Add container vulnerability scanning for the built/published ACA-Py images.

[WadeBarnes]

PR #2076 added support for building and publishing ACA-Py images. The initial implementation just builds and publishes the images.

It would be a great enhancement to have these containers scanned on a regular basis (and possible during the builds) for vulnerabilities.

[WadeBarnes]

@ryjones, Does Hyperledger have any existing tools and processes for this? Are there any other projects doing this?

[ryjones]

@WadeBarnes I think you can choose from a lot of free ones, we don't have a policy

[swcurran]

Narrowing to container images seems to give this list. Sysdig and Snyk are the names I recognize, but not sure about which to use. Opinions?

Need to verify their use/pricing for open source projects.

[ryjones]

Snyk is available to us as an open source project for free, I think.

[pradeepp88]

I created an acapy image with the new Dockerfile from the docker folder, uploaded it to Dockerhub and scanned it with Snyk tool. It was showing to have lot of vulnerabilities arising from Debian-buster base image. The number of vulnerabilities went down drastically, when changing the base image from python:{python_version}-slim-buster to python:{python_version}-slim. Used Python version 3.8. The same is the case for all the slim-buster images.

[WadeBarnes]

@pradeepp88, Did you try it with Python 3.9? The new GHA workflows only produce images for Python 3.6 (for legacy test purposes) and Python 3.9. The Python 3.6 image is just being created to make side-by-side testing easier before testing the Python 3.9 image.

[WadeBarnes]

@pradeepp88, it would also be interesting to compare the results when using 3.9-slim-bullseye. We might need to switch base images. Thanks for trying this out.

[pradeepp88]

@WadeBarnes I have tested the images with python:3.9-slim-bullseye and found 0 critical vulnerabilities. I tested in both Qualys and Synk and got the same results. So created a PR #2105 to update the base images from slim-buster to slim-bullseye version. Please review.
Looking for feedback from the community on the vulnerability scanning tool to be used. I checked Snyk, it is good and matches the report generated by enterprise scanning tools. Thanks.

[swcurran]

Thanks @pradeepp88 — great stuff. Much appreciation for the work and conclusions.

[WadeBarnes]

thanks @pradeepp88, the related PR updating the base images has been merged.

[ryjones]

@WadeBarnes does #2417 address this completely?

[WadeBarnes]

Addressed with #2418