# Release Baseline Checker

This repository implements a baseline scanner for automated security baseline checks before each release.

## Build
`bl` encapsulates some functions of trivy, so please install trivy first, see the [installation manual](https://aquasecurity.github.io/trivy/dev/getting-started/installation/) for details.

After trivy is installed, we can build the `bl` tool:

```
$ go build cmd/bl/bl.go
```

## Usage

`bl` provides two modes, including the scanner mode which can be executed directly in the command line and the server mode which provides a RESTful API that can be integrated with other services, see:

```
$ ./bl
NAME:
   bl - A simple and comprehensive baseline scanner for PingCAP

USAGE:
   bl [global options] command [command options] target

VERSION:
   dev

COMMANDS:
   client, c  scanner mode
   server, s  server mode
   help, h    Shows a list of commands or help for one command

GLOBAL OPTIONS:
   --cache-dir value  cache directory (default: "[your home]/.cache/baseline") [$BASELINE_CACHE_DIR]
   --debug, -d        debug mode (default: false) [$BASELINE_DEBUG]
   --help, -h         show help (default: false)
   --version, -v      print the version (default: false)
```

## Example

Scan an image in scanner mode:
```
./bl c i --severity CRITICAL hub.pingcap.net/tiflash/centos:7.9.2009-amd64
```

Scan a remote repository in scanner mode:

```
./bl c r --severity CRITICAL https://github.com/pingcap/tidb.git#tag@v5.3.0
```