WIP: use chainguard's static (distroless v2) for scorecard image #2593

developer-guy · 2023-01-11T08:12:55Z

Signed-off-by: Batuhan Apaydın batuhan.apaydin@trendyol.com

What kind of change does this PR introduce?

This feature is about using the chainguard's static image instead of Google's static. I removed a few things from Dockerfile to simplify the process, as I saw that we don't need them.

PR title follows the guidelines defined in our pull request documentation

What is the current behavior?

What is the new behavior (if this is a feature change)?**

Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

Special notes for your reviewer

Does this PR introduce a user-facing change?

For user-facing changes, please add a concise, human-readable release note to
the release-note

(In particular, describe what changes users might need to make in their
application as a result of this pull request.)

codecov · 2023-01-11T08:17:57Z

Codecov Report

Merging #2593 (0a36fa1) into main (a29182d) will not change coverage.
The diff coverage is n/a.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2593   +/-   ##
=======================================
  Coverage   40.40%   40.40%           
=======================================
  Files         122      122           
  Lines        9908     9908           
=======================================
  Hits         4003     4003           
  Misses       5624     5624           
  Partials      281      281

developer-guy · 2023-01-11T08:24:24Z

I marked it as WIP because I can replace all other Dockerfile's base images with Chainguard's static image and do some cleanups☝️ PTAL @dlorenc @naveensrinivasan

github-actions · 2023-01-11T09:17:48Z

Integration tests success for
[5916325]
(https://github.com/ossf/scorecard/actions/runs/3891083885)

github-actions · 2023-01-11T09:47:56Z

Integration tests success for
[cbe7a6e]
(https://github.com/ossf/scorecard/actions/runs/3891477078)

naveensrinivasan · 2023-01-11T15:30:48Z

Dockerfile

-FROM gcr.io/distroless/base:nonroot@sha256:99133cb0878bb1f84d1753957c6fd4b84f006f2798535de22ebf7ba170bbf434
+# https://github.com/chainguard-images/images/tree/main/images/static
+# latest
+FROM cgr.dev/chainguard/static@sha256:b25ab001448354017969e5abe42496fb107d759d429e69ef69b7da45f0e6cf0e


Please share the advantages of each option so we can compare them. Thank you!

One of the utmost essential advantages of using Chainguard's images is that they shipped with both SBOM and SLSA Attestation, making them transparent from an end-user perspective. Also, they have zero CVEs if we compare them with Google's distroless as it has built on top of apk/wolfi packages. Also, it comes with fewer packages included in an image. But as I'm not the project's maintainer, I will ping some maintainers to get more opinions about comparing the two. PTAL @rawlingsj @imjasonh

@developer-guy Thanks for the update!

@laurentsimon @spencerschrock I am OK with this change. Thoughts?

Skimmed https://edu.chainguard.dev/chainguard/chainguard-images/faq/ and https://github.com/chainguard-images/images/tree/main/images/static:

The main difference is in the implementation. The Google distroless images are built with Bazel and based on the Debian distribution, whereas Chainguard Images are built with apko based on the Wolfi or Alpine distributions.

Just to add to the attestation differences mentioned above.

The image has a single user nonroot with uid 65532, belonging to gid 65532.

This should be fine here for this scorecard image. The scorecard-action however needs root (which is another Dockerfile in another repo, so that would be an adoption blocker there.

Note: there are other Dockerfiles in this repo, that would be good to have everything on the same page eventually. It might make sense to update the cron images after that pipeline is restored. There's also the attestor images, @raghavkaul do you see this change impacting that?

I would recommend that we upgrade one of them and then move it across to cron.

there are other Dockerfiles in this repo, that would be good to have everything on the same page eventually.

Yep, this is the reason why I marked that issue as WIP 😇

spencerschrock · 2023-01-11T20:13:26Z

Dockerfile

-FROM gcr.io/distroless/base:nonroot@sha256:99133cb0878bb1f84d1753957c6fd4b84f006f2798535de22ebf7ba170bbf434
+# https://github.com/chainguard-images/images/tree/main/images/static
+# latest
+FROM cgr.dev/chainguard/static@sha256:b25ab001448354017969e5abe42496fb107d759d429e69ef69b7da45f0e6cf0e


Might be worth adding a tag here according to #2581. Seems like there are nightly updates, so we would just need to throttle update frequency based on our dependabot settings

Something like this perhaps?

FROM cgr.dev/chainguard/static:latest@sha256:b25ab001448354017969e5abe42496fb107d759d429e69ef69b7da45f0e6cf0e

I've also updated the digest of the static image of Chainguard that was built a day ago.

github-actions · 2023-01-12T12:54:14Z

Integration tests success for
[9c4b595]
(https://github.com/ossf/scorecard/actions/runs/3902320836)

github-actions · 2023-01-23T01:58:55Z

Stale pull request message

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

developer-guy · 2023-01-23T06:51:58Z

Kindly ping @spencerschrock @naveensrinivasan, folx, do you want me to continue to replace the base images with the chainguard ones?

naveensrinivasan · 2023-01-23T17:27:24Z

Kindly ping @spencerschrock @naveensrinivasan, folx, do you want me to continue to replace the base images with the chainguard ones?

I don't see why not? @spencerschrock Thoughts?

azeemshaikh38

Hi folks, sorry for the late reply here. @developer-guy thanks for the PR, but IMO Scorecard should continue using Distroless for the following reasons -

while there is benefit of having SLSA and SBOM attestations, I would prefer to continue using Distroless images since they see more wider community usage and have been time-tested for longer.
regarding num_vulns - I believe we are comparing distroless/base to cgr/static. If there is no reason for us to depend on distroless/base, we could very well move to distroless/static which should have a lower num_vulns.

@spencerschrock @naveensrinivasan fyi.

developer-guy · 2023-01-24T06:58:13Z

regarding num_vulns - I believe we are comparing distroless/base to cgr/static. If there is no reason for us to depend on distroless/base, we could very well move to distroless/static which should have a lower num_vulns.

To be honest, @azeemshaikh38, there are still differences between the distroless/static and Chainguard's static.

kindly ping @dlorenc: https://twitter.com/lorenc_dan/status/1614983229492105216?s=20

github-actions · 2023-02-04T01:58:09Z

Stale pull request message

developer-guy · 2023-02-15T10:32:49Z

any updates on this ?

github-actions · 2023-02-26T02:06:53Z

Stale pull request message

developer-guy · 2023-02-27T09:17:16Z

I'm still willing to do this folx

developer-guy · 2023-02-27T17:37:19Z

kindly ping @azeemshaikh38 @naveensrinivasan

github-actions · 2023-03-10T02:06:20Z

Stale pull request message

developer-guy · 2023-03-10T07:28:45Z

I'm still waiting for your comments to make it done 😇

github-actions · 2023-03-22T01:54:44Z

Stale pull request message

developer-guy · 2023-03-22T07:15:09Z

kindly ping 🙉

azeemshaikh38 · 2023-03-22T14:13:06Z

@developer-guy sorry for the late reply here. My preference is a no to this change for the reason that distroless is an industry standard compared to cgr. If a majority of @ossf/scorecard-maintainers feel differently and would like to move to cgr image instead, I'd be ok with it too. @naveensrinivasan @spencerschrock @laurentsimon @raghavkaul fyi.

If there is no response from any of the Scorecard maintainers here, I will close this PR to reduce our PR queue.

github-actions · 2023-04-03T01:50:42Z

Stale pull request message

naveensrinivasan · 2023-04-20T16:24:54Z

@developer-guy sorry for the late reply here. My preference is a no to this change for the reason that distroless is an industry standard compared to cgr. If a majority of @ossf/scorecard-maintainers feel differently and would like to move to cgr image instead, I'd be ok with it too. @naveensrinivasan @spencerschrock @laurentsimon @raghavkaul fyi.

If there is no response from any of the Scorecard maintainers here, I will close this PR to reduce our PR queue.

@developer-guy Thanks!

For now, we are going to close this. We can relook at this later.

developer-guy requested review from azeemshaikh38, justaugustus, laurentsimon, naveensrinivasan and spencerschrock as code owners January 11, 2023 08:12

developer-guy had a problem deploying to integration-test January 11, 2023 08:13 — with GitHub Actions Failure

developer-guy force-pushed the feature/chainguard-images branch from 4c282d2 to 8ddc121 Compare January 11, 2023 08:16

developer-guy had a problem deploying to integration-test January 11, 2023 08:16 — with GitHub Actions Failure

developer-guy force-pushed the feature/chainguard-images branch from 8ddc121 to 6f3a417 Compare January 11, 2023 08:19

developer-guy had a problem deploying to integration-test January 11, 2023 08:19 — with GitHub Actions Failure

developer-guy force-pushed the feature/chainguard-images branch from 6f3a417 to 9a739fb Compare January 11, 2023 08:24

developer-guy had a problem deploying to integration-test January 11, 2023 08:24 — with GitHub Actions Failure

developer-guy force-pushed the feature/chainguard-images branch from 9a739fb to 5916325 Compare January 11, 2023 08:41

developer-guy temporarily deployed to integration-test January 11, 2023 08:41 — with GitHub Actions Inactive

developer-guy force-pushed the feature/chainguard-images branch from 5916325 to cbe7a6e Compare January 11, 2023 09:33

developer-guy temporarily deployed to integration-test January 11, 2023 09:34 — with GitHub Actions Inactive

naveensrinivasan reviewed Jan 11, 2023

View reviewed changes

spencerschrock reviewed Jan 11, 2023

View reviewed changes

developer-guy force-pushed the feature/chainguard-images branch from cbe7a6e to 9c4b595 Compare January 12, 2023 12:39

developer-guy temporarily deployed to integration-test January 12, 2023 12:40 — with GitHub Actions Inactive

developer-guy requested review from spencerschrock and removed request for justaugustus, azeemshaikh38 and laurentsimon January 12, 2023 12:42

use chainguard's static (distroless v2) for scorecard image

0a36fa1

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

developer-guy force-pushed the feature/chainguard-images branch from 9c4b595 to 0a36fa1 Compare January 23, 2023 06:51

azeemshaikh38 requested changes Jan 23, 2023

View reviewed changes

github-actions bot removed the no-pr-activity label Jan 24, 2023

github-actions bot added the no-pr-activity label Feb 4, 2023

github-actions bot removed the no-pr-activity label Feb 16, 2023

github-actions bot added the no-pr-activity label Feb 26, 2023

github-actions bot removed the no-pr-activity label Feb 28, 2023

github-actions bot added the no-pr-activity label Mar 10, 2023

github-actions bot removed the no-pr-activity label Mar 11, 2023

github-actions bot added the no-pr-activity label Mar 22, 2023

github-actions bot removed the no-pr-activity label Mar 23, 2023

github-actions bot added the no-pr-activity label Apr 3, 2023

naveensrinivasan closed this Apr 20, 2023

spencerschrock mentioned this pull request May 23, 2024

✨ move to cgr base image #4113

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

WIP: use chainguard's static (distroless v2) for scorecard image #2593

WIP: use chainguard's static (distroless v2) for scorecard image #2593

developer-guy commented Jan 11, 2023

codecov bot commented Jan 11, 2023 •

edited

Loading

developer-guy commented Jan 11, 2023

github-actions bot commented Jan 11, 2023

github-actions bot commented Jan 11, 2023

naveensrinivasan Jan 11, 2023

developer-guy Jan 11, 2023

developer-guy Jan 11, 2023

naveensrinivasan Jan 11, 2023

spencerschrock Jan 11, 2023

naveensrinivasan Jan 11, 2023

developer-guy Jan 12, 2023

spencerschrock Jan 11, 2023

developer-guy Jan 12, 2023

developer-guy Jan 12, 2023

github-actions bot commented Jan 12, 2023

github-actions bot commented Jan 23, 2023

developer-guy commented Jan 23, 2023

naveensrinivasan commented Jan 23, 2023

azeemshaikh38 left a comment

developer-guy commented Jan 24, 2023 •

edited

Loading

github-actions bot commented Feb 4, 2023

developer-guy commented Feb 15, 2023

github-actions bot commented Feb 26, 2023

developer-guy commented Feb 27, 2023

developer-guy commented Feb 27, 2023

github-actions bot commented Mar 10, 2023

developer-guy commented Mar 10, 2023

github-actions bot commented Mar 22, 2023

developer-guy commented Mar 22, 2023

azeemshaikh38 commented Mar 22, 2023

github-actions bot commented Apr 3, 2023

naveensrinivasan commented Apr 20, 2023

WIP: use chainguard's static (distroless v2) for scorecard image #2593

WIP: use chainguard's static (distroless v2) for scorecard image #2593

Conversation

developer-guy commented Jan 11, 2023

What kind of change does this PR introduce?

What is the current behavior?

What is the new behavior (if this is a feature change)?**

Which issue(s) this PR fixes

Special notes for your reviewer

Does this PR introduce a user-facing change?

codecov bot commented Jan 11, 2023 • edited Loading

Codecov Report

developer-guy commented Jan 11, 2023

github-actions bot commented Jan 11, 2023

github-actions bot commented Jan 11, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

github-actions bot commented Jan 12, 2023

github-actions bot commented Jan 23, 2023

developer-guy commented Jan 23, 2023

naveensrinivasan commented Jan 23, 2023

azeemshaikh38 left a comment

Choose a reason for hiding this comment

developer-guy commented Jan 24, 2023 • edited Loading

github-actions bot commented Feb 4, 2023

developer-guy commented Feb 15, 2023

github-actions bot commented Feb 26, 2023

developer-guy commented Feb 27, 2023

developer-guy commented Feb 27, 2023

github-actions bot commented Mar 10, 2023

developer-guy commented Mar 10, 2023

github-actions bot commented Mar 22, 2023

developer-guy commented Mar 22, 2023

azeemshaikh38 commented Mar 22, 2023

github-actions bot commented Apr 3, 2023

naveensrinivasan commented Apr 20, 2023

codecov bot commented Jan 11, 2023 •

edited

Loading

developer-guy commented Jan 24, 2023 •

edited

Loading