README
¶
getarcane.dev/copacetic
A library-only fork of Project Copacetic, used by Arcane to patch OS and library vulnerabilities in container images with BuildKit.
import copa "getarcane.dev/copacetic"
err := copa.Patch(ctx, &copa.Options{
Image: "docker.io/library/nginx:1.25",
Report: "report.json", // Trivy JSON report
PatchedTag: "1.25-patched",
Timeout: 10 * time.Minute,
})
getarcane.dev/copacetic is the only importable package: Patch, Options,
ErrNoUpdatesFound, and ResolvePatchedImageName. The engine lives under
internal/.
How it differs from upstream
The patching engine is upstream's. The fork removes what a library consumer does not need, so importing it pulls in far fewer modules:
| Removed | Replacement |
|---|---|
copa CLI (main.go, pkg/cmd, cobra, viper) |
none: call copa.Patch |
Terminal UI (pkg/tui, lipgloss, progrock) |
logrus messages and BuildKit's progressui |
github.com/docker/buildx (imagetools) |
go-containerregistry builds and pushes the multi-platform index (internal/patch/manifest.go) |
github.com/aquasecurity/trivy (report types) |
local structs matching Trivy's JSON format (internal/report/trivytypes.go) |
k8s.io/apimachinery (sets) |
a plain map |
| BuildKit frontend, bulk, generate, helm, integration and e2e suites, docs site | none |
18 public pkg/... packages |
one root package; the rest moved to internal/ |
Trivy is still the scanner: Copa reads its JSON report as before.
Development
make build # go build ./...
make test # unit tests
make lint
Syncing with upstream
git remote add upstream https://github.com/project-copacetic/copacetic.git
git fetch upstream --tags
git rebase <upstream-tag> # replay the fork's commits; resolve conflicts in removed paths by deleting them
License
Apache 2.0, as upstream. See LICENSE.
Documentation
¶
Overview ¶
Package copacetic patches vulnerable OS and library packages in existing container images with BuildKit, usually driven by a Trivy JSON report.
It is a library-only fork of Project Copacetic. This package is the whole public API; the patching engine lives under internal/.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrNoUpdatesFound = types.ErrNoUpdatesFound
ErrNoUpdatesFound is returned by Patch when the image has no package updates to apply.
Functions ¶
func ResolvePatchedImageName ¶
func ResolvePatchedImageName(imageRef reference.Named, explicitTag, suffix string) (imageName, patchTag string, err error)
ResolvePatchedImageName returns the image name and tag Patch writes for imageRef: explicitTag when set, otherwise the source tag joined with suffix.
Types ¶
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
internal
|
|
|
report
Package report contains parsers and helpers for vulnerability scan reports (e.g., Trivy).
|
Package report contains parsers and helpers for vulnerability scan reports (e.g., Trivy). |
|
vex
Package vex contains logic for generating VEX (Vulnerability Exploitability eXchange) documents.
|
Package vex contains logic for generating VEX (Vulnerability Exploitability eXchange) documents. |