Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Invalid detection of CIS-DI-0010 if specfic versions are installed #250

Open
030 opened this issue Dec 9, 2023 · 0 comments
Open

Invalid detection of CIS-DI-0010 if specfic versions are installed #250

030 opened this issue Dec 9, 2023 · 0 comments
Assignees
Labels
bug Something isn't working

Comments

@030
Copy link

030 commented Dec 9, 2023

Description

RUN apk add --no-cache
libcrypto3=3.1.4-r1
libssl3=3.1.4-r1

What did you expect to happen?

no CIS-DI-0010 as packages are installed and it are no environment variables

What happened instead?

FATAL - CIS-DI-0010: Do not store credential in environment variables/files
* Suspicious ENV key found : libcrypto3 on RUN /bin/sh -c apk add --no-cache libcrypto3=3.1.4-r1 libssl3=3.1.4-r1 # buildkit (You can suppress it with --accept-key)

Output of run with -debug:

(paste your output here)

Output of dockle -v:

v0.4.13

Additional details (base image name, container registry info...):

@030 030 added the bug Something isn't working label Dec 9, 2023
@tomoyamachi tomoyamachi self-assigned this Feb 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants