From ae0e0bb70df014a186e21b01c8cfe4b3efbc76d2 Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Mon, 7 Oct 2019 08:23:37 -0400
Subject: [PATCH 01/21] Update config.yml

---
 .circleci/config.yml | 24 +++++++++---------------
 1 file changed, 9 insertions(+), 15 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 8d7ddba..a2957f7 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -9,7 +9,7 @@
 version: 2.1
 
 orbs:
-  clair_scanner: ovotech/clair-scanner@1
+  snyk: snyk/snyk@0.0.8
 
 jobs:
   build:
@@ -149,23 +149,17 @@ jobs:
       - store_test_results:
           path: test-results
   test-scan_images:
+    docker:
+      - image: 'circleci/buildpack-deps:stretch'
     environment:
       IMAGE_NAME: rfaircloth/scs
-    executor: clair_scanner/default
     steps:
-    - clair_scanner/scan:
-        image: $IMAGE_NAME:$CIRCLE_SHA1
-        whitelist: clair-whitelist.yml
-    - run:
-        command: |
-          mkdir -p /root/project/test-results
-          pip install -r requirements.txt
-          python clair_to_junit_parser.py "/clair-reports/$IMAGE_NAME:$CIRCLE_SHA1.json" --output test-results/results.xml
-        when: on_fail
-    - store_test_results:
-        path: test-results/results.xml
-    - store_artifacts:
-        path: /clair-reports
+    - checkout
+    - setup_remote_docker
+    - run: docker pull $IMAGE_NAME:$CIRCLE_SHA1
+    - snyk/scan:
+        docker-image-name: $IMAGE_NAME:$CIRCLE_SHA1
+
 
   publish-common:
     machine:

From b59f103bf373668307ec335b2e30c239bad60851 Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Mon, 7 Oct 2019 08:40:03 -0400
Subject: [PATCH 02/21] Update config.yml

---
 .circleci/config.yml | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index a2957f7..8c629ef 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -10,6 +10,7 @@ version: 2.1
 
 orbs:
   snyk: snyk/snyk@0.0.8
+  clair-scanner: ovotech/clair-scanner@1.5.0
 
 jobs:
   build:
@@ -148,7 +149,7 @@ jobs:
           when: always
       - store_test_results:
           path: test-results
-  test-scan_images:
+  test-scan-synk:
     docker:
       - image: 'circleci/buildpack-deps:stretch'
     environment:
@@ -160,6 +161,25 @@ jobs:
     - snyk/scan:
         docker-image-name: $IMAGE_NAME:$CIRCLE_SHA1
 
+  test-scan-clair:
+    environment:
+      IMAGE_NAME: rfaircloth/scs
+    executor: clair_scanner/default
+    steps:
+    - clair_scanner/scan:
+        image: $IMAGE_NAME:$CIRCLE_SHA1
+        whitelist: clair-whitelist.yml
+#    - run:
+#        command: |
+#          mkdir -p /root/project/test-results
+#          pip install -r requirements.txt
+#          python clair_to_junit_parser.py "/clair-reports/$IMAGE_NAME:$CIRCLE_SHA1.json" --output test-results/results.xml
+#        when: on_fail
+#    - store_test_results:
+#        path: test-results/results.xml
+#    - store_artifacts:
+#        path: /clair-reports
+
 
   publish-common:
     machine:
@@ -264,7 +284,7 @@ workflows:
       - test-unit:
           requires:
             - build
-      - test-scan_images:
+      - test-scan-synk:
           requires:
             - build
       - publish-common:

From 081f2b6075ad857119f20f5cc0781d629b76a0b0 Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Mon, 7 Oct 2019 08:40:40 -0400
Subject: [PATCH 03/21] Update config.yml

---
 .circleci/config.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 8c629ef..014f75f 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -287,6 +287,9 @@ workflows:
       - test-scan-synk:
           requires:
             - build
+      - test-scan-clair:
+          requires:
+            - build
       - publish-common:
           requires:
             - dgoss

From 9a645dd6f4105c05180f1c157df77f83ff8bd625 Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Mon, 7 Oct 2019 08:43:04 -0400
Subject: [PATCH 04/21] Update config.yml

---
 .circleci/config.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 014f75f..db1c81a 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -162,10 +162,13 @@ jobs:
         docker-image-name: $IMAGE_NAME:$CIRCLE_SHA1
 
   test-scan-clair:
+    docker:
+      - image: 'circleci/buildpack-deps:stretch'
     environment:
       IMAGE_NAME: rfaircloth/scs
-    executor: clair_scanner/default
     steps:
+    - setup_remote_docker
+    - run: docker pull $IMAGE_NAME:$CIRCLE_SHA1
     - clair_scanner/scan:
         image: $IMAGE_NAME:$CIRCLE_SHA1
         whitelist: clair-whitelist.yml

From c247216caee91c76680914da195447121b483e60 Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Mon, 7 Oct 2019 08:45:44 -0400
Subject: [PATCH 05/21] Update config.yml

---
 .circleci/config.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index db1c81a..99a4aed 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -169,7 +169,7 @@ jobs:
     steps:
     - setup_remote_docker
     - run: docker pull $IMAGE_NAME:$CIRCLE_SHA1
-    - clair_scanner/scan:
+    - clair-scanner/scan:
         image: $IMAGE_NAME:$CIRCLE_SHA1
         whitelist: clair-whitelist.yml
 #    - run:

From e6d9298364e79ad1b0247ad4b38d769ecbd2b15a Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Mon, 7 Oct 2019 08:47:36 -0400
Subject: [PATCH 06/21] Update config.yml

---
 .circleci/config.yml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 99a4aed..5e6b9f8 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -162,12 +162,10 @@ jobs:
         docker-image-name: $IMAGE_NAME:$CIRCLE_SHA1
 
   test-scan-clair:
-    docker:
-      - image: 'circleci/buildpack-deps:stretch'
+    executor: clair_scanner/default
     environment:
       IMAGE_NAME: rfaircloth/scs
     steps:
-    - setup_remote_docker
     - run: docker pull $IMAGE_NAME:$CIRCLE_SHA1
     - clair-scanner/scan:
         image: $IMAGE_NAME:$CIRCLE_SHA1

From 7ea2aab077b4380a0ae42ba6866228ff732565a2 Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Mon, 7 Oct 2019 08:50:20 -0400
Subject: [PATCH 07/21] Update config.yml

---
 .circleci/config.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 5e6b9f8..9fb2dbe 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -162,7 +162,7 @@ jobs:
         docker-image-name: $IMAGE_NAME:$CIRCLE_SHA1
 
   test-scan-clair:
-    executor: clair_scanner/default
+    executor: clair-scanner/default
     environment:
       IMAGE_NAME: rfaircloth/scs
     steps:

From 3428636c2de3250911291037ff186898e322958d Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Mon, 7 Oct 2019 08:55:42 -0400
Subject: [PATCH 08/21] Update config.yml

---
 .circleci/config.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 9fb2dbe..52aabc7 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -162,10 +162,11 @@ jobs:
         docker-image-name: $IMAGE_NAME:$CIRCLE_SHA1
 
   test-scan-clair:
-    executor: clair-scanner/default
+    executor: clair_scanner/default
     environment:
       IMAGE_NAME: rfaircloth/scs
     steps:
+    - setup_remote_docker
     - run: docker pull $IMAGE_NAME:$CIRCLE_SHA1
     - clair-scanner/scan:
         image: $IMAGE_NAME:$CIRCLE_SHA1

From 882e5b32321842b106aa555b27abcb656227de0c Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Mon, 7 Oct 2019 08:56:08 -0400
Subject: [PATCH 09/21] Update config.yml

---
 .circleci/config.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 52aabc7..2552e8f 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -162,7 +162,7 @@ jobs:
         docker-image-name: $IMAGE_NAME:$CIRCLE_SHA1
 
   test-scan-clair:
-    executor: clair_scanner/default
+    executor: clair-scanner/default
     environment:
       IMAGE_NAME: rfaircloth/scs
     steps:

From 7a8c3b0970cebb9ad90d9d7bf3ddcca28d284303 Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Mon, 7 Oct 2019 08:59:12 -0400
Subject: [PATCH 10/21] Update config.yml

---
 .circleci/config.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 2552e8f..9fb2dbe 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -166,7 +166,6 @@ jobs:
     environment:
       IMAGE_NAME: rfaircloth/scs
     steps:
-    - setup_remote_docker
     - run: docker pull $IMAGE_NAME:$CIRCLE_SHA1
     - clair-scanner/scan:
         image: $IMAGE_NAME:$CIRCLE_SHA1

From 0000723a47b680692e6c8b4f67d053cbede8e0a4 Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Mon, 7 Oct 2019 09:02:49 -0400
Subject: [PATCH 11/21] Update config.yml

---
 .circleci/config.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 9fb2dbe..d7035d0 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -166,7 +166,6 @@ jobs:
     environment:
       IMAGE_NAME: rfaircloth/scs
     steps:
-    - run: docker pull $IMAGE_NAME:$CIRCLE_SHA1
     - clair-scanner/scan:
         image: $IMAGE_NAME:$CIRCLE_SHA1
         whitelist: clair-whitelist.yml

From 3600d1d6e68386ddbf293bafa0d8a4e2cd46b63b Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Mon, 7 Oct 2019 09:11:08 -0400
Subject: [PATCH 12/21] Update config.yml

---
 .circleci/config.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index d7035d0..de0afc1 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -166,6 +166,8 @@ jobs:
     environment:
       IMAGE_NAME: rfaircloth/scs
     steps:
+    - setup_remote_docker:
+        docker_layer_caching: true
     - clair-scanner/scan:
         image: $IMAGE_NAME:$CIRCLE_SHA1
         whitelist: clair-whitelist.yml

From 2e33403ee99c1abb76473c6224c3d689cdcc88f1 Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Mon, 7 Oct 2019 09:17:15 -0400
Subject: [PATCH 13/21] Update config.yml

---
 .circleci/config.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index de0afc1..17fb7c9 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -162,12 +162,13 @@ jobs:
         docker-image-name: $IMAGE_NAME:$CIRCLE_SHA1
 
   test-scan-clair:
-    executor: clair-scanner/default
+    machine:
+      image: ubuntu-1604:201903-01
+      docker_layer_caching: true    # default - false
     environment:
       IMAGE_NAME: rfaircloth/scs
     steps:
-    - setup_remote_docker:
-        docker_layer_caching: true
+
     - clair-scanner/scan:
         image: $IMAGE_NAME:$CIRCLE_SHA1
         whitelist: clair-whitelist.yml

From b80ab5b257ebc6074b762c3870b1918b00bf58a8 Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Mon, 7 Oct 2019 09:19:06 -0400
Subject: [PATCH 14/21] Update config.yml

---
 .circleci/config.yml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 17fb7c9..5dfe7cc 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -162,9 +162,6 @@ jobs:
         docker-image-name: $IMAGE_NAME:$CIRCLE_SHA1
 
   test-scan-clair:
-    machine:
-      image: ubuntu-1604:201903-01
-      docker_layer_caching: true    # default - false
     environment:
       IMAGE_NAME: rfaircloth/scs
     steps:

From feff30cae99663c826c313c0c8951317dd5d245f Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Mon, 7 Oct 2019 09:20:00 -0400
Subject: [PATCH 15/21] Update config.yml

---
 .circleci/config.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 5dfe7cc..c16809e 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -162,10 +162,13 @@ jobs:
         docker-image-name: $IMAGE_NAME:$CIRCLE_SHA1
 
   test-scan-clair:
+    docker:
+      - image: 'circleci/buildpack-deps:stretch'
     environment:
       IMAGE_NAME: rfaircloth/scs
     steps:
-
+    - checkout
+    - setup_remote_docker
     - clair-scanner/scan:
         image: $IMAGE_NAME:$CIRCLE_SHA1
         whitelist: clair-whitelist.yml

From a7cd8535f3df45a923dcaeaf81a721d2e231472b Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Mon, 7 Oct 2019 09:26:46 -0400
Subject: [PATCH 16/21] Update config.yml

---
 .circleci/config.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index c16809e..37e6a5e 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -167,8 +167,6 @@ jobs:
     environment:
       IMAGE_NAME: rfaircloth/scs
     steps:
-    - checkout
-    - setup_remote_docker
     - clair-scanner/scan:
         image: $IMAGE_NAME:$CIRCLE_SHA1
         whitelist: clair-whitelist.yml

From 277f856e25c9104852391fd98b8ca8f4fdc2ec04 Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Mon, 7 Oct 2019 09:30:28 -0400
Subject: [PATCH 17/21] Update config.yml

---
 .circleci/config.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 37e6a5e..1ba4fe6 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -158,6 +158,7 @@ jobs:
     - checkout
     - setup_remote_docker
     - run: docker pull $IMAGE_NAME:$CIRCLE_SHA1
+    - run: sudo mkdir /clair-reports
     - snyk/scan:
         docker-image-name: $IMAGE_NAME:$CIRCLE_SHA1
 

From 311454f7986ae225c70d485f8e2e74a112db3ace Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Mon, 7 Oct 2019 09:38:21 -0400
Subject: [PATCH 18/21] Update config.yml

---
 .circleci/config.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 1ba4fe6..7c24dd0 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -151,7 +151,7 @@ jobs:
           path: test-results
   test-scan-synk:
     docker:
-      - image: 'circleci/buildpack-deps:stretch'
+      - image: 'circleci/buildpack-deps:stable'
     environment:
       IMAGE_NAME: rfaircloth/scs
     steps:
@@ -164,7 +164,7 @@ jobs:
 
   test-scan-clair:
     docker:
-      - image: 'circleci/buildpack-deps:stretch'
+      - image: 'docker:stable'
     environment:
       IMAGE_NAME: rfaircloth/scs
     steps:

From 2673b71716d8e2fa1453de0624d72fe32395fe87 Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Mon, 7 Oct 2019 09:45:44 -0400
Subject: [PATCH 19/21] Update config.yml

---
 .circleci/config.yml | 78 ++++++++++++++++++++++++++++++++++++--------
 1 file changed, 64 insertions(+), 14 deletions(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 7c24dd0..c79348b 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -158,7 +158,6 @@ jobs:
     - checkout
     - setup_remote_docker
     - run: docker pull $IMAGE_NAME:$CIRCLE_SHA1
-    - run: sudo mkdir /clair-reports
     - snyk/scan:
         docker-image-name: $IMAGE_NAME:$CIRCLE_SHA1
 
@@ -168,19 +167,70 @@ jobs:
     environment:
       IMAGE_NAME: rfaircloth/scs
     steps:
-    - clair-scanner/scan:
-        image: $IMAGE_NAME:$CIRCLE_SHA1
-        whitelist: clair-whitelist.yml
-#    - run:
-#        command: |
-#          mkdir -p /root/project/test-results
-#          pip install -r requirements.txt
-#          python clair_to_junit_parser.py "/clair-reports/$IMAGE_NAME:$CIRCLE_SHA1.json" --output test-results/results.xml
-#        when: on_fail
-#    - store_test_results:
-#        path: test-results/results.xml
-#    - store_artifacts:
-#        path: /clair-reports
+      - checkout
+      - setup_remote_docker:
+      - run:
+          name: "Vulnerability scan"
+          command: |
+            #!/usr/bin/env bash
+
+            set -e
+
+            REPORT_DIR=clair-reports
+            mkdir $REPORT_DIR
+
+            DB=$(docker run -p 5432:5432 -d arminc/clair-db:latest)
+            CLAIR=$(docker run -p 6060:6060 --link "$DB":postgres -d arminc/clair-local-scan:latest)
+            CLAIR_SCANNER=$(docker run -v /var/run/docker.sock:/var/run/docker.sock -d ovotech/clair-scanner@sha256:53fe8e8ac63af330d2dfc63498d23d8825d07f916f7d230271176de06d12acd6 tail -f /dev/null)
+
+            clair_ip=$(docker exec -it "$CLAIR" hostname -i | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+')
+            scanner_ip=$(docker exec -it "$CLAIR_SCANNER" hostname -i | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+')
+
+            docker cp "clair-whitelist.yml" "$CLAIR_SCANNER:/whitelist.yml"
+            WHITELIST="-w /whitelist.yml"
+
+            function scan() {
+                local image=$1
+                # replace forward-slashes and colons with underscores
+                munged_image=$(echo "$image" | sed 's/\//_/g' | sed 's/:/_/g')
+                sanitised_image_filename="${munged_image}.json"
+                local ret=0
+                local docker_cmd=(docker exec -it "$CLAIR_SCANNER" clair-scanner \
+                    --ip "$scanner_ip" \
+                    --clair=http://"$clair_ip":6060 \
+                    -t "high" \
+                    --report "/$sanitised_image_filename" \
+                    --log "/log.json" ${WHITELIST:+"-x"}
+                    --reportAll=true \
+                    --exit-when-no-features=false \
+                    "$image")
+
+                docker pull "$image"
+
+                "${docker_cmd[@]}" 2>&1 || ret=$?
+                if [ $ret -eq 0 ]; then
+                    echo "No unapproved vulnerabilities"
+                elif [ $ret -eq 1 ]; then
+                    echo "Unapproved vulnerabilities found"
+                    EXIT_STATUS=1
+                elif [ $ret -eq 5 ]; then
+                    echo "Image was not scanned, not supported."
+                    EXIT_STATUS=1
+                else
+                    echo "Unknown clair-scanner return code $ret."
+                    EXIT_STATUS=1
+                fi
+
+                docker cp "$CLAIR_SCANNER:/$sanitised_image_filename" "$REPORT_DIR/$sanitised_image_filename" || true
+            }
+
+            EXIT_STATUS=0
+
+            scan "$IMAGE_NAME:$CIRCLE_SHA1"
+
+            exit $EXIT_STATUS
+      - store_artifacts:
+          path: clair-reports
 
 
   publish-common:

From ce0e85e1be4ccf0a232bc303e1d8bd5f85964404 Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Mon, 7 Oct 2019 09:47:34 -0400
Subject: [PATCH 20/21] Update config.yml

---
 .circleci/config.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index c79348b..3be25bd 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -156,7 +156,8 @@ jobs:
       IMAGE_NAME: rfaircloth/scs
     steps:
     - checkout
-    - setup_remote_docker
+    - setup_remote_docker:
+        docker_layer_caching: true
     - run: docker pull $IMAGE_NAME:$CIRCLE_SHA1
     - snyk/scan:
         docker-image-name: $IMAGE_NAME:$CIRCLE_SHA1
@@ -169,6 +170,7 @@ jobs:
     steps:
       - checkout
       - setup_remote_docker:
+          docker_layer_caching: true
       - run:
           name: "Vulnerability scan"
           command: |

From 3cecbca82c8411a022b2ef23f3d0d496b7fbe675 Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Mon, 7 Oct 2019 10:19:33 -0400
Subject: [PATCH 21/21] disable clair scanner

---
 .circleci/config.yml | 63 +++-------------------------------------
 clair-scan.sh        | 68 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 72 insertions(+), 59 deletions(-)
 create mode 100755 clair-scan.sh

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 3be25bd..8dc6844 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -174,63 +174,7 @@ jobs:
       - run:
           name: "Vulnerability scan"
           command: |
-            #!/usr/bin/env bash
 
-            set -e
-
-            REPORT_DIR=clair-reports
-            mkdir $REPORT_DIR
-
-            DB=$(docker run -p 5432:5432 -d arminc/clair-db:latest)
-            CLAIR=$(docker run -p 6060:6060 --link "$DB":postgres -d arminc/clair-local-scan:latest)
-            CLAIR_SCANNER=$(docker run -v /var/run/docker.sock:/var/run/docker.sock -d ovotech/clair-scanner@sha256:53fe8e8ac63af330d2dfc63498d23d8825d07f916f7d230271176de06d12acd6 tail -f /dev/null)
-
-            clair_ip=$(docker exec -it "$CLAIR" hostname -i | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+')
-            scanner_ip=$(docker exec -it "$CLAIR_SCANNER" hostname -i | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+')
-
-            docker cp "clair-whitelist.yml" "$CLAIR_SCANNER:/whitelist.yml"
-            WHITELIST="-w /whitelist.yml"
-
-            function scan() {
-                local image=$1
-                # replace forward-slashes and colons with underscores
-                munged_image=$(echo "$image" | sed 's/\//_/g' | sed 's/:/_/g')
-                sanitised_image_filename="${munged_image}.json"
-                local ret=0
-                local docker_cmd=(docker exec -it "$CLAIR_SCANNER" clair-scanner \
-                    --ip "$scanner_ip" \
-                    --clair=http://"$clair_ip":6060 \
-                    -t "high" \
-                    --report "/$sanitised_image_filename" \
-                    --log "/log.json" ${WHITELIST:+"-x"}
-                    --reportAll=true \
-                    --exit-when-no-features=false \
-                    "$image")
-
-                docker pull "$image"
-
-                "${docker_cmd[@]}" 2>&1 || ret=$?
-                if [ $ret -eq 0 ]; then
-                    echo "No unapproved vulnerabilities"
-                elif [ $ret -eq 1 ]; then
-                    echo "Unapproved vulnerabilities found"
-                    EXIT_STATUS=1
-                elif [ $ret -eq 5 ]; then
-                    echo "Image was not scanned, not supported."
-                    EXIT_STATUS=1
-                else
-                    echo "Unknown clair-scanner return code $ret."
-                    EXIT_STATUS=1
-                fi
-
-                docker cp "$CLAIR_SCANNER:/$sanitised_image_filename" "$REPORT_DIR/$sanitised_image_filename" || true
-            }
-
-            EXIT_STATUS=0
-
-            scan "$IMAGE_NAME:$CIRCLE_SHA1"
-
-            exit $EXIT_STATUS
       - store_artifacts:
           path: clair-reports
 
@@ -341,9 +285,10 @@ workflows:
       - test-scan-synk:
           requires:
             - build
-      - test-scan-clair:
-          requires:
-            - build
+#Clair scanner image is broken using synk for now
+#      - test-scan-clair:
+#          requires:
+#            - build
       - publish-common:
           requires:
             - dgoss
diff --git a/clair-scan.sh b/clair-scan.sh
new file mode 100755
index 0000000..e890ce3
--- /dev/null
+++ b/clair-scan.sh
@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+
+            set -e
+
+            REPORT_DIR=clair-reports
+            mkdir $REPORT_DIR || true
+
+            #DB=$(docker run -p 5432:5432 -d arminc/clair-db:latest)
+            docker run -p 5432:5432 -d --rm --name db arminc/clair-db:latest
+            #CLAIR=$(docker run -p 6060:6060 --link "$DB":postgres -d arminc/clair-local-scan:latest)'
+            sleep 30
+            docker run -p 6060:6060 --link db:postgres -d --rm --name clair arminc/clair-local-scan:latest
+            #CLAIR_SCANNER=$(docker run -v /var/run/docker.sock:/var/run/docker.sock --link clair:clair --name clairscanner --rm -d ovotech/clair-scanner@sha256:53fe8e8ac63af330d2dfc63498d23d8825d07f916f7d230271176de06d12acd6 tail -f /dev/null)
+
+            CLAIR_SCANNER=$(docker run --link clair:clair --name clairscanner --rm -d ovotech/clair-scanner@sha256:53fe8e8ac63af330d2dfc63498d23d8825d07f916f7d230271176de06d12acd6 tail -f /dev/null)
+
+            #clair_ip=$(docker exec -it "$CLAIR" hostname -i | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+')
+            #scanner_ip=$(docker exec -it "$CLAIR_SCANNER" hostname -i | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+')
+
+            docker cp "clair-whitelist.yml" "$CLAIR_SCANNER:/whitelist.yml"
+            WHITELIST="-w /whitelist.yml"
+
+            function scan() {
+                echo Scanning $1
+                local image=$1
+                # replace forward-slashes and colons with underscores
+                munged_image=$(echo "$image" | sed 's/\//_/g' | sed 's/:/_/g')
+                sanitised_image_filename="${munged_image}.json"
+                local ret=0
+                #--ip "$scanner_ip" \
+                #
+                local docker_cmd=(docker exec -it "$CLAIR_SCANNER" clair-scanner \
+                    --clair=http://clair:6060 \
+                    -t "high" \
+                    --report "$REPORT_DIR/$sanitised_image_filename" \
+                    --log "$REPORT_DIR/log.json" --whitelist=${WHITELIST:+"-x"}
+                    --reportAll=true \
+                    --exit-when-no-features=false \
+                    "$image")
+
+                docker pull "$image"
+
+                "${docker_cmd[@]}" 2>&1 || ret=$?
+                if [ $ret -eq 0 ]; then
+                    echo "No unapproved vulnerabilities"
+                elif [ $ret -eq 1 ]; then
+                    echo "Unapproved vulnerabilities found"
+                    EXIT_STATUS=1
+                elif [ $ret -eq 5 ]; then
+                    echo "Image was not scanned, not supported."
+                    EXIT_STATUS=1
+                else
+                    echo "Unknown clair-scanner return code $ret."
+                    EXIT_STATUS=1
+                fi
+
+                docker cp "$CLAIR_SCANNER:/$sanitised_image_filename" "$REPORT_DIR/$sanitised_image_filename" || true
+            }
+
+            EXIT_STATUS=0
+
+            scan "$IMAGE_NAME:$CIRCLE_SHA1"
+
+            docker kill clairscanner
+            docker kill clair
+            docker kill db
+
+            exit $EXIT_STATUS
\ No newline at end of file