cypress/included:12.3.0 causes failure of TRG 4.02 - Base images check pipeline

[ds-mwesener]

Hello,

as can be seen in our build log the pipeline throws an error because of the cypress/included:12.3.0 dependency.

Build log: https://github.com/catenax-ng/tx-traceability-foss/actions/runs/6480134583/job/17595042382#step:3:53

Can we somehow add this?

Thanks in advance.

Kind regards

[SebastianBezold]

HI @ds-mwesener,
I'll look into that image. As background info: we do not just add image as approved, but actually check how the images is build and it is a trustworthy source. Also we collect every available info about that image, so we can include it in the notice for docker images.
In case you already collected this information, it would be great, if you could share it here

[ds-mwesener]

Hi @SebastianBezold here is a quick summary of content I could found regarding license information:
Github Repository: https://github.com/cypress-io/cypress-docker-images -> Leads to MIT License
DockerHub Repository: https://hub.docker.com/r/cypress/included/ -> No license information available

The following picture shows an overview of the included elements within this docker image: (Take care the versions are not the ones used, currently)

As the cypress/included docker image includes the operating system, cypress and some browsers it will include all of the elements in the picture above.

I hope this helps!

Kind regards.

Max

[SebastianBezold]

Hi @ds-mwesener,

sorry for the late update. But here the current status:

• The aligned base image TRG focusses on images, that we publish as Eclipse Tractus-X (will update the TRG to make that more precise)
• The aligned base images consist of official Docker images, that are scanned by DockerHub, with published scan results -> We want to leverage that for best transparency
• Docker images, that are only used for building or testing your application and are not published by you, do not necessarily use aligned base images (like cypress in your case)
• You can declare the path to the Dockerfile you are using, to exclude it from our automated release guideline check

So to sum it up, we won't add cypress to the aligned base images, but you can exclude the respective Dockerfile from the automatic scans by declaring it in the .tractusx metadata file

Is that something you can live with? 😁