From 92d891df6a22ec5abf43bc04199763fca9fc45e6 Mon Sep 17 00:00:00 2001 From: Eljees Date: Sun, 19 Jul 2026 13:21:32 +0300 Subject: [PATCH] fix: remove retired Docker Content Trust check Signed-off-by: Eljees --- CHECKPOINT.md | 20 +----------- README.md | 31 +----------------- pkg/assessor/assessor.go | 2 -- pkg/assessor/contentTrust/contentTrust.go | 39 ----------------------- pkg/scanner/scan_test.go | 3 -- pkg/types/checkpoint.go | 3 -- 6 files changed, 2 insertions(+), 96 deletions(-) delete mode 100644 pkg/assessor/contentTrust/contentTrust.go diff --git a/CHECKPOINT.md b/CHECKPOINT.md index 8f792e32..16954c63 100644 --- a/CHECKPOINT.md +++ b/CHECKPOINT.md @@ -27,7 +27,7 @@ USER dockle ### CIS-DI-0002 **Use trusted base images for containers** -Dockle checks [Content Trust](https://docs.docker.com/engine/security/trust/content_trust/). +Not supported. ### CIS-DI-0003 **Do not install unnecessary packages in the container** @@ -40,24 +40,6 @@ Not supported. Not supported. Please check with [Trivy](https://github.com/knqyf263/trivy). -### CIS-DI-0005 -**Enable Content trust for Docker** - -> Content trust is disabled by default. You should enable it. - -```bash -$ export DOCKER_CONTENT_TRUST=1 -``` - -- https://docs.docker.com/engine/security/trust/content_trust/#about-docker-content-trust-dct - - > Docker Content Trust (DCT) provides the ability to use digital signatures for data sent to and received from remote Docker registries.
- > Engine Signature Verification prevents the following: - > - > - `$ docker container run` of an unsigned image. - > - `$ docker pull` of an unsigned image. - > - `$ docker build` where the FROM image is not signed or is not scratch. - ### CIS-DI-0006 **Add `HEALTHCHECK` instruction to the container image** diff --git a/README.md b/README.md index a6742e8f..e90759c3 100644 --- a/README.md +++ b/README.md @@ -246,8 +246,6 @@ FATAL - DKL-LI-0001: Avoid empty password * No password user found! username : nopasswd WARN - CIS-DI-0001: Create a user for the container * Last user should not be root -INFO - CIS-DI-0005: Enable Content trust for Docker - * export DOCKER_CONTENT_TRUST=1 before docker pull/build INFO - CIS-DI-0008: Confirm safety of setuid/setgid files * setuid file: app/suid.txt urw-r--r-- * setgid file: app/gid.txt grw-r--r-- @@ -303,7 +301,6 @@ $ docker run --rm goodwithtech/dockle:v${DOCKLE_LATEST} [YOUR_IMAGE_NAME] | [CIS-DI-0002](CHECKPOINT.md#cis-di-0002) | Use trusted base images for containers | FATAL | [CIS-DI-0003](CHECKPOINT.md#cis-di-0003) | Do not install unnecessary packages in the container | FATAL | [CIS-DI-0004](CHECKPOINT.md#cis-di-0004) | Scan and rebuild the images to include security patches | FATAL -| [CIS-DI-0005](CHECKPOINT.md#cis-di-0005) | Enable Content trust for Docker | INFO | [CIS-DI-0006](CHECKPOINT.md#cis-di-0006) | Add `HEALTHCHECK` instruction to the container image | INFO | [CIS-DI-0007](CHECKPOINT.md#cis-di-0007) | Do not use `update` instructions alone in the Dockerfile | FATAL | [CIS-DI-0008](CHECKPOINT.md#cis-di-0008) | Confirm safety of `setuid` and `setgid` files | INFO @@ -350,8 +347,6 @@ $ dockle goodwithtech/test-image:v1 ``` FATAL - CIS-DI-0001: Create a user for the container * Last user should not be root -WARN - CIS-DI-0005: Enable Content trust for Docker - * export DOCKER_CONTENT_TRUST=1 before docker pull/build FATAL - CIS-DI-0006: Add HEALTHCHECK instruction to the container image * not found HEALTHCHECK statement FATAL - CIS-DI-0007: Do not use update instructions alone in the Dockerfile @@ -405,7 +400,7 @@ $ dockle -f json -o results.json goodwithtech/test-image:v1 "summary": { "fatal": 6, "warn": 2, - "info": 2, + "info": 1, "pass": 7 }, "details": [ @@ -417,14 +412,6 @@ $ dockle -f json -o results.json goodwithtech/test-image:v1 "Last user should not be root" ] }, - { - "code": "CIS-DI-0005", - "title": "Enable Content trust for Docker", - "level": "INFO", - "alerts": [ - "export DOCKER_CONTENT_TRUST=1 before docker pull/build" - ] - }, { "code": "CIS-DI-0006", "title": "Add HEALTHCHECK instruction to the container image", @@ -552,15 +539,6 @@ $ dockle -f sarif -o results.json goodwithtech/test-image:v1 "text": "https://github.com/goodwithtech/dockle/blob/master/CHECKPOINT.md#DKL-LI-0001" } }, - { - "id": "CIS-DI-0005", - "shortDescription": { - "text": "Enable Content trust for Docker" - }, - "help": { - "text": "https://github.com/goodwithtech/dockle/blob/master/CHECKPOINT.md#CIS-DI-0005" - } - }, { "id": "CIS-DI-0008", "shortDescription": { @@ -620,13 +598,6 @@ $ dockle -f sarif -o results.json goodwithtech/test-image:v1 "text": "No password user found! username : nopasswd" } }, - { - "ruleId": "CIS-DI-0005", - "level": "note", - "message": { - "text": "export DOCKER_CONTENT_TRUST=1 before docker pull/build" - } - }, { "ruleId": "CIS-DI-0008", "level": "note", diff --git a/pkg/assessor/assessor.go b/pkg/assessor/assessor.go index 200e4a18..19e556d7 100644 --- a/pkg/assessor/assessor.go +++ b/pkg/assessor/assessor.go @@ -6,7 +6,6 @@ import ( "github.com/goodwithtech/dockle/pkg/assessor/cache" "github.com/goodwithtech/dockle/pkg/assessor/privilege" - "github.com/goodwithtech/dockle/pkg/assessor/contentTrust" "github.com/goodwithtech/dockle/pkg/assessor/credential" "github.com/goodwithtech/dockle/pkg/assessor/hosts" @@ -36,7 +35,6 @@ func init() { RegisterAssessor(hosts.HostsAssessor{}) RegisterAssessor(credential.CredentialAssessor{}) RegisterAssessor(manifest.ManifestAssessor{}) - RegisterAssessor(contentTrust.ContentTrustAssessor{}) RegisterAssessor(cache.CacheAssessor{}) } diff --git a/pkg/assessor/contentTrust/contentTrust.go b/pkg/assessor/contentTrust/contentTrust.go deleted file mode 100644 index 680d78b3..00000000 --- a/pkg/assessor/contentTrust/contentTrust.go +++ /dev/null @@ -1,39 +0,0 @@ -package contentTrust - -import ( - "os" - - "github.com/goodwithtech/dockle/pkg/log" - "github.com/goodwithtech/dockle/pkg/types" -) - -var HostEnvironmentFileName = "ENVIRONMENT variable on HOST OS" - -type ContentTrustAssessor struct{} - -func (a ContentTrustAssessor) Assess(_ types.FileMap) ([]*types.Assessment, error) { - log.Logger.Debug("Scan start : DOCKER_CONTENT_TRUST") - - if os.Getenv("DOCKER_CONTENT_TRUST") != "1" { - return []*types.Assessment{ - { - Code: types.UseContentTrust, - Filename: HostEnvironmentFileName, - Desc: "export DOCKER_CONTENT_TRUST=1 before docker pull/build", - }, - }, nil - } - return nil, nil -} - -func (a ContentTrustAssessor) RequiredFiles() []string { - return []string{} -} - -func (a ContentTrustAssessor) RequiredExtensions() []string { - return []string{} -} - -func (a ContentTrustAssessor) RequiredPermissions() []os.FileMode { - return []os.FileMode{} -} diff --git a/pkg/scanner/scan_test.go b/pkg/scanner/scan_test.go index 8e121b99..51404b8c 100644 --- a/pkg/scanner/scan_test.go +++ b/pkg/scanner/scan_test.go @@ -10,7 +10,6 @@ import ( "github.com/google/go-cmp/cmp" - "github.com/goodwithtech/dockle/pkg/assessor/contentTrust" "github.com/goodwithtech/dockle/pkg/assessor/manifest" "github.com/goodwithtech/dockle/pkg/log" "github.com/goodwithtech/dockle/pkg/types" @@ -44,7 +43,6 @@ func TestScanImage(t *testing.T) { {Code: types.AddHealthcheck, Filename: manifest.ConfigFileName}, {Code: types.MinimizeAptGet, Filename: manifest.ConfigFileName}, {Code: types.AvoidCredential, Filename: manifest.ConfigFileName}, - {Code: types.UseContentTrust, Filename: contentTrust.HostEnvironmentFileName}, }, }, "Dockerfile.scratch": { @@ -52,7 +50,6 @@ func TestScanImage(t *testing.T) { expected: []*types.Assessment{ {Code: types.AvoidCredential, Filename: "credentials.json"}, {Code: types.AddHealthcheck, Filename: manifest.ConfigFileName}, - {Code: types.UseContentTrust, Filename: contentTrust.HostEnvironmentFileName}, {Code: types.AvoidEmptyPassword, Level: types.SkipLevel}, {Code: types.AvoidDuplicateUserGroup, Level: types.SkipLevel}, {Code: types.AvoidDuplicateUserGroup, Level: types.SkipLevel}, diff --git a/pkg/types/checkpoint.go b/pkg/types/checkpoint.go index 9fb299e7..11fd07e4 100644 --- a/pkg/types/checkpoint.go +++ b/pkg/types/checkpoint.go @@ -3,7 +3,6 @@ package types const ( // CIS-DI AvoidRootDefault = "CIS-DI-0001" - UseContentTrust = "CIS-DI-0005" AddHealthcheck = "CIS-DI-0006" UseAptGetUpdateNoCache = "CIS-DI-0007" CheckSuidGuid = "CIS-DI-0008" @@ -36,7 +35,6 @@ const ( // DefaultLevelMap save risk level each checkpoints var DefaultLevelMap = map[string]int{ AvoidRootDefault: WarnLevel, - UseContentTrust: InfoLevel, AddHealthcheck: InfoLevel, UseAptGetUpdateNoCache: FatalLevel, CheckSuidGuid: InfoLevel, @@ -58,7 +56,6 @@ var DefaultLevelMap = map[string]int{ // TitleMap save title each checkpoints var TitleMap = map[string]string{ AvoidRootDefault: "Create a user for the container", - UseContentTrust: "Enable Content trust for Docker", AddHealthcheck: "Add HEALTHCHECK instruction to the container image", UseAptGetUpdateNoCache: "Do not use update instructions alone in the Dockerfile", CheckSuidGuid: "Confirm safety of setuid/setgid files",