engineaccount.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | Anchore Enterprise account 4 | 5 |
6 | -------------------------------------------------------------------------------- /src/main/resources/com/anchore/jenkins/plugins/anchore/AnchoreBuilder/help-enginepass.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | Password of the Anchore Enterprise user 4 | 5 |
6 | -------------------------------------------------------------------------------- /src/main/resources/com/anchore/jenkins/plugins/anchore/AnchoreBuilder/help-engineuser.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | Username of the Anchore Enterprise user 4 | 5 |
6 | -------------------------------------------------------------------------------- /src/main/webapp/help/help-Annotations.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | Annotations in key-value form to be associated with the image added to Anchore Enterprise 4 | 5 |
6 | -------------------------------------------------------------------------------- /src/main/resources/com/anchore/jenkins/plugins/anchore/AnchoreBuilder/help-anchoreioPass.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | Your password for the associated username on https://anchore.io 4 | 5 |
6 | -------------------------------------------------------------------------------- /src/main/resources/com/anchore/jenkins/plugins/anchore/AnchoreBuilder/help-debug.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | If selected, the plugin will output DEBUG level messages to console log. 4 | 5 |
6 | -------------------------------------------------------------------------------- /src/main/resources/com/anchore/jenkins/plugins/anchore/AnchoreBuilder/help-engineRetryInterval.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | Interval between polling attempts (in seconds) for the Anchore Enterprise. 4 | 5 |
6 | -------------------------------------------------------------------------------- /.github/dependabot.yml: -------------------------------------------------------------------------------- 1 | version: 2 2 | updates: 3 | - package-ecosystem: maven 4 | directory: "/" 5 | schedule: 6 | interval: "daily" 7 | open-pull-requests-limit: 10 8 | commit-message: 9 | prefix: "feat" 10 | -------------------------------------------------------------------------------- /src/main/resources/index.jelly: -------------------------------------------------------------------------------- 1 | 2 | 5 |
6 | This plugin provides container image scanning using Anchore Enterprise 7 |
8 | -------------------------------------------------------------------------------- /src/main/resources/com/anchore/jenkins/plugins/anchore/AnchoreBuilder/help-anchoreioUser.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | Your username on https://anchore.io that has access to a custom policy bundle to sync with your local anchore installation 4 | 5 |
6 | -------------------------------------------------------------------------------- /src/main/webapp/help/help-OverrideAEURL.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | Override plugin's global settings for Anchore Enterprise URL. The override is applicable only to builds in this job and does not change 4 | the plugin wide global settings. 5 | 6 |
7 | -------------------------------------------------------------------------------- /src/main/webapp/help/help-OverrideAEAccount.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | Override plugin's global settings for Anchore Enterprise account. The override is applicable only to builds in this job and does not change 4 | the plugin wide global settings. 5 | 6 |
7 | -------------------------------------------------------------------------------- /src/main/webapp/help/help-OverrideAECredentials.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | Override plugin's global settings for Anchore Enterprise username and password. The override is applicable only to builds in this job and 4 | does not change the global settings. 5 | 6 |
7 | -------------------------------------------------------------------------------- /src/main/resources/com/anchore/jenkins/plugins/anchore/AnchoreBuilder/help-engineRetries.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | Number of polling attempts to wait for the Anchore Enterprise operation to complete. Time between attempts is determined by the Retry Interval setting. 4 | 5 |
6 | -------------------------------------------------------------------------------- /src/main/resources/com/anchore/jenkins/plugins/anchore/AnchoreBuilder/help-forceAnalyze.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | If selected or set to 'true', the Anchore Container Image Scanner step will instruct Anchore Enterprise to force analyze the image. 4 | Default value: 'false' 5 | 6 |
7 | -------------------------------------------------------------------------------- /src/main/resources/com/anchore/jenkins/plugins/anchore/AnchoreBuilder/help-bailOnFail.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | If selected or set to 'true', the Anchore Container Image Scanner step will cause the build to fail if the policy evaluation result 4 | is FAIL. Default value: 'true' 5 | 6 |
7 | -------------------------------------------------------------------------------- /src/main/resources/com/anchore/jenkins/plugins/anchore/AnchoreBuilder/help-bailOnPluginFail.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | If selected or set to 'true', the Anchore Container Image Scanner step will cause the build to fail if the plugin encounters an 4 | error. Default value: 'true' 5 | 6 |
7 | -------------------------------------------------------------------------------- /src/main/resources/com/anchore/jenkins/plugins/anchore/AnchoreBuilder/help-policyBundleId.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | ID of the policy bundle on Anchore Enterprise to be used for policy evaluations. If empty, the policy bundle marked active on 4 | Anchore Enterprise will be used by default. 5 | 6 |
7 | -------------------------------------------------------------------------------- /src/main/resources/com/anchore/jenkins/plugins/anchore/AnchoreBuilder/help-anchoreui.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | Anchore Enterprise UI URL: The URL of the Anchore Enterprise dashboard. If this is set then links to the Anchore Enterprise UI will be displayed in the Anchore report seen within Jenkins. 4 | 5 |
6 | -------------------------------------------------------------------------------- /src/main/resources/com/anchore/jenkins/plugins/anchore/AnchoreBuilder/help-autoSubscribeTagUpdates.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | If selected or set to 'true', the Anchore Container Image Scanner step will instruct Anchore Enterprise to automatically begin watching 4 | the added tag for updates from registry. Default value: 'true' 5 | 6 |
7 | -------------------------------------------------------------------------------- /src/main/resources/com/anchore/jenkins/plugins/anchore/Annotation/config.jelly: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | *.class 2 | 3 | # Mobile Tools for Java (J2ME) 4 | .mtj.tmp/ 5 | 6 | # Package Files # 7 | *.jar 8 | *.war 9 | *.ear 10 | 11 | # virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml 12 | hs_err_pid* 13 | 14 | # build stuff 15 | target/ 16 | 17 | # IDE 18 | .idea 19 | *.iml 20 | 21 | # hpi:run data 22 | /work/ 23 | 24 | # OS 25 | .DS_Store 26 | -------------------------------------------------------------------------------- /src/main/webapp/css/anchore.css: -------------------------------------------------------------------------------- 1 | table { 2 | border-collapse: collapse; 3 | width: 100%; 4 | } 5 | 6 | th, td { 7 | text-align: left; 8 | padding: 8px; 9 | transition: all 0.3s; 10 | } 11 | 12 | tr:nth-child(even) { 13 | background-color: #eaf2f3 14 | } 15 | 16 | th { 17 | background-color: #3c7fe2;; 18 | color: #EEDC00; 19 | } 20 | 21 | tr td:hover { 22 | background: #5BC2E7; 23 | color: #FFFFFF; 24 | } -------------------------------------------------------------------------------- /src/main/resources/com/anchore/jenkins/plugins/anchore/AnchoreBuilder/help-name.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | Name of the file that contains a list of container images for anchore to analyze, evaluate policy, and run queries against. The 4 | format for each line is "imageId /path/to/Dockerfile", where the Dockerfile is optional. This file must be made available (created by 5 | a prior step) to Anchore Container Image Scanner plugin. 6 | 7 |
8 | -------------------------------------------------------------------------------- /src/main/resources/com/anchore/jenkins/plugins/anchore/AnchoreAction/summary.jelly: -------------------------------------------------------------------------------- 1 | 2 | 4 | 5 | 6 | Anchore Report (${it.gateStatus}) 7 | 8 | 9 | 10 | -------------------------------------------------------------------------------- /src/main/resources/com/anchore/jenkins/plugins/anchore/AnchoreProjectAction/detailGraph.jelly: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 |
8 | [Anchore trend chart] 9 |
10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /.github/workflows/jenkins-security-scan.yml: -------------------------------------------------------------------------------- 1 | name: Jenkins Security Scan 2 | 3 | on: 4 | push: 5 | branches: 6 | - master 7 | pull_request: 8 | types: [ opened, synchronize, reopened ] 9 | workflow_dispatch: 10 | 11 | permissions: 12 | security-events: write 13 | contents: read 14 | actions: read 15 | 16 | jobs: 17 | security-scan: 18 | uses: jenkins-infra/jenkins-security-scan/.github/workflows/jenkins-security-scan.yaml@v2 19 | with: 20 | java-cache: 'maven' # Optionally enable use of a build dependency cache. Specify 'maven' or 'gradle' as appropriate. 21 | # java-version: 21 # Optionally specify what version of Java to set up for the build, or remove to use a recent default. 22 | -------------------------------------------------------------------------------- /src/main/resources/com/anchore/jenkins/plugins/anchore/AnchoreBuilder/help-excludeFromBaseImage.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | If selected or set to 'true', any match in the Policy or Vulnerability results where Inherited From Base == true will be excluded from the final results tables. This will NOT affect the final policy evaluation status, but will remove inherited vulnerabilities from the final results. 4 | 5 | This is useful for filtering out inherited vulnerabilities from the final results, as they are not actionable for the image being scanned. However, it is important to note that inherited vulnerabilities are still important to understand the full risk profile of the image. 6 | 7 | Default value: 'false' 8 | 9 |
10 | -------------------------------------------------------------------------------- /Makefile: -------------------------------------------------------------------------------- 1 | .PHONY: build 2 | build: # Should be run in project root - results go in `target/` 3 | docker volume create --name maven-repo && \ 4 | docker run --rm -it \ 5 | -v maven-repo:/root/.m2 \ 6 | -v "${shell pwd}":/usr/src/mymaven \ 7 | -w /usr/src/mymaven \ 8 | maven:3.9.6-eclipse-temurin-17-focal \ 9 | mvn clean install 10 | 11 | 12 | .PHONY: run-jenkins 13 | run-jenkins: 14 | docker run -p 8080:8080 -p 50000:50000 --restart=on-failure -v jenkins_home:/var/jenkins_home jenkins/jenkins:lts-jdk17 15 | 16 | 17 | .PHONY: run-jenkins-oldest # The minimum version supported by the project 18 | run-jenkins-oldest: 19 | docker run -p 8080:8080 -p 50000:50000 --restart=on-failure -v jenkins_home:/var/jenkins_home jenkins/jenkins:2.426.3-lts-jdk11 20 | -------------------------------------------------------------------------------- /src/main/resources/com/anchore/jenkins/plugins/anchore/AnchoreProjectAction/jobMain.jelly: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 |
12 | 13 | -------------------------------------------------------------------------------- /src/main/resources/com/anchore/jenkins/plugins/anchore/AnchoreProjectAction/floatingBox.jelly: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 |
8 |
9 | Anchore Trend 10 |
11 |
12 | [Anchore trend chart] 13 |
14 |
15 | Enlarge 16 |
17 |
18 | 19 | -------------------------------------------------------------------------------- /src/main/java/com/anchore/jenkins/plugins/anchore/Util.java: -------------------------------------------------------------------------------- 1 | package com.anchore.jenkins.plugins.anchore; 2 | 3 | import com.google.common.base.Splitter; 4 | import java.util.regex.Pattern; 5 | 6 | public class Util { 7 | 8 | // This is probably the slowest way of formatting strings, should do for now but please figure out a better way 9 | public static final Splitter IMAGE_LIST_SPLITTER = Splitter.on(Pattern.compile("\\s+")).trimResults().omitEmptyStrings(); 10 | 11 | public enum GATE_ACTION {STOP, WARN, GO, PASS, FAIL} 12 | 13 | public enum LOG_LEVEL {DEBUG, WARN, INFO, ERROR} 14 | 15 | public enum GATE_SUMMARY_COLUMN {Repo_Tag, Stop_Actions, Warn_Actions, Go_Actions, Final_Action, Stop_Action_Details} 16 | 17 | public enum API_VERSION {v1, v2} 18 | 19 | public static final API_VERSION GET_API_VERSION_FROM_URL(String engineUrl) { 20 | if (engineUrl.endsWith("v2") || engineUrl.endsWith("v2/")){ 21 | return API_VERSION.v2; 22 | } 23 | return API_VERSION.v1; 24 | } 25 | } 26 | -------------------------------------------------------------------------------- /src/main/java/com/anchore/jenkins/plugins/anchore/Annotation.java: -------------------------------------------------------------------------------- 1 | package com.anchore.jenkins.plugins.anchore; 2 | 3 | import hudson.Extension; 4 | import hudson.model.AbstractDescribableImpl; 5 | import hudson.model.Descriptor; 6 | import java.io.Serializable; 7 | import org.kohsuke.stapler.DataBoundConstructor; 8 | 9 | /** 10 | * Wrapper class for Anchore query 11 | */ 12 | public class Annotation extends AbstractDescribableImpl implements Serializable { 13 | 14 | private static final long serialVersionUID = 1L; 15 | 16 | private String key; 17 | private String value; 18 | 19 | public String getKey() { 20 | return key; 21 | } 22 | 23 | public String getValue() { 24 | return value; 25 | } 26 | 27 | @DataBoundConstructor 28 | public Annotation(String key, String value) { 29 | this.key = key; 30 | this.value = value; 31 | } 32 | 33 | @Extension 34 | public static class DescriptorImpl extends Descriptor { 35 | 36 | @Override 37 | public String getDisplayName() { 38 | return "Anchore Enterprise Image Annotation"; 39 | } 40 | } 41 | } 42 | -------------------------------------------------------------------------------- /src/main/resources/com/anchore/jenkins/plugins/anchore/AnchoreBuilder/global.jelly: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | -------------------------------------------------------------------------------- /src/main/java/com/anchore/jenkins/plugins/anchore/ConsoleLog.java: -------------------------------------------------------------------------------- 1 | package com.anchore.jenkins.plugins.anchore; 2 | 3 | import hudson.AbortException; 4 | import java.io.PrintStream; 5 | import java.util.Date; 6 | import java.util.logging.Logger; 7 | 8 | /** 9 | * Logging mechanism for outputting messages to Jenkins build console 10 | */ 11 | public class ConsoleLog { 12 | 13 | private static final Logger LOG = Logger.getLogger(ConsoleLog.class.getName()); 14 | private static final String LOG_FORMAT = "%1$tY-%1$tm-%1$tdT%1$tH:%1$tM:%1$tS.%1$tL %2$-6s %3$-15s %4$s"; 15 | 16 | private String name; 17 | private PrintStream logger; 18 | private boolean enableDebug; 19 | 20 | public PrintStream getLogger() { 21 | return logger; 22 | } 23 | 24 | public boolean isEnableDebug() { 25 | return enableDebug; 26 | } 27 | 28 | public ConsoleLog(String name, PrintStream logger, boolean enableDebug) throws AbortException { 29 | if (null != logger) { 30 | this.name = name; 31 | this.logger = logger; 32 | this.enableDebug = enableDebug; 33 | } else { 34 | LOG.warning("Cannot instantiate console logger"); 35 | throw new AbortException("Cannot instantiate console logger"); 36 | } 37 | } 38 | 39 | public void logDebug(String msg) { 40 | if (enableDebug) { 41 | logger.println(String.format(LOG_FORMAT, new Date(), "DEBUG", name, msg)); 42 | } 43 | } 44 | 45 | public void logDebug(String msg, Throwable t) { 46 | logDebug(msg); 47 | if (null != t) { 48 | t.printStackTrace(logger); 49 | } 50 | } 51 | 52 | public void logInfo(String msg) { 53 | logger.println(String.format(LOG_FORMAT, new Date(), "INFO", name, msg)); 54 | } 55 | 56 | public void logWarn(String msg) { 57 | logger.println(String.format(LOG_FORMAT, new Date(), "WARN", name, msg)); 58 | } 59 | 60 | public void logWarn(String msg, Throwable t) { 61 | logWarn(msg); 62 | if (null != t) { 63 | t.printStackTrace(logger); 64 | } 65 | } 66 | 67 | public void logError(String msg) { 68 | logger.println(String.format(LOG_FORMAT, new Date(), "ERROR", name, msg)); 69 | } 70 | 71 | public void logError(String msg, Throwable t) { 72 | logError(msg); 73 | if (null != t) { 74 | t.printStackTrace(logger); 75 | } 76 | } 77 | } 78 | -------------------------------------------------------------------------------- /TESTING.md: -------------------------------------------------------------------------------- 1 | # Local development testing 2 | ## Deploying a test build 3 | 4 | A build can be executed using the Makefile command `make build` 5 | 6 | It is important you bump the version in `pom.xml` prior to starting a build. 7 | 8 | The build will run some tests, linting and if all compliant will produce a `.hpi` file in `anchore-container-scanner-plugin/target/anchore-container-scanner.hpi` 9 | 10 | You can upload this .hpi file into Jenkins using the `Deploy Plugin` section in `Dashboard > Manage Jenkins > Plugins > Advanced settings`. 11 | 12 | > ** You *must* restart Jenkins for the new plugin to take effect, every time any plugin is changed** 13 | 14 | You should check that the Anchore Container Scanner plugin settings pane appears in the `Manage Jenkins > System` page. 15 | Sometimes the plugin install borks and you need to uninstall it within Jenkins (restart Jenkins), rebuild it (`make build`) and re-install it (restart Jenkins). 16 | 17 | ## Configuring the plugin within Jenkins 18 | 19 | Run Anchore Enterprise locally so it is available on your machines localhost. 20 | 21 | Within Jenkins go to `Manage Jenkins > System` and find the Anchore settings section. 22 | 23 | For `Anchore Enterprise URL` enter `http://host.docker.internal:8228/v2` 24 | 25 | Tick `Enable DEBUG logging` for testing as it helps troubleshooting. 26 | 27 | 28 | ## Setting up a test job 29 | 30 | Each job can have its own Enterprise override configuration. This can be useful if A/B testing APIs or other systems within Enterprise. 31 | 32 | From the Jenkins Dashboard click `New Item`, enter a name, then select `Freestyle project`. 33 | 34 | The way the Anchore plugin works, is by reading a line of image tags from a file, and sending those to Enterprise for analysis. By default this file is called `anchore_images`. 35 | 36 | This is usually populated by a real test workload, but we can mock it by adding a `Build step` of type `Execute Shell`. Then enter something like the following: 37 | 38 | ``` 39 | echo 'alpine:latest' > anchore_images 40 | echo 'node:5.5-slim' >> anchore_images 41 | ``` 42 | 43 | > These images must be pullable by Enterprise, so if they're private ensure you have registry credentials within Enterprise. Registry credentials within Enterprise will also help bypass the Docker pull rate limit. 44 | 45 | Then add a `Build Step` of `Anchore Container Image Scanner`, here you can override any of the default settings, but usually the default config will be enough. 46 | 47 | Save the new `Freestyle Job` and it will appear in the Dashboard. From here you can execute it by clicking `Build Now` 48 | 49 | Anchore will gate the Job based on if the images passed the specified/default policy. Once a build is complete a new tab called `Anchore Report` will appear in the left hand menu. 50 | -------------------------------------------------------------------------------- /src/main/resources/com/anchore/jenkins/plugins/anchore/AnchoreBuilder/config.jelly: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 |
34 | 35 |
36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | -------------------------------------------------------------------------------- /src/main/java/com/anchore/jenkins/plugins/anchore/BuildConfig.java: -------------------------------------------------------------------------------- 1 | package com.anchore.jenkins.plugins.anchore; 2 | 3 | 4 | import com.anchore.jenkins.plugins.anchore.Util.API_VERSION; 5 | import java.util.List; 6 | 7 | /** 8 | * Holder for all Anchore configuration - includes global and project level attributes. A convenience class for capturing a snapshot of 9 | * the config at the beginning of plugin execution and caching it for use during that specific execution 10 | */ 11 | public class BuildConfig { 12 | 13 | // Build configuration 14 | private String name; 15 | private String engineRetries; 16 | private String engineRetryInterval; 17 | private boolean bailOnFail; 18 | private boolean bailOnPluginFail; 19 | private String policyBundleId; 20 | private List annotations; 21 | private boolean autoSubscribeTagUpdates; 22 | private boolean forceAnalyze; 23 | private boolean excludeFromBaseImage; 24 | 25 | // Global configuration 26 | private boolean debug; 27 | private String anchoreui; 28 | private String engineurl; 29 | private String engineuser; 30 | private String enginepass; 31 | private String engineaccount; 32 | private boolean engineverify; 33 | private API_VERSION engineApiVersion; 34 | 35 | public BuildConfig(String name, String engineRetries, String engineRetryInterval, boolean bailOnFail, boolean bailOnPluginFail, 36 | String policyBundleId, List annotations, boolean autoSubscribeTagUpdates, boolean forceAnalyze, boolean excludeFromBaseImage, 37 | boolean debug, String anchoreui, String engineurl, String engineuser, String enginepass, String engineaccount, boolean engineverify) { 38 | this.name = name; 39 | this.engineRetries = engineRetries; 40 | this.engineRetryInterval = engineRetryInterval; 41 | this.bailOnFail = bailOnFail; 42 | this.bailOnPluginFail = bailOnPluginFail; 43 | this.policyBundleId = policyBundleId; 44 | this.annotations = annotations; 45 | this.autoSubscribeTagUpdates = autoSubscribeTagUpdates; 46 | this.forceAnalyze = forceAnalyze; 47 | this.excludeFromBaseImage = excludeFromBaseImage; 48 | this.debug = debug; 49 | this.anchoreui = anchoreui; 50 | this.engineurl = engineurl; 51 | this.engineuser = engineuser; 52 | this.enginepass = enginepass; 53 | this.engineaccount = engineaccount; 54 | this.engineverify = engineverify; 55 | this.engineApiVersion = Util.GET_API_VERSION_FROM_URL(engineurl); 56 | } 57 | 58 | public String getName() { 59 | return name; 60 | } 61 | 62 | public String getEngineRetries() { 63 | return engineRetries; 64 | } 65 | 66 | public String getEngineRetryInterval() { 67 | return engineRetryInterval; 68 | } 69 | 70 | public boolean getBailOnFail() { 71 | return bailOnFail; 72 | } 73 | 74 | public boolean getBailOnPluginFail() { 75 | return bailOnPluginFail; 76 | } 77 | 78 | public String getPolicyBundleId() { 79 | return policyBundleId; 80 | } 81 | 82 | public List getAnnotations() { 83 | return annotations; 84 | } 85 | 86 | public boolean getAutoSubscribeTagUpdates() { 87 | return autoSubscribeTagUpdates; 88 | } 89 | 90 | public boolean getForceAnalyze() { 91 | return forceAnalyze; 92 | } 93 | 94 | public boolean getExcludeFromBaseImage() { 95 | return excludeFromBaseImage; 96 | } 97 | 98 | public boolean getDebug() { 99 | return debug; 100 | } 101 | 102 | public String getAnchoreui() { 103 | return anchoreui; 104 | } 105 | 106 | public String getEngineurl() { 107 | return engineurl; 108 | } 109 | 110 | public String getEngineuser() { 111 | return engineuser; 112 | } 113 | 114 | public String getEnginepass() { 115 | return enginepass; 116 | } 117 | 118 | public String getEngineaccount() { 119 | return engineaccount; 120 | } 121 | 122 | public boolean getEngineverify() { 123 | return engineverify; 124 | } 125 | 126 | public API_VERSION getEngineApiVersion() { 127 | return engineApiVersion; 128 | } 129 | 130 | public void print(ConsoleLog consoleLog) { 131 | consoleLog.logInfo("[global] debug: " + String.valueOf(debug)); 132 | 133 | // Global or build properties 134 | consoleLog.logInfo("[build] engineurl: " + engineurl); 135 | consoleLog.logInfo("[build] engineuser: " + engineuser); 136 | consoleLog.logInfo("[build] enginepass: " + "****"); 137 | consoleLog.logInfo("[build] engineaccount: " + engineaccount); 138 | consoleLog.logInfo("[build] engineverify: " + String.valueOf(engineverify)); 139 | 140 | // Build properties 141 | consoleLog.logInfo("[build] name: " + name); 142 | consoleLog.logInfo("[build] engineRetries: " + engineRetries); 143 | consoleLog.logInfo("[build] engineRetryInterval: " + engineRetryInterval); 144 | consoleLog.logInfo("[build] policyBundleId: " + policyBundleId); 145 | if (null != annotations && !annotations.isEmpty()) { 146 | for (Annotation a : annotations) { 147 | consoleLog.logInfo("[build] annotation: " + a.getKey() + "=" + a.getValue()); 148 | } 149 | } 150 | consoleLog.logInfo("[build] bailOnFail: " + bailOnFail); 151 | consoleLog.logInfo("[build] bailOnPluginFail: " + bailOnPluginFail); 152 | } 153 | } 154 | -------------------------------------------------------------------------------- /src/main/resources/com/anchore/jenkins/plugins/anchore/AnchoreAction/index.jelly: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 21 | 22 | 23 | 24 | 25 | 42 | 43 | 44 | 45 | 46 | 47 |
48 | 49 | 50 | 61 | 62 | 63 |
64 |
65 | 66 |

Anchore Policy Evaluation Summary

67 | 68 | 69 | 72 | 73 | 74 |

Anchore Policy Evaluation Report

75 | 76 | 77 | 78 | 81 |
82 | 83 | 84 | 85 |
86 |

Anchore Image Query Report (${e.key})

87 | 88 | 89 | 92 |
93 | 94 | 95 | 96 |
97 |

Common Vulnerabilities and Exposures (CVE) List

98 | 99 | 100 | 103 |
104 | 105 |
106 |
107 | 108 | 109 | 110 |

Anchore Policy Evaluation Report

111 |