add command to surface vulnerability scan report for a bundle about imgpkg HOT 5 OPEN

To try to clarify the ask here, the idea would be to try to integrate with the Registry and the Registry would do the scan. Or the idea is that imgpkg should integrate directly with tools like trivy and claire, as Harbour does?

The following registries do vulnerability check already:

• Harbor does not export an API
• quay
• Google Cloud Registry
• Azure Container Registry, does the vulnerability check but doesn't look like it gives and API to get that information
• Amazon Container Registry
• Docker has a CLI plugin that uses Snyk to do the scan but doesn't look like it as an API

from imgpkg.

Registry would do the scan

some other service (like registry) would do the scan. imgpkg hopefully would be able to retrieve results for the scan since it knows which images are in the bundle.

from imgpkg.

This seems like a good idea, it's unfortunate that there isn't a universal API that we could try to target regardless of registry used. Though, we could always figure out the registry and have a mapping to their endpoints (if available).

What format should this output take? Would this be a part of some automation around e.g. failing a CI if an image has vulnerabilities? Or is there any automation component to this request?

from imgpkg.

@DennisDenuto and I were reviewing this further, and we will go ahead and add a story to our backlog to further discuss how to make this happen.

from imgpkg.

+1 this would be a great feature!

from imgpkg.