carbon-black-cloud-container-cli (also known as cbctl) is a CLI tool that can be used to scan any container-based images in the command line or in CI/CD pipelines.

To Linux:

CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
  go build  \
   -tags="containers_image_openpgp exclude_graphdriver_devicemapper exclude_graphdriver_btrfs" \
   -ldflags "-X 'github.com/vmware/carbon-black-cloud-container-cli/internal/version.version=${version}' \
             -X 'github.com/vmware/carbon-black-cloud-container-cli/internal/version.buildDate=${build_date}'" \
   main.go

To MacOS:

CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 \
  go build  \
   -tags="containers_image_openpgp exclude_graphdriver_devicemapper exclude_graphdriver_btrfs" \
   -ldflags "-X 'github.com/vmware/carbon-black-cloud-container-cli/internal/version.version=${version}' \
             -X 'github.com/vmware/carbon-black-cloud-container-cli/internal/version.buildDate=${build_date}'" \
   main.go

The detailed usage of cbctl can be found here: Carbon Black Container CLI

We exposed bom generation and scan image functions for convenient image scanning process, you can follow the following steps to get started:

$ go get -u github.com/vmware/carbon-black-cloud-container-cli

1. Create a pair of API ID & Key with workloads.container.image (CREATE and READ permissions) access level in Carbon Black Cloud console
2. Create a RegistryHandler for generating Software Bill of Materials (SBOM) from user's input:
   1. Create RegistryHandler: registryHandler := scan.NewRegistryHandler()
   2. Get the SBOM (options can be checked below): sbom, err := registryHandler.Generate(input, scan.Option)
3. Create a ScanHandler for scanning vulnerabilities from SBOM:
   1. Create ScanHandler: scanHandler := scan.NewScanHandler(<CBC_saasURL>, <CBC_orgKey>, <apiID>, <apiKey>, <sbom>);
   2. Scan the SBOM (options can be checked below): scannedImage, err := scanHandler.Scan(scan.Option)

Please follow CONTRIBUTING.md

Apache-2.0