Public Access
initial-commit
This commit is contained in:
Guillaume GRABÉ
Executable
+222
@@ -0,0 +1,222 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
|
||||
# Run from the deploy/ directory
|
||||
cd "$(dirname "$0")"
|
||||
|
||||
# Colors for output
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
echo -e "${BLUE}"
|
||||
cat << "EOF"
|
||||
______ __ __ ___
|
||||
/ ____// /_ ____ _ _____ __ __ / /_ ____/ (_)____
|
||||
/ / / __ \ / __ `// ___// / / // __ \ / __ // // __ \
|
||||
/ /___ / / / // /_/ // / / /_/ // /_/ // /_/ // // /_/ /
|
||||
\____//_/ /_/ \__,_//_/ \__, //_.___/ \__,_//_/ \____/
|
||||
/____/
|
||||
EOF
|
||||
echo -e "${NC}"
|
||||
|
||||
echo -e "${GREEN}Charybdis Demo${NC}\n"
|
||||
|
||||
# Detect gRPC client
|
||||
GRPC_CMD=""
|
||||
if command -v buf &> /dev/null; then
|
||||
GRPC_CMD="buf"
|
||||
elif command -v grpcurl &> /dev/null; then
|
||||
GRPC_CMD="grpcurl"
|
||||
else
|
||||
echo -e "${RED}Error: Neither 'buf' nor 'grpcurl' found. Install one:${NC}"
|
||||
echo -e " brew install bufbuild/buf/buf"
|
||||
echo -e " brew install grpcurl"
|
||||
exit 1
|
||||
fi
|
||||
echo -e "${BLUE}Using gRPC client: ${GRPC_CMD}${NC}\n"
|
||||
|
||||
# Helper function for gRPC calls
|
||||
grpc_call() {
|
||||
local service_method="$1"
|
||||
local data="$2"
|
||||
local host="${3:-localhost:50051}"
|
||||
|
||||
if [ "$GRPC_CMD" = "buf" ]; then
|
||||
buf curl --protocol grpc --http2-prior-knowledge \
|
||||
-d "$data" \
|
||||
"http://${host}/${service_method}" 2>&1
|
||||
else
|
||||
grpcurl -plaintext -d "$data" "$host" "$service_method" 2>&1
|
||||
fi
|
||||
}
|
||||
|
||||
# Check if Docker is running
|
||||
if ! docker info > /dev/null 2>&1; then
|
||||
echo -e "${RED}Error: Docker is not running. Please start Docker first.${NC}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo -e "${BLUE}Starting services...${NC}\n"
|
||||
|
||||
# Start core services (Charybdis + Postgres only for quick demo)
|
||||
docker compose -f docker-compose.demo.yml up -d postgres-charybdis 2>/dev/null
|
||||
echo -e "${GREEN} Postgres started${NC}"
|
||||
|
||||
# Wait for Postgres
|
||||
for i in {1..15}; do
|
||||
if docker compose -f docker-compose.demo.yml exec -T postgres-charybdis pg_isready -U charybdis > /dev/null 2>&1; then
|
||||
break
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
|
||||
docker compose -f docker-compose.demo.yml up -d charybdis 2>/dev/null
|
||||
echo -e "${GREEN} Charybdis started${NC}"
|
||||
|
||||
# Wait for Charybdis gRPC
|
||||
echo -e "\n${BLUE}Waiting for Charybdis to be ready...${NC}"
|
||||
for i in {1..30}; do
|
||||
if timeout 2 bash -c "echo > /dev/tcp/localhost/50051" 2>/dev/null; then
|
||||
echo -e "${GREEN} gRPC server ready on :50051${NC}"
|
||||
break
|
||||
fi
|
||||
if [ $i -eq 30 ]; then
|
||||
echo -e "${RED} Charybdis failed to start${NC}"
|
||||
docker compose -f docker-compose.demo.yml logs charybdis | tail -10
|
||||
exit 1
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
|
||||
sleep 2 # Allow service to fully initialize
|
||||
|
||||
# --- Demo: Entity Management ---
|
||||
echo -e "\n${BLUE}=== Entity Management ===${NC}\n"
|
||||
|
||||
echo -e "${YELLOW}1. Creating a Component...${NC}"
|
||||
RESULT=$(grpc_call "charybdis.entities.EntityService/CreateEntity" '{
|
||||
"entity": {
|
||||
"kind": "Component",
|
||||
"component_metadata": {
|
||||
"name": "payment-service",
|
||||
"namespace": "default",
|
||||
"description": "Payment processing microservice"
|
||||
},
|
||||
"component_spec": {
|
||||
"type": "service",
|
||||
"lifecycle": "production",
|
||||
"owner": "team-payments"
|
||||
}
|
||||
}
|
||||
}')
|
||||
echo "$RESULT" | head -5
|
||||
ENTITY_ID=$(echo "$RESULT" | grep '"id"' | head -1 | sed 's/.*"id": *"//;s/".*//')
|
||||
echo -e "${GREEN} Created entity: ${ENTITY_ID}${NC}\n"
|
||||
|
||||
echo -e "${YELLOW}2. Listing entities...${NC}"
|
||||
grpc_call "charybdis.entities.EntityService/ListEntities" '{}' | head -5
|
||||
echo -e ""
|
||||
|
||||
# --- Demo: Vulnerability Ingestion ---
|
||||
echo -e "\n${BLUE}=== Vulnerability Ingestion ===${NC}\n"
|
||||
|
||||
# Create a SARIF report
|
||||
SARIF_REPORT=$(cat << 'SARIF'
|
||||
{
|
||||
"version": "2.1.0",
|
||||
"runs": [{
|
||||
"tool": {"driver": {"name": "semgrep", "version": "1.0.0", "rules": [
|
||||
{"id": "sql-injection", "shortDescription": {"text": "SQL Injection"}, "defaultConfiguration": {"level": "error"}, "properties": {"tags": ["CWE-89"]}},
|
||||
{"id": "xss-reflected", "shortDescription": {"text": "Reflected XSS"}, "defaultConfiguration": {"level": "warning"}, "properties": {"tags": ["CWE-79"]}},
|
||||
{"id": "hardcoded-secret", "shortDescription": {"text": "Hardcoded Secret"}, "defaultConfiguration": {"level": "error"}}
|
||||
]}},
|
||||
"results": [
|
||||
{"ruleId": "sql-injection", "level": "error", "message": {"text": "User input in SQL query without parameterization"}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/db/queries.rs"}, "region": {"startLine": 42}}}], "partialFingerprints": {"primaryLocationLineHash": "fp-sql-001"}},
|
||||
{"ruleId": "xss-reflected", "level": "warning", "message": {"text": "User input reflected in response without encoding"}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/handlers/search.rs"}, "region": {"startLine": 18}}}]},
|
||||
{"ruleId": "hardcoded-secret", "level": "error", "message": {"text": "AWS secret key found in source code"}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/config.rs"}, "region": {"startLine": 7}}}]}
|
||||
]
|
||||
}]
|
||||
}
|
||||
SARIF
|
||||
)
|
||||
|
||||
SARIF_B64=$(echo "$SARIF_REPORT" | base64)
|
||||
|
||||
echo -e "${YELLOW}3. Dry-run scan (preview without persisting)...${NC}"
|
||||
grpc_call "charybdis.ingestion.IngestionService/DryRunScan" "{
|
||||
\"component_ref\": \"payment-service\",
|
||||
\"lifecycle\": \"production\",
|
||||
\"format\": \"sarif\",
|
||||
\"data\": \"${SARIF_B64}\"
|
||||
}"
|
||||
echo -e ""
|
||||
|
||||
echo -e "${YELLOW}4. Importing scan (persisting findings)...${NC}"
|
||||
grpc_call "charybdis.ingestion.IngestionService/ImportScan" "{
|
||||
\"component_ref\": \"payment-service\",
|
||||
\"lifecycle\": \"production\",
|
||||
\"format\": \"sarif\",
|
||||
\"data\": \"${SARIF_B64}\"
|
||||
}"
|
||||
echo -e ""
|
||||
|
||||
echo -e "${YELLOW}5. Re-importing same scan (testing deduplication)...${NC}"
|
||||
grpc_call "charybdis.ingestion.IngestionService/ImportScan" "{
|
||||
\"component_ref\": \"payment-service\",
|
||||
\"lifecycle\": \"production\",
|
||||
\"format\": \"sarif\",
|
||||
\"data\": \"${SARIF_B64}\"
|
||||
}"
|
||||
echo -e ""
|
||||
|
||||
# Simulate a fix: remove the SQL injection finding
|
||||
SARIF_FIXED=$(cat << 'SARIF'
|
||||
{
|
||||
"version": "2.1.0",
|
||||
"runs": [{
|
||||
"tool": {"driver": {"name": "semgrep", "version": "1.0.0", "rules": [
|
||||
{"id": "xss-reflected", "shortDescription": {"text": "Reflected XSS"}, "defaultConfiguration": {"level": "warning"}, "properties": {"tags": ["CWE-79"]}},
|
||||
{"id": "hardcoded-secret", "shortDescription": {"text": "Hardcoded Secret"}, "defaultConfiguration": {"level": "error"}}
|
||||
]}},
|
||||
"results": [
|
||||
{"ruleId": "xss-reflected", "level": "warning", "message": {"text": "User input reflected in response without encoding"}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/handlers/search.rs"}, "region": {"startLine": 18}}}]},
|
||||
{"ruleId": "hardcoded-secret", "level": "error", "message": {"text": "AWS secret key found in source code"}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/config.rs"}, "region": {"startLine": 7}}}]}
|
||||
]
|
||||
}]
|
||||
}
|
||||
SARIF
|
||||
)
|
||||
|
||||
SARIF_FIXED_B64=$(echo "$SARIF_FIXED" | base64)
|
||||
|
||||
echo -e "${YELLOW}6. Importing scan after fix (SQL injection resolved)...${NC}"
|
||||
grpc_call "charybdis.ingestion.IngestionService/ImportScan" "{
|
||||
\"component_ref\": \"payment-service\",
|
||||
\"lifecycle\": \"production\",
|
||||
\"format\": \"sarif\",
|
||||
\"data\": \"${SARIF_FIXED_B64}\"
|
||||
}"
|
||||
echo -e ""
|
||||
|
||||
# --- Summary ---
|
||||
echo -e "\n${GREEN}=== Demo Complete ===${NC}\n"
|
||||
echo -e "${BLUE}What we demonstrated:${NC}"
|
||||
echo -e " 1. Created a Component entity via gRPC"
|
||||
echo -e " 2. Dry-run scan: preview findings without persisting"
|
||||
echo -e " 3. Import scan: persist 3 findings (SQL injection, XSS, hardcoded secret)"
|
||||
echo -e " 4. Deduplication: re-import same scan -> all unchanged"
|
||||
echo -e " 5. Auto-resolution: import without SQL injection -> marked as resolved"
|
||||
echo ""
|
||||
echo -e "${BLUE}Access:${NC}"
|
||||
echo -e " gRPC: localhost:50051"
|
||||
echo -e " YAML Adapter: http://localhost:8081"
|
||||
echo ""
|
||||
echo -e "${BLUE}Stop:${NC}"
|
||||
echo -e " docker compose -f docker-compose.demo.yml down"
|
||||
echo ""
|
||||
echo -e "${BLUE}Clean up:${NC}"
|
||||
echo -e " docker compose -f docker-compose.demo.yml down -v"
|
||||
echo ""
|
||||
Reference in New Issue
Block a user