[om986]

Summary

• Add om scan workload image aws, om scan workload image azure, and om scan workload image gcp for Phase 4 (#104). Each runs as root on a worker in that account and region, reads a boot image once through the same package walker as a root volume, and adds those CPE 2.3 names and package URLs to every workload launched from that image.
• Packages already stored stay, so a package installed on an instance after boot is not attributed to the image or to another instance. om scan workload aws, om scan workload azure, and om scan workload gcp still replace packages with what is on that instance's own disk. om enrich cve is unchanged.
• The copy created for the read is deleted, including when the walk fails. The AMI snapshot is not deleted. Marketplace and shared images the account cannot snapshot are skipped, and the command says so. Owned images are read even when no instance is running.
• om scan workload is now the parent command. The AWS root-volume scan is om scan workload aws, beside the Azure and GCE commands.

Test plan

• go test ./internal/workload/... ./internal/cmd/ ./internal/graph/ -count=1
• On an EC2 instance, run om scan aws, then sudo -E ./om scan workload image aws, and confirm instances from one AMI share that image's package identifiers
• Install a package on one instance after boot, run om scan workload aws for that instance, then run the image scan again, and confirm the extra package stays on that instance only
• On an Azure VM, run om scan azure, then sudo -E ./om scan workload image azure
• On a GCE instance, run om scan gcp, then sudo -E ./om scan workload image gcp
• Fail a read on purpose and confirm the volume or disk created for the scan is deleted, and the AMI snapshot is not
• Confirm a marketplace image the account cannot snapshot is skipped with account cannot snapshot this image
• Run om enrich cve and confirm a CVE attaches when an image package identifier matches

Made with Cursor

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: OpenSourceOM/core
• Branch: feat/boot-image-packages
• File: .coderabbit.yaml
• Commit: 15dfbd9
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0d737335-61f4-4705-a8f7-7ae539c38cfd

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}