Configuring IBM Cloud Code Risk Analyzer scans

Configuring scans

To generate the SBOM file, a Code Risk Analyzer scan accesses artifacts in the specified directory path and performs deep discovery to identify all of the dependencies; including trasitive dependencies. There are no specific pipeline environment variables that are needed to generate the SBOM file and discover vulnerabilities, but if the path contains a Dockerfile, the base image is pulled and images are built for each build stage specified in the file.

If your Dockerfile requires ARGS, set an individual ARG as an environment variable in a custom script and provide the location of the custom script as the pipeline vairable.

For more information, see custom scripts

By default, Terraform files are not analyzed. To scan your Terraform file, you must set the following pipeline environment variables.

The Code Risk Analyzer scan utilizes the API key provided to log in to the IBMCloud CLI and triggers a Docker build. The existing IBM Cloud CLI session is continued to be used for the remainder of this CRA step. However, the IBM Cloud CLI session expires after 20 minutes for a standard API key login. If the build process takes longer than 20 minutes, the CRA step will fail with a 401 error message since the session has expired. An environment variable ibmcloud-enable-session-keep-alive has been introduced to keep the IBMCloud CLI session alive for such long operations.

By default, The Code Risk Analyzer deployment-analyze command runs configuration checks on Kubernetes deployment manifests. The Code Risk Analyzer deployment-analyze command runs with the --strict option set. To ignore files during Code Risk Analyzer deployment-analyze scan, the following environment variable has to be used.

Omitting vulnerabilities to deploy your app

The Code Risk Analyzer is designed to find vulnerable packages before an adivsory board does. In exceptional circumstances, you might need to deploy your application even if vulnerable packages have been detected and have not yet been fixed. Whenever possible, you should update the packages or remove them before redeploying your code.

To ignore specific files and complete your push to production, you can create a file called .cra/.cveignore in the scanned repository's root with the following schema:

[
  {
    "cve": "string",
    "alwaysOmit": "bool",
    "untilRemediationAvailable": "bool",
    "expiration": "string"
  },
]

The following code snippet shows a sample .cveignore file:

[
  {
    "cve": "CVE-2021-27290",
    "alwaysOmit": true
  },
  {
    "cve": "CVE-2020-8244",
    "untilRemediationAvailable": true,
  },
  {
    "cve": "CLAIR-JAVA-ORGAPACHEHTTPCOMPONENTS-31517",
    "expiration": "2022-02-10T22:08:41+04:00",
    "comment": "Additional security measures are in place"
  }
]

This file used to be known as .craveomit. The original file format has been deprecated and replaced by .cra/.cveignore. Please update your code to use the most recent file.

You can learn more about the Code Risk Analyzer plug-in's docs, or you can also check the deprecated CRA docs.

Automatically remediating vulnerabilities

You can use the Code Risk Analyzer as part of the Continuous Compliance (CC) pipeline to not only find but automatically remediate vulnerabiltiies. The Code Risk Analyzer works as part of the compliance-check step of the pipeline. By default, auto-remediation is turned off.

Auto-remediation is available for the CC pipeline only.

When auto-remediation is turned on, the Code Risk Analyzer attempts to update a vulnerable package to a non-vunlnerable version by creating a pull request with the identified fixes against the default branch of your repo. By default, the Code Risk Analyzer will update minor and patch versions for the main vulnerable package as well as dependent packages, but does not update the major version of a package. If the pull request is acceptable, you can manually approve and merge it. Each time the pipeline is run, a new pull request is generated, so be sure to review and merge as they are opened to avoid duplications.

Auto-remediation is available for the both Enterprise GitHub and GitLab repositories and can modify the files specified in the following table.

To start automatically remediating vulnerabilities, set the following optional environment variables for your pipeline.