Scan code, images and the supply chain

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Vaardigheden in dit hoofdstuk

Code- en supply-chain-scans — 8

Trivy — the all-in-one scanner

trivy finds CVEs, misconfigurations, secrets and licenses in images, folders, repos, IaC files, clusters and SBOMs.

$trivy fs --scanners vuln,secret,misconfig .
$trivy config infra/
$trivy image --exit-code 1 --severity CRITICAL --ignore-unfixed ghcr.io/s0sta/shop:1.4.0
$trivy k8s --report summary

Security checklist:

Fail the build on CRITICAL (and later HIGH) with a fix available.
Every ignore has a reason and an end date (exp:).

8.2

Syft — the SBOM maker

syft lists every package in an image or folder as an SBOM (CycloneDX, SPDX), so you can answer "are we affected?" in minutes.

$syft ghcr.io/s0sta/shop:1.4.0 -o cyclonedx-json=shop.cdx.json
$jq -r '.components[] | select(.name|test("log4j")) | .name + " " + .version' shop.cdx.json

8.3

Grype — CVEs from images and SBOMs

grype scans images and SBOMs for known vulnerabilities; re-scan old SBOMs every night when new CVEs appear.

$grype sbom:shop.cdx.json --only-fixed
$grype ghcr.io/s0sta/shop:1.4.0 --fail-on high

8.4

Cosign — sign and verify images

cosign signs image digests (keyless with the CI identity, or with a key in a KMS) and attaches SBOM and provenance attestations; clusters verify before running.

$cosign sign --yes ghcr.io/s0sta/shop@sha256:4a5b…
$cosign verify ghcr.io/s0sta/shop:1.4.0 --certificate-identity-regexp '^https://github.com/s0sta/' --certificate-oidc-issuer https://token.actions.githubusercontent.com
$cosign attest --yes --type cyclonedx --predicate shop.cdx.json ghcr.io/s0sta/shop@sha256:4a5b…

Security checklist:

Sign digests, not tags; verify identity AND issuer.
Enforce signatures in the cluster (Kyverno or policy-controller).

8.5

Gitleaks — find secrets in Git

gitleaks finds keys, tokens and passwords in the whole Git history and in staged changes (pre-commit).

$gitleaks git -v --redact .
$gitleaks protect --staged --redact

Security checklist:

Pre-commit hook + CI job + GitHub push protection.
A found secret: rotate first, then clean history.

8.6

Semgrep — static code analysis (SAST)

semgrep matches code patterns (injection, unsafe functions, weak crypto) in 30+ languages; rules are readable YAML.

$semgrep scan --config p/owasp-top-ten --error .
$semgrep scan --config p/default --baseline-commit origin/main
$semgrep -e 'yaml.load($X)' -l python .

8.7

SonarQube — code quality and the quality gate

sonar-scanner sends code to SonarQube / SonarQube Cloud: bugs, vulnerabilities, hotspots, coverage, and a quality gate that can block the merge.

$sonar-scanner -Dsonar.host.url=http://sonar.lab.local:9000 -Dsonar.qualitygate.wait=true

8.8

ZAP — test the running app (DAST)

ZAP crawls and scans a running web app or API from the outside: missing headers, cookie flags, XSS, SQL injection.

$docker run --rm -v "$PWD:/zap/wrk:rw" -t zaproxy/zap-stable zap-baseline.py -t https://staging.example.com -r baseline.html
$docker run --rm -v "$PWD:/zap/wrk:rw" -t zaproxy/zap-stable zap-api-scan.py -t https://staging.example.com/openapi.json -f openapi

Security checklist:

Baseline (passive) scan on every PR environment; full active scan only on test systems you own.

8.9

Put them in one pipeline

The order in a typical secure pipeline:

Stage	Tools	Fails the build when
Pre-commit	`gitleaks`, `terraform fmt`	a secret is staged
Pull request	`semgrep`, `trivy` fs + config, `sonar-scanner`	new HIGH/CRITICAL finding, red quality gate
Build	`docker`, `syft`, `trivy` image or `grype`	CRITICAL CVE with a fix
Release	`cosign` sign + attest	—
Deploy	Kyverno / policy-controller	image not signed by the pipeline
After deploy	`zap` baseline, nightly re-scan of SBOMs	new FAIL rule / new CVE

Op het werk

Start strict only on new code and CRITICAL findings; teams accept gates that are fair. Make them stricter step by step.

Alle commando's in dit hoofdstuk