{"id":24504102,"url":"https://github.com/mawinkler/c1-cs-tmas","last_synced_at":"2025-03-15T08:24:39.621Z","repository":{"id":169752813,"uuid":"645203088","full_name":"mawinkler/c1-cs-tmas","owner":"mawinkler","description":"Containerized Trend Micro ASaaS client","archived":false,"fork":false,"pushed_at":"2023-05-26T12:44:29.000Z","size":6,"stargazers_count":0,"open_issues_count":0,"forks_count":3,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-01-21T23:23:45.017Z","etag":null,"topics":["artifact","container","scanning","trendmicro"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/mawinkler.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-05-25T06:32:01.000Z","updated_at":"2023-05-25T13:56:45.000Z","dependencies_parsed_at":null,"dependency_job_id":"4bf26b69-ca3e-4de4-a108-a31a503dd603","html_url":"https://github.com/mawinkler/c1-cs-tmas","commit_stats":null,"previous_names":["mawinkler/c1-cs-tmas"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mawinkler%2Fc1-cs-tmas","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mawinkler%2Fc1-cs-tmas/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mawinkler%2Fc1-cs-tmas/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/mawinkler%2Fc1-cs-tmas/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/mawinkler","download_url":"https://codeload.github.com/mawinkler/c1-cs-tmas/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243704373,"owners_count":20334145,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["artifact","container","scanning","trendmicro"],"created_at":"2025-01-21T23:21:14.357Z","updated_at":"2025-03-15T08:24:39.614Z","avatar_url":"https://github.com/mawinkler.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# TMAS Container\n\n## Description\n\n`tmas` is a CLI tool that performs open source vulnerability scanning and report generation for artifacts. It first takes the artifact that you wish to be scanned and generates a Software Bill of Materials (SBOM). The SBOM is then uploaded to Cloud One for processing, and a vulnerability report is returned to the CLI user.\n\nThis container is to ease the usage of tmas within pipelines. It can fail the pipeline run if a user defined a vulnerability threshold for the image is exceeded.\n\n## Getting Started\n\n1. Clone the repository.\n\n```sh\ngit clone https://github.com/mawinkler/c1-cs-tmas\n```\n\n2. Navigate to the directory.\n\n```sh\ncd c1-cs-tmas\n```\n\n3. Build the image.\n\n```sh\ndocker build -t tmas .\n```\n\n4. (Optional) Push the image to your registry.\n\n```sh\ndocker tag tmas registry:yourrepo/tmas:latest\ndocker push registry:yourrepo/tmas:latest\n```\n\n5. Create a scan.\n\nUsage:\n\n```sh\ndocker run --rm --name tmas \\\n  -e CLOUD_ONE_API_KEY=\u003cYOUR API KEY HERE\u003e \\\n  tmas [OPTION...] registry:\u003cYOUR ARTIFACT HERE\u003e\n```\n\nExamples:\n\n```sh\ndocker run --rm --name tmas \\\n  -e CLOUD_ONE_API_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxxx:xxxxxx... \\\n  tmas -t medium registry:public.ecr.aws/g1k6g7f0/shell:latest\n```\n\nOptions        | Description\n-------------- | ---------------------------\n`-e URL`       | Endpoint to use\n`-v`           | Be verbose\n`-r REGION`    | Cloud One region to use\n`-t THRESHOLD` | \u003c`any`, `critical`, `high`, `medium`, `low`\u003e\u003cbr\u003eSee below\n`-u username`  | Username for registry authentication \n`-p password`  | Password for registry authentication \n\nThreshold   | Description\n----------- | --------------------------------\n`any`       | Fail if any vulnerability\n`critical`  | Fail on critical vulnerabilities\n`high`      | Fail on high or higher (default)\n`medium`    | Fail on medium or higher\n`low`       | Fail on low or higher\n\nIf the vulnerability threshold is exceeded the container will exit with exit code `1`.\n\n\u003e ***Note:*** If you need to proxy to Cloud One simply add the documented environment variables to the docker run command.\n\n## AWS CodePipeline Example\n\nUsing the tmas container within a pipeline is simple. Here's an example for AWS CodeBuild:\n\n```yaml\n  ...\n  post_build:\n    commands:\n      # Create Repository if not exists\n      ...\n      # Push to ECR\n      ...\n\n      # Scan Image using tmas\n      - \u003e-\n        docker run --cap-drop ALL --rm --name tmas\n        -e CLOUD_ONE_API_KEY=${CLOUD_ONE_SCANNER_API_KEY}\n        mawinkler/tmas -t medium -u ${ECR_USERNAME} -p ${ECR_PASSWORD} registry:${REPOSITORY_URI}:${TAG} | tee findings.json\n      ...\n\nartifacts:\n  files:\n    - findings.json\n```\n\nFull example:\n\n```yaml\n---\nversion: 0.2\nphases:\n  install:\n    commands:\n      # Install aws-iam-authenticator and kubectl\n      - curl -sS -o aws-iam-authenticator https://amazon-eks.s3-us-west-2.amazonaws.com/1.12.7/2019-03-27/bin/linux/amd64/aws-iam-authenticator\n      - curl -sS -o kubectl https://storage.googleapis.com/kubernetes-release/release/$(curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt)/bin/linux/amd64/kubectl\n      - chmod +x ./kubectl ./aws-iam-authenticator\n      - export PATH=${PWD}/:${PATH}\n\n      # Install AWS CLI v2\n      - curl https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip -o ~/awscliv2.zip\n      - unzip -q ~/awscliv2.zip -d ~/\n      - ~/aws/install\n\n  pre_build:\n    commands:\n      # Dynamically set the image name in the deployment manifest\n      - TAG=${CODEBUILD_BUILD_NUMBER}\n      - echo ${REPOSITORY_URI}:${TAG}\n      - sed -i 's@CONTAINER_IMAGE@'\"${REPOSITORY_URI}:${TAG}\"'@' app-eks.yml\n      \n      # Set KUBECONFIG\n      - export KUBECONFIG=$HOME/.kube/config\n\n  build:\n    commands:\n      # Login Docker\n      - echo ${DOCKER_PASSWORD} | docker login --username ${DOCKER_USERNAME} --password-stdin\n\n      # Check Docker Hub rate limit\n      # - TOKEN=$(curl --user \"${DOCKER_USERNAME}:${DOCKER_PASSWORD}\" \"https://auth.docker.io/token?service=registry.docker.io\u0026scope=repository:ratelimitpreview/test:pull\" | jq -r .token)\n      # - echo $(curl --head -H \"Authorization:Bearer ${TOKEN}\" https://registry-1.docker.io/v2/ratelimitpreview/test/manifests/latest | grep -i rate)\n      \n      # Build the image\n      - docker build --tag ${REPOSITORY_URI}:${TAG} .\n\n      # Login to ECR\n      - ECR_USERNAME=AWS\n      - ECR_PASSWORD=$(aws ecr get-login-password --region ${AWS_DEFAULT_REGION})\n      - \u003e-\n        echo ${ECR_PASSWORD} | \n          docker login --username ${ECR_USERNAME} --password-stdin ${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_DEFAULT_REGION}.amazonaws.com\n\n  post_build:\n    commands:\n      # Create Repository if not exists\n      - \u003e-\n        aws ecr describe-repositories --repository-names ${REPOSITORY_URI##*/} ||\n        aws ecr create-repository --repository-name ${REPOSITORY_URI##*/} --image-scanning-configuration scanOnPush=true --region ${AWS_DEFAULT_REGION}\n\n      # Push to ECR\n      - docker tag ${REPOSITORY_URI}:${TAG} ${REPOSITORY_URI}:latest\n      - docker images\n      - docker push ${REPOSITORY_URI}:${TAG}\n      - docker push ${REPOSITORY_URI}:latest\n\n      # Scan Image using tmas\n      - \u003e-\n        docker run --cap-drop ALL --rm --name tmas\n        -e CLOUD_ONE_API_KEY=${CLOUD_ONE_SCANNER_API_KEY}\n        mawinkler/tmas -t medium -u ${ECR_USERNAME} -p ${ECR_PASSWORD} registry:${REPOSITORY_URI}:${TAG} | tee findings.json\n\n      # Assume Role to manage Kubernetes\n      - CREDENTIALS=$(aws sts assume-role --role-arn ${EKS_KUBECTL_ROLE_ARN} --role-session-name codebuild-kubectl --duration-seconds 900)\n      - export AWS_ACCESS_KEY_ID=\"$(echo ${CREDENTIALS} | jq -r '.Credentials.AccessKeyId')\"\n      - export AWS_SECRET_ACCESS_KEY=\"$(echo ${CREDENTIALS} | jq -r '.Credentials.SecretAccessKey')\"\n      - export AWS_SESSION_TOKEN=\"$(echo ${CREDENTIALS} | jq -r '.Credentials.SessionToken')\"\n      - export AWS_EXPIRATION=$(echo ${CREDENTIALS} | jq -r '.Credentials.Expiration')\n\n      # Update EKS KubeConfig\n      - aws eks update-kubeconfig --name ${EKS_CLUSTER_NAME}\n\n      # Deploy to EKS\n      - kubectl apply -f app-eks.yml\n      - printf '[{\"name\":\"c1-app-sec-uploader\",\"imageUri\":\"%s\"}]' ${REPOSITORY_URI}:${TAG} \u003e build.json\n\n\nartifacts:\n  files:\n    - build.json\n    - findings.json\n```\n\n## Support\n\nThis is an Open Source community project. Project contributors may be able to help, depending on their time and availability. Please be specific about what you're trying to do, your system, and steps to reproduce the problem.\n\nFor bug reports or feature requests, please [open an issue](../../issues). You are welcome to [contribute](#contribute).\n\nOfficial support from Trend Micro is not available. Individual contributors may be Trend Micro employees, but are not official support.\n\n## Contribute\n\nI do accept contributions from the community. To submit changes:\n\n1. Fork this repository.\n1. Create a new feature branch.\n1. Make your changes.\n1. Submit a pull request with an explanation of your changes or additions.\n\nI will review and work with you to release the code.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmawinkler%2Fc1-cs-tmas","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmawinkler%2Fc1-cs-tmas","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmawinkler%2Fc1-cs-tmas/lists"}