Merge pull request #315 from replicatedcom/divolgin/cve

Make and readme updates with info used to make this release

Author: divolgin

.circleci/config.yml

@@ -30,15 +30,10 @@ jobs:
     steps:
       - checkout
       - setup_remote_docker
-      - run:
-          name: Build image
-          command: |
-            docker build --pull -t replicated/support-bundle:base -f deploy/Dockerfile-base deploy/
       - run:
           name: Run local image vulnerability scan
           command: |
-            curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b .
-            ./grype --fail-on=medium --only-fixed --config=.circleci/.anchore/grype.yaml -vv replicated/support-bundle:base
+            make scan-base
 
   e2e:
     # Use machine for volume binding support in Docker

.gitignore

@@ -22,3 +22,4 @@
 *.out
 
 .DS_Store
+grype

Makefile

@@ -221,3 +221,12 @@ support-bundle-generate: goreleaser
 	@mkdir -p .state
 	docker build --pull -t replicated/support-bundle:base -f deploy/Dockerfile-base deploy/
 	@touch .state/base
+
+grype:
+	curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b .
+
+build-base:
+	docker build --pull -t replicated/support-bundle:base -f deploy/Dockerfile-base deploy/
+
+scan-base: build-base grype
+	./grype --fail-on=medium --only-fixed --config=.circleci/.anchore/grype.yaml -vv replicated/support-bundle:base

README.md

@@ -18,6 +18,12 @@ make test
 make e2e-supportbundle-core e2e-supportbundle-docker
 ```
 
+## Scanning image prior to release
+
+```
+make scan-base
+```
+
 ## Releases
 
 Releases are created on CircleCI when a tag is pushed.