Package: paclair
Paclair is a Python3 Cli tool to interact withCoreos’s Clair.Features:Now compatible with Clair V3 (delete is not available)No need to have docker installed since Paclair interacts directly with the registries.Compatible with all registries.Simple to use.Easy integration in a CI job thanks to a lightweight output mode.InstallationTo install Paclair, simply usepip(or pipenv):$pipinstallpaclair✨🍰✨Voilà!ConfigurationExampleAn example configuration file is available in the conf directoryGeneral:
  clair_url: 'https://localhost:6060'
  # clair_api_version: 3
  # Whitelist known CVE's not to shown in html report
  # cve_whitelist:
  #   - CVE-2016-9843
  #   - CVE-2016-9840
  #   - CVE-2016-6313
Plugins:
  Docker:
    class: paclair.plugins.docker_plugin.DockerPlugin
    registries:
      artifactory.registry.com:
        token_url: "https://artifactory.registry.com/api/docker/{image.repository}/v2/token?service=artifactory.registry.com"
        protocol: 'http'
        api_prefix: '/api/docker/{image.repository}'
      registry.gitlab.domain.com:
        auth:
          - "*****"
          - "*****"
      # Example for a private gitlab server
      gitlab.example.com:4567:
        # If using https with an internal CA, ensure verify is pointing to it
        protocol: 'https'
        verify: "/etc/ssl/certs/ca-certificates.crt"
        auth:
          - "*****"
          - "*****"
      # Example for ECR Docker Repository
      xxxxxxxxxxxxxxxx.dkr.ecr.eu-west-1.amazonaws.com:
        token: "" # Execute this command to get token aws ecr get-authorization-token --output text --query 'authorizationData[].authorizationToken'
        protocol: 'https'
        token_type: BasicPlugins are dynamically loaded during execution. That’s why you have to specify the class of the
plugins you want to use.We have various plugins to interact with different sources (ex: docker registry, Elasticsearch)
because we use a custom variant of Clair which can analyse more than Docker images.If you want to use Paclair only to analyse docker images, don’t bother with others plugins.OptionsConfig OptionDescriptionGeneral::clair_urlurl of the Clair Server.General::verifyEither a boolean, in which case
it controls whether we verify the
server’s TLS certificate, or a
string, in which case it must be
a path to a CA bundle to use.General::clair_api_versionClair Api Version.
If different from 3, will be set
to default.
Default to 1.General::html_templateHtml template.
You can use a custom html template
when using html output.General::cve_whitelistCVE vulnerability list not to be
included in the report post
analysis (stats or html).PluginsList of plugins to use. If you
only want to analyse docker
images, keep the default
configuration.Plugins::Docker::classClass for the docker pluginPlugins::Docker::registriesYou can specify configuration for
registries (authentification, …)
if needed.Plugins::Docker::registries::regi
stry1::authlogin/passwordPlugins::Docker::registries::regi
stry1::verifyEither a boolean, in which case
it controls whether we verify the
server’s TLS certificate, or a
string, in which case it must be
a path to a CA bundle to use.Plugins::Docker::registries::regi
stry1::protocolProtocol to use (http or https).
Default to https.Plugins::Docker::registries::tokenYou can specify an authentication
token (use with token_type).
Default to None.Plugins::Docker::registries::token
_typeSpecify the token type.
Default to Bearer.Running the testsLaunch tox.$toxUsageusage:paclair[-h][--debug][--syslog][--confCONF]pluginhosts[hosts...]{push,delete,analyse}...positionalarguments:pluginPlugintolaunchhostsImage/hostnametoanalyse{push,delete,analyse}CommandtolaunchpushPushimages/hoststoClairdeleteDeleteimages/hostsfromClairanalyseAnalyseimages/hostsalreadypushedtoClairoptionalarguments:-h,--helpshowthishelpmessageandexit--debugDebugmode--syslogLogtosyslog--confCONFConffileAnalyse command usageusage:paclairpluginhosts[hosts...]analyse[-h][--output-format{stats,html}][--output-report{file,term}][--output-dirOUTPUT_DIR][--delete]optionalarguments:-h,--helpshowthishelpmessageandexit--output-format{stats,html}Changedefaultoutputformat(default:json)--output-report{file,term}Changereportlocation(default:logger)--output-dirOUTPUT_DIRChangeoutputdirectory(default:current)--deleteDeleteafteranalyseExamplesPush ubuntu image to Clair$paclair--confconf/conf.ymlDockerubuntupushPushedubuntutoClair.Analyse ubuntu image (stats only show fixable CVE)$paclair--confconf/conf.ymlDockerubuntuanalyse--output-formatstatsMedium:3You can have the full json if you don’t specify –output-format stats.Analyse ubuntu image and get a html report in directory /tmp$paclair--confconf/conf.ymlDockerubuntuanalyse--output-formathtml--output-dir/tmpDelete ubuntu image$paclair--confconf/conf.ymlDockerubuntudeleteubuntuwasdeletedfromClair.ContributingFeel free to contribute.AuthorsYebinama-Initial work-Yebinama