API tools faq
paste
Guest User

Untitled

a guest
Sep 11th, 2026
23
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 12.42 KB | None | 0 0
raw download clone embed print report
  1. #!/usr/bin/env bash
  2. set -Eeuo pipefail
  3.  
  4. # Build current upstream Greenbone scanner/openvasd and openvas-smb images with
  5. # debug symbols. The source is fetched at build time; use OPENVAS_REF and
  6. # OPENVAS_SMB_REF to make a build reproducible.
  7.  
  8. ROOT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)"
  9. SOURCE_DIR="${ROOT_DIR}/.openvas-source"
  10.  
  11. REGISTRY="${REGISTRY:-local}"
  12. IMAGE_PREFIX="${IMAGE_PREFIX:-openvas}"
  13. IMAGE_VERSION="${IMAGE_VERSION:-${VERSION:-latest}}"
  14. OPENVAS_REF="${OPENVAS_REF:-main}"
  15. OPENVAS_SMB_REF="${OPENVAS_SMB_REF:-main}"
  16. PLATFORM="${PLATFORM:-linux/amd64}"
  17. BUILDER="${BUILDER:-openvas-debug-builder}"
  18. PUSH="${PUSH:-0}"
  19. NO_CACHE="${NO_CACHE:-0}"
  20. SKIP_DOCKER_INSTALL="${SKIP_DOCKER_INSTALL:-0}"
  21. BUILD_FULL_STACK="${BUILD_FULL_STACK:-1}"
  22. COMPOSE_FILE="${COMPOSE_FILE:-${ROOT_DIR}/docker-compose.debug.yml}"
  23.  
  24. SCANNER_IMAGE="${REGISTRY}/${IMAGE_PREFIX}-scanner:debug"
  25. SMB_IMAGE="${REGISTRY}/${IMAGE_PREFIX}-smb:debug"
  26.  
  27. if [[ "${EUID}" -eq 0 ]]; then
  28. ROOT_CMD=()
  29. else
  30. command -v sudo >/dev/null || {
  31. echo "ERROR: run as root or install sudo" >&2
  32. exit 1
  33. }
  34. ROOT_CMD=(sudo)
  35. fi
  36.  
  37. build_debug_component() {
  38. local name="$1" repo="$2" ref="$3" image="$4" base_image="${5:-}"
  39. local source="${SOURCE_DIR}/${name}"
  40. local upstream_dockerfile debug_dockerfile
  41.  
  42. echo "Fetching ${name} (${ref})..."
  43. clone_or_update "${repo}" "${ref}" "${source}"
  44. upstream_dockerfile="${source}/.docker/prod.Dockerfile"
  45. if [[ ! -f "${upstream_dockerfile}" ]]; then
  46. upstream_dockerfile="$(find "${source}/.docker" -maxdepth 1 -type f -name 'prod*.Dockerfile' | sort | head -n 1)"
  47. fi
  48. debug_dockerfile="${source}/.docker/debug.Dockerfile"
  49.  
  50. # gvm-auth-lib currently has no upstream container Dockerfile. Build its
  51. # Rust library and C wrapper directly on Debian 13 instead.
  52. if [[ -z "${upstream_dockerfile}" && "${name}" == gvm-auth-lib ]]; then
  53. cat > "${debug_dockerfile}" <<'EOF'
  54. FROM rust:bookworm AS build
  55. RUN apt-get update && apt-get install --no-install-recommends -y \
  56. build-essential cmake pkg-config libssl-dev libc6-dev clang \
  57. python3 ca-certificates && rm -rf /var/lib/apt/lists/*
  58. COPY . /source
  59. WORKDIR /source
  60. RUN cargo build && \
  61. cmake -DCMAKE_BUILD_TYPE=Debug -DBUILD_TESTING=OFF -DBUILD_TESTS=OFF \
  62. -DCMAKE_INSTALL_PREFIX=/usr/local -B/build /source && \
  63. DESTDIR=/install cmake --build /build -j"$(nproc)" -- install
  64. FROM debian:13-slim
  65. COPY --from=build /install/ /
  66. RUN ldconfig
  67. ENV RUST_BACKTRACE=full RUST_LOG=debug G_LOG_LEVEL=debug
  68. EOF
  69. elif [[ -z "${upstream_dockerfile}" ]]; then
  70. echo "ERROR: no production Dockerfile found for ${name}" >&2
  71. return 1
  72. else
  73.  
  74. sed \
  75. -e 's/CMAKE_BUILD_TYPE=Release/CMAKE_BUILD_TYPE=Debug/g' \
  76. -e 's/cargo build --release/cargo build/g' \
  77. -e 's#target/release/#target/debug/#g' \
  78. -e 's#FROM registry.community.greenbone.net/community/openvas-scanner:${VERSION}#FROM ${OPENVAS_SCANNER_IMAGE}#g' \
  79. -e '/^CMD /i ENV RUST_BACKTRACE=full RUST_LOG=debug G_LOG_LEVEL=debug PYTHONUNBUFFERED=1 NODE_ENV=development' \
  80. "${upstream_dockerfile}" > "${debug_dockerfile}"
  81. if [[ -n "${base_image}" ]]; then
  82. sed -i '1i ARG OPENVAS_SCANNER_IMAGE' "${debug_dockerfile}"
  83. fi
  84. fi
  85.  
  86. local args=(--platform "${PLATFORM}" --file "${debug_dockerfile}" --tag "${image}" \
  87. --build-arg VERSION="${IMAGE_VERSION}" --build-arg GVM_LIBS_VERSION=stable \
  88. --build-arg BUILDKIT_INLINE_CACHE=1 \
  89. --label "org.opencontainers.image.title=${name}-debug")
  90. [[ "${NO_CACHE}" == 1 ]] && args+=(--no-cache)
  91. [[ -n "${base_image}" ]] && args+=(--build-arg "OPENVAS_SCANNER_IMAGE=${base_image}")
  92.  
  93. DOCKER_BUILDKIT=1 docker build "${args[@]}" "${source}"
  94. }
  95.  
  96. write_compose_file() {
  97. cat > "${COMPOSE_FILE}" <<EOF
  98. services:
  99. postgres:
  100. image: postgres:16
  101. restart: unless-stopped
  102. environment:
  103. POSTGRES_DB: gvmd
  104. POSTGRES_USER: gvmd
  105. POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-change-this-password}
  106. volumes:
  107. - pgdata:/var/lib/postgresql/data
  108.  
  109. redis:
  110. image: redis:7-alpine
  111. restart: unless-stopped
  112. volumes:
  113. - redisdata:/data
  114.  
  115. gvmd:
  116. image: ${REGISTRY}/${IMAGE_PREFIX}-gvmd:debug
  117. depends_on: [postgres, redis, ospd-openvas]
  118. volumes:
  119. - gvmd-run:/run/gvmd
  120. - gvm-data:/var/lib/gvm
  121. - gvmd-logs:/var/log/gvm
  122.  
  123. ospd-openvas:
  124. image: ${REGISTRY}/${IMAGE_PREFIX}-ospd-openvas:debug
  125. depends_on: [scanner]
  126. privileged: true
  127. volumes:
  128. - ospd-run:/run/ospd
  129. - gvm-data:/var/lib/gvm
  130. - ospd-logs:/var/log/gvm
  131.  
  132. scanner:
  133. image: ${SCANNER_IMAGE}
  134. privileged: true
  135. volumes:
  136. - gvm-data:/var/lib/gvm
  137.  
  138. gsad:
  139. image: ${REGISTRY}/${IMAGE_PREFIX}-gsad:debug
  140. depends_on: [gvmd]
  141. ports:
  142. - "${GSAD_PORT:-9392}:9392"
  143. volumes:
  144. - gvmd-run:/run/gvmd
  145. - gsad-run:/run/gsad
  146.  
  147. gsa:
  148. image: ${REGISTRY}/${IMAGE_PREFIX}-gsa:debug
  149. depends_on: [gsad]
  150. ports:
  151. - "${GSA_PORT:-8080}:80"
  152.  
  153. feed-sync:
  154. image: registry.community.greenbone.net/community/vulnerability-tests
  155. environment:
  156. FEED_RELEASE: "24.10"
  157. KEEP_ALIVE: 1
  158. volumes:
  159. - gvm-data:/mnt
  160.  
  161. volumes:
  162. pgdata:
  163. redisdata:
  164. gvm-data:
  165. gvmd-run:
  166. gvmd-logs:
  167. ospd-run:
  168. ospd-logs:
  169. gsad-run:
  170. EOF
  171. }
  172.  
  173. if [[ "${SKIP_DOCKER_INSTALL}" != 1 ]]; then
  174. [[ -r /etc/os-release ]] || {
  175. echo "ERROR: /etc/os-release not found; Debian 13 is required" >&2
  176. exit 1
  177. }
  178. # shellcheck disable=SC1091
  179. . /etc/os-release
  180. [[ "${ID:-}" == debian && "${VERSION_ID:-}" == 13* ]] || {
  181. echo "ERROR: this script supports Debian 13 (trixie); found ${PRETTY_NAME:-unknown}" >&2
  182. echo "Set SKIP_DOCKER_INSTALL=1 only if Docker and dependencies are already installed." >&2
  183. exit 1
  184. }
  185.  
  186. echo "Installing Debian 13 prerequisites and Docker Engine..."
  187. "${ROOT_CMD[@]}" apt-get update
  188. "${ROOT_CMD[@]}" apt-get install -y --no-install-recommends \
  189. ca-certificates curl git gnupg
  190.  
  191. "${ROOT_CMD[@]}" install -m 0755 -d /etc/apt/keyrings
  192. curl -fsSL https://download.docker.com/linux/debian/gpg | \
  193. "${ROOT_CMD[@]}" gpg --dearmor --yes -o /etc/apt/keyrings/docker.gpg
  194. "${ROOT_CMD[@]}" chmod a+r /etc/apt/keyrings/docker.gpg
  195.  
  196. arch="$(dpkg --print-architecture)"
  197. cat <<EOF | "${ROOT_CMD[@]}" tee /etc/apt/sources.list.d/docker.list >/dev/null
  198. deb [arch=${arch} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian trixie stable
  199. EOF
  200.  
  201. "${ROOT_CMD[@]}" apt-get update
  202. "${ROOT_CMD[@]}" apt-get install -y --no-install-recommends \
  203. docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
  204.  
  205. if command -v systemctl >/dev/null && systemctl is-system-running >/dev/null 2>&1; then
  206. "${ROOT_CMD[@]}" systemctl enable --now docker
  207. fi
  208. fi
  209.  
  210. command -v docker >/dev/null || { echo "ERROR: docker is required" >&2; exit 1; }
  211. command -v git >/dev/null || { echo "ERROR: git is required" >&2; exit 1; }
  212. docker buildx version >/dev/null || {
  213. echo "ERROR: Docker Buildx plugin is unavailable" >&2
  214. exit 1
  215. }
  216. docker info >/dev/null || {
  217. echo "ERROR: Docker daemon is not running or is inaccessible" >&2
  218. exit 1
  219. }
  220.  
  221. mkdir -p "${SOURCE_DIR}"
  222.  
  223. clone_or_update() {
  224. local repo="$1" ref="$2" destination="$3"
  225. if [[ -d "${destination}/.git" ]]; then
  226. git -C "${destination}" fetch --depth 1 origin "${ref}"
  227. git -C "${destination}" checkout --detach FETCH_HEAD
  228. else
  229. git clone --depth 1 --branch "${ref}" "${repo}" "${destination}"
  230. fi
  231. }
  232.  
  233. echo "Fetching openvas-scanner (${OPENVAS_REF})..."
  234. clone_or_update \
  235. https://github.com/greenbone/openvas-scanner.git \
  236. "${OPENVAS_REF}" "${SOURCE_DIR}/openvas-scanner"
  237.  
  238. echo "Fetching openvas-smb (${OPENVAS_SMB_REF})..."
  239. clone_or_update \
  240. https://github.com/greenbone/openvas-smb.git \
  241. "${OPENVAS_SMB_REF}" "${SOURCE_DIR}/openvas-smb"
  242.  
  243. SCANNER_COMMIT="$(git -C "${SOURCE_DIR}/openvas-scanner" rev-parse HEAD)"
  244. SMB_COMMIT="$(git -C "${SOURCE_DIR}/openvas-smb" rev-parse HEAD)"
  245.  
  246. docker buildx inspect "${BUILDER}" >/dev/null 2>&1 || \
  247. docker buildx create --name "${BUILDER}" --use
  248. docker buildx use "${BUILDER}"
  249.  
  250. COMMON_ARGS=(--builder "${BUILDER}" --platform "${PLATFORM}")
  251. [[ "${PUSH}" == 1 ]] && COMMON_ARGS+=(--push) || COMMON_ARGS+=(--load)
  252. [[ "${NO_CACHE}" == 1 ]] && COMMON_ARGS+=(--no-cache)
  253.  
  254. echo "Building ${SMB_IMAGE}"
  255. DEBUG_SMB_DOCKERFILE="${SOURCE_DIR}/openvas-smb/.docker/debug.Dockerfile"
  256. sed \
  257. -e 's/CMAKE_BUILD_TYPE=Release/CMAKE_BUILD_TYPE=Debug/g' \
  258. "${SOURCE_DIR}/openvas-smb/.docker/prod.Dockerfile" > "${DEBUG_SMB_DOCKERFILE}"
  259.  
  260. docker buildx build "${COMMON_ARGS[@]}" \
  261. --file "${DEBUG_SMB_DOCKERFILE}" \
  262. --build-arg VERSION="${IMAGE_VERSION}" \
  263. --build-arg BUILDKIT_INLINE_CACHE=1 \
  264. --label org.opencontainers.image.title=openvas-smb-debug \
  265. --label org.opencontainers.image.revision="${SMB_COMMIT}" \
  266. --tag "${SMB_IMAGE}" \
  267. "${SOURCE_DIR}/openvas-smb"
  268.  
  269. # Keep the upstream Dockerfile intact and patch only the build mode in a
  270. # generated copy. The upstream file builds both the C scanner and openvasd.
  271. DEBUG_DOCKERFILE="${SOURCE_DIR}/openvas-scanner/.docker/debug.Dockerfile"
  272. sed \
  273. -e 's/cargo build --release/cargo build/g' \
  274. -e 's#target/release/#target/debug/#g' \
  275. -e 's/CMAKE_BUILD_TYPE=Release/CMAKE_BUILD_TYPE=Debug/g' \
  276. -e '/^CMD \["\/usr\/local\/bin\/openvasd"\]/i ENV RUST_BACKTRACE=full RUST_LOG=debug OPENVAS_LOG_LEVEL=debug OPENVASD_LOG_LEVEL=debug' \
  277. "${SOURCE_DIR}/openvas-scanner/.docker/prod.Dockerfile" > "${DEBUG_DOCKERFILE}"
  278.  
  279. echo "Building ${SCANNER_IMAGE}"
  280. if [[ "${PUSH}" == 1 ]]; then
  281. docker buildx build "${COMMON_ARGS[@]}" \
  282. --file "${DEBUG_DOCKERFILE}" \
  283. --build-arg VERSION="${IMAGE_VERSION}" \
  284. --build-arg OPENVAS_SMB_IMAGE="${SMB_IMAGE}" \
  285. --build-arg BUILDKIT_INLINE_CACHE=1 \
  286. --label org.opencontainers.image.title=openvas-scanner-debug \
  287. --label org.opencontainers.image.revision="${SCANNER_COMMIT}" \
  288. --label org.opencontainers.image.openvas-smb-revision="${SMB_COMMIT}" \
  289. --tag "${SCANNER_IMAGE}" \
  290. "${SOURCE_DIR}/openvas-scanner"
  291. else
  292. # The docker-container Buildx driver cannot see images loaded into the host
  293. # Docker image store. Use the host builder here so the locally built SMB
  294. # image can be used by the scanner build without a registry.
  295. DOCKER_BUILDKIT=1 docker build \
  296. --platform "${PLATFORM}" \
  297. --file "${DEBUG_DOCKERFILE}" \
  298. --build-arg VERSION="${IMAGE_VERSION}" \
  299. --build-arg OPENVAS_SMB_IMAGE="${SMB_IMAGE}" \
  300. --build-arg BUILDKIT_INLINE_CACHE=1 \
  301. --label org.opencontainers.image.title=openvas-scanner-debug \
  302. --label org.opencontainers.image.revision="${SCANNER_COMMIT}" \
  303. --label org.opencontainers.image.openvas-smb-revision="${SMB_COMMIT}" \
  304. --tag "${SCANNER_IMAGE}" \
  305. "${SOURCE_DIR}/openvas-scanner"
  306. fi
  307.  
  308. if [[ "${BUILD_FULL_STACK}" == 1 ]]; then
  309. build_debug_component gvm-libs \
  310. https://github.com/greenbone/gvm-libs.git main \
  311. "${REGISTRY}/${IMAGE_PREFIX}-gvm-libs:debug"
  312. build_debug_component gvm-auth-lib \
  313. https://github.com/greenbone/gvm-auth-lib.git main \
  314. "${REGISTRY}/${IMAGE_PREFIX}-gvm-auth-lib:debug"
  315. build_debug_component gvmd \
  316. https://github.com/greenbone/gvmd.git main \
  317. "${REGISTRY}/${IMAGE_PREFIX}-gvmd:debug"
  318. build_debug_component gsad \
  319. https://github.com/greenbone/gsad.git main \
  320. "${REGISTRY}/${IMAGE_PREFIX}-gsad:debug"
  321. build_debug_component ospd-openvas \
  322. https://github.com/greenbone/ospd-openvas.git main \
  323. "${REGISTRY}/${IMAGE_PREFIX}-ospd-openvas:debug" "${SCANNER_IMAGE}"
  324. build_debug_component gsa \
  325. https://github.com/greenbone/gsa.git main \
  326. "${REGISTRY}/${IMAGE_PREFIX}-gsa:debug"
  327. write_compose_file
  328. echo "Generated Compose file: ${COMPOSE_FILE}"
  329. fi
  330.  
  331. echo
  332. echo "Built images:"
  333. echo " ${SMB_IMAGE}"
  334. echo " ${SCANNER_IMAGE}"
  335. if [[ "${BUILD_FULL_STACK}" == 1 ]]; then
  336. echo " ${REGISTRY}/${IMAGE_PREFIX}-gvm-libs:debug"
  337. echo " ${REGISTRY}/${IMAGE_PREFIX}-gvm-auth-lib:debug"
  338. echo " ${REGISTRY}/${IMAGE_PREFIX}-gvmd:debug"
  339. echo " ${REGISTRY}/${IMAGE_PREFIX}-gsad:debug"
  340. echo " ${REGISTRY}/${IMAGE_PREFIX}-ospd-openvas:debug"
  341. echo " ${REGISTRY}/${IMAGE_PREFIX}-gsa:debug"
  342. fi
  343. echo "Scanner commit: ${SCANNER_COMMIT}"
  344. echo "SMB commit: ${SMB_COMMIT}"
  345. echo
  346. echo "Run scanner debugging with:"
  347. echo " docker run --rm -it --cap-add NET_ADMIN --cap-add NET_RAW ${SCANNER_IMAGE}"
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!