Install binskim through dotnet sdk

microsoft · Feb 20, 2025 · 93312b1 · 93312b1
1 parent 51b56c5
commit 93312b1
Showing 1 changed file with 16 additions and 9 deletions.
diff --git a/.github/workflows/binskim.yaml b/.github/workflows/binskim.yaml
@@ -22,25 +22,31 @@ jobs:
           echo "Installing dependencies..."
           sudo apt-get update
           sudo apt-get install -y git golang rustc cargo build-essential protobuf-compiler libprotobuf-dev expect libssl-dev clang libseccomp-dev btrfs-progs libdevmapper-dev cmake libfuse-dev
+          sudo add-apt-repository ppa:dotnet/backports
+          sudo apt-get install -y dotnet-sdk-9.0 aspnetcore-runtime-9.0 dotnet-runtime-9.0 zlib1g
 
-
-      - name: Download and Install BinSkim
+      - name: Set up BinSkim
         run: |
-          echo "Downloading BinSkim..."
-          curl -L -o binskim https://github.com/microsoft/binskim/releases/latest/download/BinSkim-linux-x64
-          chmod +x binskim
-          sudo mv binskim /usr/local/bin/
-          echo "BinSkim installed successfully."
-          binskim --version || echo "BinSkim installed but no version command."
+          dotnet new console -n TempConsoleApp
+          cd TempConsoleApp
+          echo "Installing BinSkim version 1.9.5"
+          dotnet add package Microsoft.CodeAnalysis.BinSkim --version 1.9.5
+          ls ~/.nuget/packages/microsoft.codeanalysis.binskim/
+          sudo mv ~/.nuget/packages/microsoft.codeanalysis.binskim/ $GITHUB_WORKSPACE
+          echo "BinSkim files moved to: $GITHUB_WORKSPACE"
+          sudo ln -sf "$GITHUB_WORKSPACE/microsoft.codeanalysis.binskim/1.9.5/tools/netcoreapp3.1/linux-x64/BinSkim" /usr/local/bin/binskim
+          
 
       - name: Build kata artifacts
         run: |
+          echo "Building kata-agent binary"
           agent_make_flags="LIBC=gnu OPENSSL_NO_VENDOR=Y DESTDIR=${AGENT_INSTALL_DIR} BUILD_TYPE=${AGENT_BUILD_TYPE}"
           agent_make_flags+=" AGENT_POLICY=yes"
           pushd src/agent/
           make ${agent_make_flags}
           popd
 
+          echo "Building kata-runtime binary"
           runtime_make_flags="SKIP_GO_VERSION_CHECK=1 QEMUCMD= FCCMD= ACRNCMD= STRATOVIRTCMD= DEFAULT_HYPERVISOR=cloud-hypervisor 
             DEFMEMSZ=0 DEFSTATICSANDBOXWORKLOADMEM=512 DEFVCPUS=0 DEFSTATICSANDBOXWORKLOADVCPUS=1 DEFVIRTIOFSDAEMON=${VIRTIOFSD_BINARY_LOCATION} PREFIX=${INSTALL_PATH_PREFIX}"
           runtime_make_flags+=" CLHPATH=${CLOUD_HYPERVISOR_LOCATION}"
@@ -54,11 +60,12 @@ jobs:
           make all
           popd
 
+          echo "Building tardev-snapshotter service binary"
           pushd src/tardev-snapshotter/
           make all
           popd
 
-      # 🔹 Run BinSkim on compiled binaries
+      # Run BinSkim on compiled binaries
       - name: Scan kata-agent binary
         run: binskim analyze src/agent/target/release/kata-agent --output binskim-agent.sarif --verbose