pyrox.dev
lol
sysdig-cli-scanner: init at 1.13.2
Co-authored-by: Alexis Hildebrandt <afh@surryhill.net>
+55
pkgs/by-name/sy/sysdig-cli-scanner/package.nix
+55
pkgs/by-name/sy/sysdig-cli-scanner/package.nix
···
1
+
{
2
+
stdenv,
3
+
lib,
4
+
fetchurl,
5
+
makeWrapper,
6
+
}:
7
+
let
8
+
versionMetadata = import ./sysdig-cli-scanner.versions.nix;
9
+
fetchForSystem = versionMetadata.${stdenv.system} or (throw "unsupported system ${stdenv.system}");
10
+
in
11
+
stdenv.mkDerivation {
12
+
pname = "sysdig-cli-scanner";
13
+
version = versionMetadata.version;
14
+
15
+
src = fetchurl { inherit (fetchForSystem) url hash; };
16
+
17
+
nativeBuildInputs = [ makeWrapper ];
18
+
19
+
dontUnpack = true;
20
+
21
+
installPhase = ''
22
+
runHook preInstall
23
+
24
+
install -Dm755 -T $src $out/bin/sysdig-cli-scanner
25
+
26
+
wrapProgram $out/bin/sysdig-cli-scanner \
27
+
--add-flags --dbpath="\$HOME/.cache/sysdig-cli-scanner/"
28
+
29
+
runHook postInstall
30
+
'';
31
+
32
+
passthru.updateScript = ./update.sh;
33
+
34
+
meta = with lib; {
35
+
description = "Tool for scanning container images and directories using Sysdig";
36
+
longDescription = ''
37
+
The Sysdig Vulnerability CLI Scanner, sysdig-cli-scanner, is a versatile tool designed to
38
+
manually scan container images and directories, whether they are located locally or remotely.
39
+
Depending on your specific use case, you have the flexibility to execute sysdig-cli-scanner
40
+
in Vulnerability Management (VM) mode for image scanning or Infrastructure as Code (IaC) mode
41
+
for scanning directories.
42
+
'';
43
+
homepage = "https://docs.sysdig.com/en/docs/installation/sysdig-secure/install-vulnerability-cli-scanner/";
44
+
mainProgram = "sysdig-cli-scanner";
45
+
license = licenses.unfreeRedistributable;
46
+
maintainers = with maintainers; [ tembleking ];
47
+
platforms = [
48
+
"x86_64-linux"
49
+
"aarch64-linux"
50
+
"x86_64-darwin"
51
+
"aarch64-darwin"
52
+
];
53
+
sourceProvenance = with sourceTypes; [ binaryNativeCode ];
54
+
};
55
+
}
+23
pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
+23
pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
···
1
+
{
2
+
version = "1.13.2";
3
+
4
+
x86_64-linux = {
5
+
url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.13.2/linux/amd64/sysdig-cli-scanner";
6
+
hash = "sha256-nFQ+xDiB7CA9mfQlRiTH/FvyZMKZ0YH8Gzn4ZuZ/Ucc=";
7
+
};
8
+
9
+
aarch64-linux = {
10
+
url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.13.2/linux/arm64/sysdig-cli-scanner";
11
+
hash = "sha256-IscMTVzEbWImFZa7uXNp2K6Gplnq2LZoVPoAo5oIZ1U=";
12
+
};
13
+
14
+
x86_64-darwin = {
15
+
url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.13.2/darwin/amd64/sysdig-cli-scanner";
16
+
hash = "sha256-Xgip9cquafpRuYcXnnCF5ptFi774EocBZ535b/LzXUQ=";
17
+
};
18
+
19
+
aarch64-darwin = {
20
+
url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.13.2/darwin/arm64/sysdig-cli-scanner";
21
+
hash = "sha256-l/u8UV9O5/mFrNHpyIaKvXbVCQ+Fh6binJLv7MCHrtM=";
22
+
};
23
+
}
+56
pkgs/by-name/sy/sysdig-cli-scanner/update.sh
+56
pkgs/by-name/sy/sysdig-cli-scanner/update.sh
···
1
+
#! /usr/bin/env nix-shell
2
+
#! nix-shell -i bash -p bash curl jq
3
+
4
+
set -euo pipefail
5
+
6
+
LATEST_VERSION=$(curl -L -s https://download.sysdig.com/scanning/sysdig-cli-scanner/latest_version.txt)
7
+
SUPPORTED_OPERATING_SYSTEMS=("linux" "darwin")
8
+
SUPPORTED_ARCHITECTURES=("x86_64" "aarch64")
9
+
SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
10
+
VERSIONS_FILE="${SCRIPT_DIR}/sysdig-cli-scanner.versions.nix"
11
+
12
+
main() {
13
+
echo "{" > "$VERSIONS_FILE"
14
+
echo " version = \"${LATEST_VERSION}\";" >> "$VERSIONS_FILE"
15
+
for os in "${SUPPORTED_OPERATING_SYSTEMS[@]}"; do
16
+
for arch in "${SUPPORTED_ARCHITECTURES[@]}"; do
17
+
formatted_arch=$(formatArchitectureForURL "$arch")
18
+
download_url="https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/${LATEST_VERSION}/${os}/${formatted_arch}/sysdig-cli-scanner"
19
+
file_hash=$(fetchFileHash "$download_url")
20
+
appendToVersionsFile "$VERSIONS_FILE" "$arch" "$os" "$download_url" "$file_hash"
21
+
done
22
+
done
23
+
echo "}" >> "$VERSIONS_FILE"
24
+
}
25
+
26
+
formatArchitectureForURL() {
27
+
local architecture="$1"
28
+
case "$architecture" in
29
+
x86_64) echo "amd64" ;;
30
+
aarch64) echo "arm64" ;;
31
+
*) echo "Unsupported architecture: $architecture" >&2; return 1 ;;
32
+
esac
33
+
}
34
+
35
+
fetchFileHash() {
36
+
local url="$1"
37
+
nix store prefetch-file --json "$url" | jq -r .hash
38
+
}
39
+
40
+
appendToVersionsFile() {
41
+
local file="$1"
42
+
local architecture="$2"
43
+
local operating_system="$3"
44
+
local url="$4"
45
+
local hash="$5"
46
+
cat >> "$file" << EOF
47
+
48
+
${architecture}-${operating_system} = {
49
+
url = "$url";
50
+
hash = "$hash";
51
+
};
52
+
EOF
53
+
}
54
+
55
+
main
56
+