tree ddb46391f99c3b9748b57af084849c3ea4a516d7
parent 1f59111d4218ed75a30eb135611d7d58900e6e00
author Jonathan Amsterdam <jba@google.com> 1647375691 -0400
committer Jonathan Amsterdam <jba@google.com> 1647470260 +0000

internal/worker: scan modules for vulnerabilities

This is the first CL for a new task for the vuln worker: to scan
a selected set of modules for vulnerabilities.

Establish a new server endpoint, /scan-modules, to do that.
Currently visiting that endpoint scans the list of modules unconditionally.
A future CL will skip the scan if the vuln DB hasn't changed.

Hardcode a list of modules in the golang.org/x namespace.
Fetch each one from the proxy, and run vulncheck on it.

At present we just log any vulnerabilities we find. Later we'll
file issues to a GitHub repo.

Lastly, change the base image for the service to one that
has the go toolchain, since go/packages requires it.

Change-Id: I1de571d24d683b080542c5c40b55767967dbe8a5
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/393174
Trust: Jonathan Amsterdam <jba@google.com>
Run-TryBot: Jonathan Amsterdam <jba@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Damien Neil <dneil@google.com>