# Ubuntu/Debian
sudo apt-get install trivy

# macOS
brew install trivy

# Docker 方式运行
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
    aquasec/trivy image myapp:latest

# 扫描镜像
trivy image myapp:latest

# 扫描本地 Dockerfile
trivy config Dockerfile

# 扫描目录（包含 Dockerfile、Kubernetes manifests 等）
trivy fs .

# 输出 JSON 格式
trivy image --format json --output result.json myapp:latest

# 仅显示高危和严重漏洞
trivy image --severity HIGH,CRITICAL myapp:latest

# 退出码（CI 集成）
trivy image --exit-code 1 --severity CRITICAL myapp:latest

# GitHub Actions
name: Security Scan
on: [push, pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Build image
        run: docker build -t myapp:${{ github.sha }} .
      
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:${{ github.sha }}
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'
          exit-code: '1'
      
      - name: Upload Trivy scan results to GitHub Security
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'

# .trivyignore
# 忽略特定 CVE（需要评估风险后才可忽略）
CVE-2024-0727
# 忽略特定漏洞（带有效期）
CVE-2024-2096
  expires: 2026-12-31

# Docker Desktop 内置 Scout
docker scout cves myapp:latest

# 快速查看建议
docker scout recommendations myapp:latest

# 比较两个版本的漏洞
docker scout compare myapp:v1 myapp:v2

# 下载最新版
COSIGN_VERSION="v2.2.3"
curl -fsSL "https://github.com/sigstore/cosign/releases/download/${COSIGN_VERSION}/cosign-linux-amd64" \
    -o /usr/local/bin/cosign
chmod +x /usr/local/bin/cosign

# 生成密钥对
cosign generate-key-pair

# 使用私钥签名
cosign sign --key cosign.key registry.example.com/myapp:latest

# 使用密钥签名并附加签名
cosign sign --key cosign.key \
    -a "commit=$(git rev-parse HEAD)" \
    -a "builder=$(whoami)" \
    registry.example.com/myapp:latest

# 使用公钥验证
cosign verify --key cosign.pub registry.example.com/myapp:latest

# 输出验证结果
# The following checks were performed:
#   - The cosign claims were validated
#   - The signatures were verified against the specified public key

# 在 K8s 中强制验证（使用 Kyverno 或 OPA Gatekeeper）

# 使用 OIDC 身份签名（适合 CI/CD）
# 不需要管理密钥对
cosign sign \
    --yes \
    --identity-token=$(get-oidc-token) \
    registry.example.com/myapp:latest

# 在 GitHub Actions 中使用
# 直接使用 GITHUB_TOKEN，无需配置密钥

# GitHub Actions 中签名
name: Build and Sign
on: push
jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      id-token: write  # OIDC
      contents: read
    steps:
      - uses: actions/checkout@v4
      
      - uses: docker/setup-buildx-action@v3
      
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      
      - uses: docker/build-push-action@v5
        with:
          push: true
          tags: ghcr.io/${{ github.repository }}:${{ github.sha }}
      
      - uses: sigstore/cosign-installer@v3
      
      - name: Sign image
        run: cosign sign --yes ghcr.io/${{ github.repository }}:${{ github.sha }}

# 使用 syft（Anchore 出品）
syft myapp:latest -o spdx-json > sbom.spdx.json
syft myapp:latest -o cyclonedx-json > sbom.cdx.json

# 使用 Docker SBOM 插件
docker sbom myapp:latest

# 附加 SBOM 到镜像（OCI artifact）
cosign attest --predicate sbom.spdx.json --type spdx \
    --key cosign.key \
    registry.example.com/myapp:latest

{
  "spdxVersion": "SPDX-2.3",
  "name": "myapp",
  "packages": [
    {
      "name": "openssl",
      "versionInfo": "3.0.13",
      "licenseConcluded": "Apache-2.0"
    },
    {
      "name": "curl",
      "versionInfo": "7.88.1",
      "licenseConcluded": "MIT"
    }
  ]
}

# ❌ 包含大量不必要的工具
FROM ubuntu:22.04

# ✅ 使用精简镜像
FROM python:3.12-slim

# ✅ 使用 Distroless（无 shell、无包管理器）
FROM gcr.io/distroless/python3

# ✅ 使用 Chainguard Images（零 CVE 目标）
FROM cgr.dev/chainguard/python:latest