#!/usr/bin/env bash
# Verify that Trivy scans work from the local DB with no network access.
# As root it runs inside a network namespace with no interfaces (unshare -n),
# so any attempt to download would fail the test.
set -uo pipefail

ROOT="$(cd "$(dirname "$0")" && pwd)"

if [[ "${_TRIVY_NETNS:-}" != 1 ]]; then
  if [[ $EUID -eq 0 ]] && command -v unshare >/dev/null; then
    exec env _TRIVY_NETNS=1 unshare -n "$0" "$@"
  fi
  echo "WARN: not root, running WITHOUT network isolation (disconnect the host to be sure)"
fi

# shellcheck source=trivy-offline.env
source "$ROOT/trivy-offline.env"
export TRIVY_CACHE_DIR="$ROOT/cache"
cd "$ROOT"

pass=0; fail=0
check() {  # check NAME EXPECTED_REGEX -- trivy args...
  local name="$1" want="$2"; shift 3
  local out; out="$(trivy "$@" 2>&1)"
  if grep -qE "$want" <<<"$out" && ! grep -q FATAL <<<"$out"; then
    echo "PASS  $name"; pass=$((pass+1))
  else
    echo "FAIL  $name"; grep -E "FATAL|ERROR" <<<"$out" | head -3 | sed 's/^/      /'; fail=$((fail+1))
  fi
}

echo "== network: $(curl -sS --max-time 3 -o /dev/null https://mirror.gcr.io/v2/ 2>&1 && echo REACHABLE || echo blocked)"
echo "== DB: $(jq -r '"vuln updated " + .UpdatedAt' cache/db/metadata.json), $(jq -r '"java updated " + .UpdatedAt' cache/java-db/metadata.json)"

check "fs: Python lockfile (vuln DB)"   'CVE-2020-14343'  -- fs --scanners vuln samples/python-app
check "rootfs: log4j JAR (Java DB)"     'CVE-2021-44228'  -- rootfs --scanners vuln samples/java
check "image: UBI 9 tarball (OS pkgs)"  'redhat 9\.8'     -- image --input samples/images/ubi9-minimal-9.8.tar
check "config: Dockerfile (checks)"     'DS-0002'         -- config samples/python-app

trivy fs --scanners vuln --severity CRITICAL --exit-code 1 --quiet samples/python-app >/dev/null 2>&1
if [[ $? -eq 1 ]]; then echo "PASS  gate: --exit-code 1 on CRITICAL"; pass=$((pass+1)); else echo "FAIL  gate"; fail=$((fail+1)); fi

echo "== $pass passed, $fail failed"
[[ $fail -eq 0 ]]