process_operator_scan.sh

#!/bin/bash
# Script to process results of the scan.sh script

source ./functions.sh

INPUT_FILE="${1}"
OUTPUT_FILE="$(echo ${INPUT_FILE} | sed 's|\.csv||')_annotated.csv"

# Contains CVE/image pairings from ACS export
TMP_CVES="/tmp/cves.txt"
# Container cve-analyser results
CVE_ANALYSER_RESULTS="/tmp/cve_analyser.txt"

COLS=$(head -1 ${INPUT_FILE}) 
echo "${COLS}, \"RedHat CVSS Score\", \"RedHat Disposition\"" > "${OUTPUT_FILE}"

while read -r line
do
  image_name=$(echo "${line}" | awk -F\, '{print $1}'| tr -d '"')
  cve=$(echo "${line}" | awk -F\, '{print $2}' | tr -d '"')
  cvss=$(echo "${line}" | awk -F\, '{print $3}')
  if [[ "${image_name}" =~ "@" ]]; then
    image_repo=$(echo "${image_name}" | awk -F\@ '{print $1}' | awk '{sub(/\//," ");$1=$1;print $2}')
  else
    image_repo=$(echo "${image_name}" | awk -F\: '{print $1}' | awk '{sub(/\//," ");$1=$1;print $2}')
  fi
  image=$(echo "${image_repo}" | awk -F\/ '{print $NF}')

  #echo "--------------------------------------------------------------"
  #echo "$line"
  #echo "Image Name: $image_name"
  #echo "CVE: $cve"
  #echo "CVSS: $cvss"
  #echo "Image Repo: $image_repo"
  #echo "Image: $image"

  echo "Processing cve: ${cve}"

  if [[ "${cve}" =~ "RHSA" ]]
  then
    #echo "${line}, todo, skipping" >> "${OUTPUT_FILE}"
    #continue
    RST=$(process_rhsa ${image_repo} ${cve})
  else
    # Convert image with digest to image with tag and process with cve-analyser
    image_tag=$(digest_to_tag ${image_name})

    # Map rh-acs repo to advanced-cluster-security which is where they actually live
    if [[ "${image_repo}" =~ "rh-acs" ]]
    then
      image_repo=$(echo ${image_repo} | sed 's|rh-acs|advanced-cluster-security|g')
    fi

    image_with_tag="$(echo "${image_repo}" | sed 's|@.*||'):${image_tag}"

    # TODO: Upgrade cve-analyser to accept CLI pair instead of file only, faster
    echo "${cve},${image_with_tag}" > "${TMP_CVES}"
    RST=$(cve-analyser "${TMP_CVES}" | awk -F\, '{print $NF}')
    #echo "RST: ${RST}"
    echo "${cve}, ${image_repo}, ${RST}"
  fi
  echo "${line}, todo, ${RST}" >> "${OUTPUT_FILE}"

done < <(tail -n +2 ${INPUT_FILE})