attestor | A Shape Analysis Tool based on Graph Grammars

by moves-rwth Java Version: 0.4.1 License: GPL-3.0

X-Ray Key Features Code Snippets(3)Community Discussions(3)Vulnerabilities Install Support

kandi X-RAY | attestor Summary

attestor is a Java library. attestor has no bugs, it has no vulnerabilities, it has build file available, it has a Strong Copyleft License and it has low support. You can download it from GitHub, Maven.

Attestor is a graph-based tool for analysing Java programs operating on dynamic data structures. It involves the generation of an abstract state space employing user-supplied graph grammars or, alternatively, formulas in a fragment of symbolic heap separation logic. LTL model checking is then applied to the generated state space, supporting both structural and functional correctness properties. The analysis is fully automated, procedure-modular, and provides visual feedback including counterexamples in case of property violations. As an alternative to graphs, Attestor also supports a fragment of symbolic heap separation logic with user-supplied inductive predicate definitions as an input.

Support

Quality

Security

License

Reuse

Support

attestor has a low active ecosystem.

It has 9 star(s) with 4 fork(s). There are 7 watchers for this library.

It had no major release in the last 12 months.

attestor has no issues reported. There are 4 open pull requests and 0 closed requests.

It has a neutral sentiment in the developer community.

The latest version of attestor is 0.4.1

Quality

attestor has 0 bugs and 0 code smells.

Security

attestor has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

attestor code analysis shows 0 unresolved vulnerabilities.

There are 0 security hotspots that need review.

License

attestor is licensed under the GPL-3.0 License. This license is Strong Copyleft.

Strong Copyleft licenses enforce sharing, and you can use them when creating open source projects.

Reuse

attestor releases are available to install and integrate.

Deployable package is available in Maven.

Build file is available. You can build the component from source.

Installation instructions, examples and code snippets are available.

It has 36115 lines of code, 3257 functions and 519 files.

It has medium code complexity. Code complexity directly impacts maintainability of the code.

Top functions reviewed by kandi - BETA

kandi's functional review helps you automatically verify the functionalities of the libraries and avoid rework.
Currently covering the most popular Java, JavaScript and Python libraries. See a Sample of attestor

Get all kandi verified functions for this library.

attestor Key Features

No Key Features are available at this moment for attestor.

attestor Examples and Code Snippets

Quickstart,Reproducing Benchmarks

Java

Lines of Code : 5

License : Strong Copyleft (GPL-3.0)

Copy

 $ git clone https://github.com/moves-rwth/attestor-examples.git
 $ chmod +x run.sh
 $ ./run.sh

 $ git clone https://github.com/moves-rwth/attestor-examples.git
 $ mvn clean install exec:exec@run

Quickstart,Installation

Java

Lines of Code : 2

License : Strong Copyleft (GPL-3.0)

Copy

$ git clone https://github.com/moves-rwth/attestor.git
$ mvn install

Quickstart,Getting Started

Java

Lines of Code : 2

License : Strong Copyleft (GPL-3.0)

Copy

 attestor--jar-with-dependencies.jar 

 $ java -jar attestor--jar-with-dependencies.jar

Community Discussions

Trending Discussions on attestor

Binary Authorization for Cloud Run vs gcloud vulnerability filter

Jenkins declarative pipeline 'when' condition ignoring env var value

How to delete added attestation in google cloud platform's kubernetes engine image authorization process

QUESTION

Binary Authorization for Cloud Run vs gcloud vulnerability filter

Asked 2022-Apr-03 at 19:25

I have enabled automatic vulnerability scanning for my images in Google's Container Registry and was thinking now to use Binary Authorization to let my Cloud Run services only be deployed for images that pass a policy.

I read through the documentation https://cloud.google.com/binary-authorization/docs/creating-attestations-kritis and so I need to create an attestor, use this kritis signer to sign an image and create attestations based on my policy and only then the Cloud Run service would be deployed.

I'm wondering if all of this is really necessary in my case.

In my Github Actions CI/CD pipelines I could use the gcloud command gcloud beta container images describe HOSTNAME/PROJECT_ID/IMAGE_ID@sha256:HASH --show-package-vulnerability to view the vulnerabilities for a newly uploaded and scanned image and have my Pipeline fail if I find any vulnerabilities for a certain severity (e.g. critical) or even ignore certain CVEs before the Cloud Run service deployment with the new image. So I could basically achieve the same as the options available in the policy here https://github.com/grafeas/kritis/blob/HEAD/samples/signer/policy.yaml used by the kritis signer.

A gcloud command seems a lot simpler than implementing this whole process of using the kritis signer tool, creating attestations etc.

So are there any advantages or security reasons why I should use Binary authorization and follow that process instead of using the gcloud filter check in my CI/CD pipelines?

Thank you in advance for any help.

...

ANSWER

Answered 2022-Apr-03 at 19:25

There is 2 different layers:

On one side, you check that your container doesn't content any known vulnerability
On the other side, Binary Authorization, you check that you deploy a container from an authorized registry

Imagine the case:

You correctly check the container CVE in your CI/CD pipeline and you store it in your registry
Someone deploy a container from another registry.

Even if you check YOUR container in YOUR registry, you doesn't protect Cloud Run against a deployment from another registry.

So, all your efforts are useless!

Source https://stackoverflow.com/questions/71727346

QUESTION

Jenkins declarative pipeline 'when' condition ignoring env var value

Asked 2021-Dec-13 at 14:27

I want a specific stage to run if a variable in the pipeline is null i.e. A gcloud command runs in one stage, if the output of this command is nothing, then the next stage should run. If it has a value, don't run the next stage.

Here's the stage which runs a gcloud command to populate the ATTESTATION variable with a value if an image has been attested by binary authorisation before.

N.B. There are some global variables such as the ATTESTOR_NAME, GIT_COMMIT and DOCKER_IMAGE_NAME which are defined earlier but not showing here for simplicity - the commands do work when I execute in a terminal so there is nothing wrong with the commands themselves.

...

ANSWER

Answered 2021-Dec-13 at 14:27

Thanks to @ymochurad for this answer in the comments. Simply changing the comparison from null to '' worked!!

If I am not mistaken comparing it to null checks if variable exists at all. And in your case it is set to empty string. Did you try to compare to empty string like: expression { env.ATTESTATION == '' }

Source https://stackoverflow.com/questions/70332870

QUESTION

How to delete added attestation in google cloud platform's kubernetes engine image authorization process

Asked 2020-Jan-09 at 12:40

I have added an attestation on google cloud platform to use for image signing and attestation by the attestor and want to remove the added attestation but I can't seem to find any documentation on how this is done or even if this is how is should be done.

I have seen the one for removal of the attestor but none on removing of deleting the attestation. I had added it using the following command:

Official documentation version:

...

ANSWER

Answered 2020-Jan-09 at 12:40

Looks like somekind of underlying resources(the error messages indicates that) are still need to be deleted.

Found some documentation on binary authorization where they have explained complete tear down and clean-up. It looks like apart from the attestor, we need to delete some other connected resources as well.

Source https://stackoverflow.com/questions/59641116

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install attestor

What is Attestor?
System Requirements
Reproducing Benchmarks (without installation)
Installation
Getting Started
A Guided Tour
We distribute executable .jar files of stable Attestor releases on maven central. To install the latest version of Attestor, please proceed as follows:. Please note that the installation requires an internet connection as maven will install additional dependencies.
After installation, an executable jar file is created in the directory target within the cloned repository. The name of executable jar is of the form. where <VERSION> is the previously cloned version of the Attestor repository. To execute Attestor, it suffices to run. from within the target directory. This should display a help page explaining all available command line options. Since the above jar file contains all dependencies, it is safe to rename it and move the file to a more convenient directory.