Terrier is a Image and Container analysis tool that can be used to scan Images and Containers to identify and verify the presence of specific files according to their hashes.
License: Apache License 2.0
pull/run the container:
docker pull reliableembeddedsystems/oci-lighttpd:latest
docker run -p 8079:80 --interactive --tty --entrypoint=/bin/ash reliableembeddedsystems/oci-lighttpd:latest --login
In the container:
sha256sum /lib/libBrokenLocale-2.31.so
f899be243afeb1f820c87063a0c4ea7a4ea9dbbe56f233136813c53588d003ef /lib/libBrokenLocale-2.31.so
exit
create an image usable by terrier:
sudo docker save 458c2cb0b638 -o image.tar
sudo mkdir image && cd image
sudo tar xvf ../image.tar
cd 968cdb1a5815591c1e84ee7e5862be582d1b824c2a6e9bc21cfbc086ec77f215
sudo mkdir rootfs && cd rootfs
sudo tar xvf ../layer.tar
sha256sum of the lib:
sha256sum lib/libBrokenLocale-2.31.so
f899be243afeb1f820c87063a0c4ea7a4ea9dbbe56f233136813c53588d003ef lib/libBrokenLocale-2.31.so
create sha256sum of all files
sudo sh -c "find . -type f \( ! -iname sha256list \) -exec sha256sum {} \; > sha256list"
copy it somewhere:
rm -f ../../../sha256list
sudo cp sha256list ../../../
just to make sure it's still all sane:
cat sha256list | grep Broken
f899be243afeb1f820c87063a0c4ea7a4ea9dbbe56f233136813c53588d003ef ./lib/libBrokenLocale-2.31.so
convert the sha256list into a yml file usable by terrier:
convertSHA.sh sha256list image.tar.yml
still sane?
cat image.tar.yml | grep -A2 libBrokenLocale-2.31.so
- name: '/lib/libBrokenLocale-2.31.so'
hashes:
- hash: 'f899be243afeb1f820c87063a0c4ea7a4ea9dbbe56f233136813c53588d003ef'
adjust the yml file to point to the tarball
vi image.tar.yml
image: image.tar.yml -> image: image.tar
run terrier
terrier -cfg image.tar.yml
[+] Loading config: image.tar.yml
[+] Analysing Image
[+] Docker Image Source: image.tar
[*] Inspecting Layer: 968cdb1a5815591c1e84ee7e5862be582d1b824c2a6e9bc21cfbc086ec77f215
[!] Not all components were identifed: (1/237)
[!] Component not identified: /lib/libBrokenLocale-2.31.so
Hmm now it's getting freaky ;)
When I turn on veryverbose:
terrier -cfg image.tar.yml | grep libBrokenLocale-2.31.so
[*] Linkname File: ./lib/libBrokenLocale.so.1 libBrokenLocale-2.31.so
[*] Analysing File: ./lib/libBrokenLocale-2.31.so
[*] Linkname File: ./lib/libBrokenLocale-2.31.so
[*] File is TypeReg: ./lib/libBrokenLocale-2.31.so
[*] File not found in tar: /lib/libBrokenLocale-2.31.so
...
File not found in tar: /lib/libBrokenLocale-2.31.so repeats many times
...
*] File not found in tar: /lib/libBrokenLocale-2.31.so
[!] Component not identified: /lib/libBrokenLocale-2.31.so
There are 237 sha256 checksums and files and 236 work ;)
cat sha256list | wc
237 474 23003
Can you please advise and tell me what's different with this specific library so it can not be found by terrier?
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.