ogr icon indicating copy to clipboard operation
ogr copied to clipboard

add thoth security analysis

Open TomasTomecek opened this issue 2 years ago • 17 comments

Utilize https://github.com/thoth-station/thamos

TomasTomecek avatar Jun 29 '22 13:06 TomasTomecek

Build succeeded.

:heavy_check_mark: pre-commit SUCCESS in 2m 04s :heavy_check_mark: ogr-tests-rpm SUCCESS in 7m 10s :heavy_check_mark: ogr-tests-pip-deps SUCCESS in 6m 35s :heavy_check_mark: ogr-reverse-dep-packit-tests SUCCESS in 17m 04s

Sample analysis: https://thoth-station.ninja/search/advise/adviser-220630131041-a0de409d483ad409/packages

TomasTomecek avatar Jun 30 '22 13:06 TomasTomecek

Build failed.

:x: pre-commit TIMED_OUT in 30m 27s :heavy_check_mark: ogr-tests-rpm SUCCESS in 6m 21s :heavy_check_mark: ogr-tests-pip-deps SUCCESS in 6m 43s :heavy_check_mark: ogr-reverse-dep-packit-tests SUCCESS in 16m 30s

Build failed.

:x: pre-commit FAILURE in 2m 28s :heavy_check_mark: ogr-tests-rpm SUCCESS in 6m 15s :heavy_check_mark: ogr-tests-pip-deps SUCCESS in 6m 19s :heavy_check_mark: ogr-reverse-dep-packit-tests SUCCESS in 18m 27s

their TLS cert now expired, will continue with testing after my vacation

TomasTomecek avatar Jul 01 '22 08:07 TomasTomecek

recheck

TomasTomecek avatar Jul 01 '22 11:07 TomasTomecek

Build failed.

:x: pre-commit FAILURE in 3m 13s :heavy_check_mark: ogr-tests-rpm SUCCESS in 6m 44s :heavy_check_mark: ogr-tests-pip-deps SUCCESS in 6m 52s :heavy_check_mark: ogr-reverse-dep-packit-tests SUCCESS in 16m 56s

recheck

TomasTomecek avatar Jul 11 '22 08:07 TomasTomecek

Build failed.

:x: pre-commit FAILURE in 3m 20s :heavy_check_mark: ogr-tests-rpm SUCCESS in 6m 34s :heavy_check_mark: ogr-tests-pip-deps SUCCESS in 6m 34s :heavy_check_mark: ogr-reverse-dep-packit-tests SUCCESS in 13m 57s

Build failed.

:x: pre-commit FAILURE in 2m 44s :heavy_check_mark: ogr-tests-rpm SUCCESS in 6m 25s :heavy_check_mark: ogr-tests-pip-deps SUCCESS in 6m 16s :heavy_check_mark: ogr-reverse-dep-packit-tests SUCCESS in 13m 10s

Build succeeded.

:heavy_check_mark: pre-commit SUCCESS in 2m 16s :heavy_check_mark: ogr-tests-rpm SUCCESS in 6m 28s :heavy_check_mark: ogr-tests-pip-deps SUCCESS in 6m 08s :heavy_check_mark: ogr-reverse-dep-packit-tests SUCCESS in 11m 35s

This issue has been marked as stale because it hasn't seen any activity for the last 60 days.

Stale issues are closed after 14 days, unless the label is removed by a maintainer or someone comments on it.

This is done in order to ensure that open issues are still relevant.

Thank you for your contribution! :unicorn: :rocket: :robot:

(Note: issues labeled with pinned or EPIC are never marked as stale.)

stale[bot] avatar Sep 21 '22 00:09 stale[bot]

this is on my todo list and am planning to go back to this in November

TomasTomecek avatar Nov 14 '22 11:11 TomasTomecek

I didn't see the label change, just your last comment, I thought you meant November '23 :smile:

mfocko avatar Dec 15 '22 12:12 mfocko

*December

TomasTomecek avatar Dec 15 '22 12:12 TomasTomecek

These were the results I got locally:

latest analysis type

                                                                                                                 Application stack guidance                                                                                                                  
                                                                                                           ╷                                                                                                                   ╷                             
                   Link                                                                                    │ Message                                                                                                           │ Type                        
                  ═════════════════════════════════════════════════════════════════════════════════════════╪═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════╪═══════════                  
                   https://thoth-station.ninja/search/advise/adviser-221215120135-20858e1e52fed376/summary │ Results can be browsed in Thoth search                                                                            │ ✔️ INFO                      
                   https://thoth-station.ninja/j/cve_timestamp                                             │ CVE database of known vulnerabilities for Python packages was updated at '2022-12-15T00:00:06.283051'             │ ✔️ INFO                      
                   https://thoth-station.ninja/j/lax_version                                               │ No version range specifier for 'cryptography' found, it is recommended to specify version ranges in requirements  │ ⚠️ WARNING                   
                   https://thoth-station.ninja/j/lax_version                                               │ No version range specifier for 'deprecated' found, it is recommended to specify version ranges in requirements    │ ⚠️ WARNING                   
                   https://thoth-station.ninja/j/lax_version                                               │ No version range specifier for 'gitpython' found, it is recommended to specify version ranges in requirements     │ ⚠️ WARNING                   
                   https://thoth-station.ninja/j/lax_version                                               │ No version range specifier for 'pygithub' found, it is recommended to specify version ranges in requirements      │ ⚠️ WARNING                   
                   https://thoth-station.ninja/j/lax_version                                               │ No version range specifier for 'python-gitlab' found, it is recommended to specify version ranges in requirements │ ⚠️ WARNING                   
                   https://thoth-station.ninja/j/lax_version                                               │ No version range specifier for 'pyyaml' found, it is recommended to specify version ranges in requirements        │ ⚠️ WARNING                   
                   https://thoth-station.ninja/j/lax_version                                               │ No version range specifier for 'requests' found, it is recommended to specify version ranges in requirements      │ ⚠️ WARNING                   
                   https://thoth-station.ninja/j/lax_version                                               │ No version range specifier for 'urllib3' found, it is recommended to specify version ranges in requirements       │ ⚠️ WARNING                   
                   https://thoth-station.ninja/j/thoth_s2i                                                 │ It is recommended to use Thoth's s2i to have recommendations specific to runtime environment                      │ ✔️ INFO                      
                   https://thoth-station.ninja/j/py_version                                                │ No version of Python specified explicitly, assigning the one found in Thoth's configuration: '3.11'               │ ⚠️ WARNING                   
                   https://thoth-station.ninja/recommendation-types/                                       │ Using recommendation type 'latest'                                                                                │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ Resolving for runtime environment named 'fedora-37'                                                               │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ Resolving for operating system 'fedora' in version '37'                                                           │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ Resolving for Python version '3.11'                                                                               │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ Using platform 'linux-x86_64'                                                                                     │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ No constraints supplied to the resolution process                                                                 │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ Using supplied static source code analysis                                                                        │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ No containerized environment used                                                                                 │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ Using CPU family 6 model 142                                                                                      │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ No CUDA used                                                                                                      │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ No cuDNN used                                                                                                     │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ No OpenBLAS used                                                                                                  │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ No OpenMPI used                                                                                                   │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ No MKL used                                                                                                       │ ✔️ INFO                      
                   https://thoth-station.ninja/j/solved_sw_env                                             │ No observations found for 'fedora' in version '37' using Python '3.11'                                            │ ❌ ERROR                    
                   https://thoth-station.ninja/j/solved_sw_env                                             │ Consider using 'fedora' in version '34' with Python 3.9                                                           │ ❌ ERROR                    
                   https://thoth-station.ninja/j/solved_sw_env                                             │ Consider using 'fedora' in version '35' with Python 3.10                                                          │ ❌ ERROR                    
                   https://thoth-station.ninja/j/solved_sw_env                                             │ Consider using 'rhel' in version '8' with Python 3.8                                                              │ ❌ ERROR                    
                   https://thoth-station.ninja/j/solved_sw_env                                             │ Consider using 'ubi' in version '8' with Python 3.8                                                               │ ❌ ERROR                    
                                                                                                           ╵                                                                                                                   ╵ 


security

                                                                                                                 Application stack guidance                                                                                                                  
                                                                                                           ╷                                                                                                                   ╷                             
                   Link                                                                                    │ Message                                                                                                           │ Type                        
                  ═════════════════════════════════════════════════════════════════════════════════════════╪═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════╪═══════════                  
                   https://thoth-station.ninja/search/advise/adviser-221215120931-3eb177ea3940bf92/summary │ Results can be browsed in Thoth search                                                                            │ ✔️ INFO                      
                   https://thoth-station.ninja/j/cve_timestamp                                             │ CVE database of known vulnerabilities for Python packages was updated at '2022-12-15T00:00:06.283051'             │ ✔️ INFO                      
                   https://thoth-station.ninja/j/lax_version                                               │ No version range specifier for 'cryptography' found, it is recommended to specify version ranges in requirements  │ ⚠️ WARNING                   
                   https://thoth-station.ninja/j/lax_version                                               │ No version range specifier for 'deprecated' found, it is recommended to specify version ranges in requirements    │ ⚠️ WARNING                   
                   https://thoth-station.ninja/j/lax_version                                               │ No version range specifier for 'gitpython' found, it is recommended to specify version ranges in requirements     │ ⚠️ WARNING                   
                   https://thoth-station.ninja/j/lax_version                                               │ No version range specifier for 'pygithub' found, it is recommended to specify version ranges in requirements      │ ⚠️ WARNING                   
                   https://thoth-station.ninja/j/lax_version                                               │ No version range specifier for 'python-gitlab' found, it is recommended to specify version ranges in requirements │ ⚠️ WARNING                   
                   https://thoth-station.ninja/j/lax_version                                               │ No version range specifier for 'pyyaml' found, it is recommended to specify version ranges in requirements        │ ⚠️ WARNING                   
                   https://thoth-station.ninja/j/lax_version                                               │ No version range specifier for 'requests' found, it is recommended to specify version ranges in requirements      │ ⚠️ WARNING                   
                   https://thoth-station.ninja/j/lax_version                                               │ No version range specifier for 'urllib3' found, it is recommended to specify version ranges in requirements       │ ⚠️ WARNING                   
                   https://thoth-station.ninja/j/thoth_s2i                                                 │ It is recommended to use Thoth's s2i to have recommendations specific to runtime environment                      │ ✔️ INFO                      
                   https://thoth-station.ninja/j/py_version                                                │ No version of Python specified explicitly, assigning the one found in Thoth's configuration: '3.11'               │ ⚠️ WARNING                   
                   https://thoth-station.ninja/recommendation-types/                                       │ Using recommendation type 'security'                                                                              │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ Resolving for runtime environment named 'fedora-37'                                                               │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ Resolving for operating system 'fedora' in version '37'                                                           │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ Resolving for Python version '3.11'                                                                               │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ Using platform 'linux-x86_64'                                                                                     │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ No constraints supplied to the resolution process                                                                 │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ Using supplied static source code analysis                                                                        │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ No containerized environment used                                                                                 │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ Using CPU family 6 model 142                                                                                      │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ No CUDA used                                                                                                      │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ No cuDNN used                                                                                                     │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ No OpenBLAS used                                                                                                  │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ No OpenMPI used                                                                                                   │ ✔️ INFO                      
                   https://thoth-station.ninja/j/env                                                       │ No MKL used                                                                                                       │ ✔️ INFO                      
                   https://thoth-station.ninja/j/solved_sw_env                                             │ No observations found for 'fedora' in version '37' using Python '3.11'                                            │ ❌ ERROR                    
                   https://thoth-station.ninja/j/solved_sw_env                                             │ Consider using 'fedora' in version '34' with Python 3.9                                                           │ ❌ ERROR                    
                   https://thoth-station.ninja/j/solved_sw_env                                             │ Consider using 'fedora' in version '35' with Python 3.10                                                          │ ❌ ERROR                    
                   https://thoth-station.ninja/j/solved_sw_env                                             │ Consider using 'rhel' in version '8' with Python 3.8                                                              │ ❌ ERROR                    
                   https://thoth-station.ninja/j/solved_sw_env                                             │ Consider using 'ubi' in version '8' with Python 3.8                                                               │ ❌ ERROR                    
                                                                                                           ╵                                                                                                                   ╵                             
                                                               Boot pipeline unit SolvedSoftwareEnvironmentBoot failed: No observations found for 'fedora' in version '37' using Python '3.11'

I'm assuming the team has not processed Fedora 37 hence it doesn't produce any meaningful results. It would probably produce relevant data on UBI 8 but that's not what we are using.

TomasTomecek avatar Dec 15 '22 12:12 TomasTomecek

Build failed.

:x: pre-commit FAILURE in 2m 58s :heavy_check_mark: ogr-tests-rpm SUCCESS in 6m 23s :heavy_check_mark: ogr-tests-pip-deps SUCCESS in 6m 38s :heavy_check_mark: ogr-reverse-dep-packit-tests SUCCESS in 13m 58s