Merge release v2.4.1 into main

.github/workflows/package.yml

@@ -48,7 +48,7 @@ jobs:
         run: sudo cmd/prepare
       - name: Install package
         shell: bash {0}
-        run: sudo apt install ./testrun*.deb
+        run: sudo -E DEBIAN_FRONTEND=noninteractive apt install ./testrun*.deb
       - name: Start testrun
         shell: bash {0}
         run: sudo testrun > >(tee testrun_output.log) 2>&1 &
@@ -82,7 +82,7 @@ jobs:
         run: sudo cmd/prepare
       - name: Install package
         shell: bash {0}
-        run: sudo apt install ./testrun*.deb
+        run: sudo -E DEBIAN_FRONTEND=noninteractive apt install ./testrun*.deb
       - name: Start testrun
         shell: bash {0}
         run: sudo testrun > >(tee testrun_output.log) 2>&1 &

.github/workflows/security.yml

@@ -6,7 +6,6 @@
 
 permissions:
   contents: read
-  pull-requests: write
 
 on:
   # For Branch-Protection check. Only the default branch is supported. See
@@ -49,79 +48,82 @@
           base_dir: "."
           json_exclude_regex: '.*(tsconfig.*\.json|\.venv|node_modules)'
           yaml_exclude_regex: '.*(\.venv|node_modules)'
-  # dockerfile_scan:
-  #   name: Dockerfile Scan
-  #   runs-on: ubuntu-24.04
-  #   steps:
-  #     - name: Checkout source
-  #       uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-  #     - name: Run Hadolint
-  #       uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 #v3.3.0
-  #       with:
-  #         dockerfile: "*Dockerfile"
-  #         recursive: true
-  #         ignore: DL3007,DL3008,DL3015,DL3059
-  #         failure-threshold: warning
-  # shellcheck_scan:
-  #   name: ShellCheck Bash Scan
-  #   runs-on: ubuntu-24.04
-  #   steps:
-  #     - name: Checkout source
-  #       uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-  #     - name: Run Shellcheck
-  #       uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 #v2.0.0
-  #       with:
-  #         ignore_paths: >-
-  #           node_modules
-  #           .venv
-  #           dist
-  #           build
-  #         severity: warning
-  # trivy_sca_scan:
-  #   name: Trivy SCA Security Scan
-  #   runs-on: ubuntu-24.04
-  #   steps:
-  #     - name: Checkout source
-  #       uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-  #     - name: Run Trivy in Filesystem mode
-  #       uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 #0.36.0
-  #       with:
-  #         scan-type: 'fs'
-  #         scan-ref: '.'
-  #         format: 'table'
-  #         exit-code: '1'
-  #         ignore-unfixed: true
-  #         severity: 'CRITICAL,HIGH'
-  # bandit_sast_scan:
-  #   name: Bandit Python SAST Scan
-  #   runs-on: ubuntu-24.04
-  #   steps:
-  #     - name: Checkout source
-  #       uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-  #     - name: Set up Python
-  #       uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 #v.6.0.3
-  #       with:
-  #         python-version: '3.13'
-  #     - name: Install Bandit
-  #       run: pip install bandit==1.9.4
-  #     - name: Run Bandit Analysis
-  #       run: bandit -r . -ll -x ./testing,./modules/ui/node_modules
-  # semgrep_scan:
-  #   name: Semgrep OSS SAST Scan
-  #   runs-on: ubuntu-24.04
-  #   container:
-  #     image: semgrep/semgrep:1.169.0
-  #   steps:
-  #     - name: Checkout source
-  #       uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-  #     - name: Run Semgrep Security Analiss
-  #       run: |
-  #         semgrep scan \
-  #         --config=auto \
-  #         --error \
-  #         --exclude="**/testing/**"
-  #         --exclude="modules/ui/node_modules"
-
+  dockerfile_scan:
+    name: Dockerfile Scan
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Run Hadolint
+        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 #v3.3.0
+        with:
+          dockerfile: "*Dockerfile"
+          recursive: true
+          ignore: DL3007,DL3008,DL3015,DL3059
+          failure-threshold: warning
+  trivy_sca_scan:
+    name: Trivy SCA Security Scan
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Remove Node.js lockfiles for scan
+        run: find . -type f \( -name "package-lock.json" -o -name "yarn.lock" -o -name "pnpm-lock.yaml" \) -delete
+      - name: Run Trivy in Filesystem mode
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # 0.36.0
+        with:
+          scan-type: 'fs'
+          scan-ref: '.'
+          format: 'table'
+          exit-code: '1'
+          ignore-unfixed: true
+          severity: 'CRITICAL,HIGH'
+          skip-dirs: 'node_modules'
+          trivy-options: '--disabled-analyzers npm-pkg-lock,yarn,pnpm,node-pkg'
+  shellcheck_scan:
+    name: ShellCheck Bash Scan
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Run Shellcheck
+        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 #v2.0.0
+        with:
+          ignore_paths: >-
+            node_modules
+            .venv
+            dist
+            build
+          severity: warning
+  semgrep_scan:
+    name: Semgrep OSS SAST Scan
+    runs-on: ubuntu-24.04
+    container:
+      image: semgrep/semgrep:1.169.0
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Run Semgrep Security Analiss
+        run: |
+          semgrep scan \
+          --config=auto \
+          --error \
+          --exclude="**/testing/**" \
+          --exclude="modules/ui/node_modules"
+  bandit_sast_scan:
+    name: Bandit Python SAST Scan
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 #v.6.0.3
+        with:
+          python-version: '3.13'
+      - name: Install Bandit
+        run: pip install bandit==1.9.4
+      - name: Run Bandit Analysis
+        run: bandit -r . -ll -x ./testing,./modules/ui/node_modules
 
 
 

.github/workflows/testing.yml

@@ -152,21 +152,18 @@ jobs:
     - name: Install Chromium Browser
       run: |
         sudo add-apt-repository ppa:xtradeb/apps -y
-        sudo apt-get update
-        sudo apt-get install -y chromium
+        sudo -E DEBIAN_FRONTEND=noninteractive apt-get update
+        sudo -E DEBIAN_FRONTEND=noninteractive apt-get install -y chromium
 
     - name: Install dependencies
       run: npm ci
       working-directory: ./modules/ui
 
     - name: Run tests
       run: |
-        sudo sysctl -w kernel.unprivileged_userns_clone=1
-        export CHROMIUM_FLAGS="--no-sandbox --disable-setuid-sandbox"
+        sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
         export CHROME_BIN=/usr/bin/chromium
         CI=true npm run test-ci
-      env:
-        CI: true
       working-directory: ./modules/ui
 
   linters_ui:

bin/testrun

@@ -27,10 +27,12 @@ sudo mkdir -p /var/run/netns
 FILE_PATH=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 
 # Check if Testrun was installed as a package
-if [ $FILE_PATH == "/usr/bin" ] ; then
-  export TESTRUN_PATH="/usr/local/testrun"
+if [ "$FILE_PATH" = "/usr/bin" ]; then
+    TESTRUN_PATH="/usr/local/testrun"
+    export TESTRUN_PATH
 else
-  export TESTRUN_PATH=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")"/.. && pwd)
+    TESTRUN_PATH=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")"/.. && pwd)
+    export TESTRUN_PATH
 fi
 
 cd $TESTRUN_PATH
@@ -43,6 +45,6 @@ source venv/bin/activate
 
 # Set the PYTHONPATH to include the "src" directory
 export PYTHONPATH="$TESTRUN_PATH/framework/python/src"
-python -u framework/python/src/core/test_runner.py $@ 2>&1 | tee testrun.log
+python -u framework/python/src/core/test_runner.py "$@" 2>&1 | tee testrun.log
 
 deactivate

cmd/build

@@ -17,7 +17,7 @@
 # Check if Docker is installed
 if [[ $(which docker) && $(docker --version) ]]; then
     # Docker is installed
-    echo Using $(docker --version)
+    echo Using "$(docker --version)"
   else
     # Docker is not installed
     echo Docker is not installed. Please follow the Get Started guide at https://github.com/google/testrun

cmd/install

@@ -18,10 +18,14 @@ echo Installing application dependencies
 
 # Collect command line arguments
 while getopts ":l" option; do
-   case $option in
-      l) # Install Testrun in local directory
+  case $option in
+    l) # Install Testrun in local directory
         TESTRUN_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")"/.. && pwd)
-   esac
+        ;;
+    *)
+        echo "Ignored unknown option: -${OPTARG:-$option}" >&2
+        ;;
+  esac
 done
 
 # Check if TESTRUN_DIR has been set, otherwise install in /usr/local/testrun

cmd/package

@@ -28,6 +28,7 @@ if ! (id -nGz "$USER" | grep -qzxF "docker"); then
     exit 1
 fi
 
+# shellcheck disable=SC2209
 MAKE_SRC_DIR=make
 MAKE_CONTROL_DIR=make/DEBIAN/control
 
@@ -41,7 +42,7 @@ echo Building package for testrun v${version}
 
 # Delete existing make files
 echo Cleaning up previous build files
-rm -rf $MAKE_SRC_DIR/usr
+rm -rf "${MAKE_SRC_DIR:?}/usr"
 
 # Copy testrun script to /bin
 mkdir -p $MAKE_SRC_DIR/bin

cmd/prepare

@@ -20,6 +20,7 @@
 echo Installing system dependencies
 
 # Install system dependencies
-sudo apt-get update && sudo apt-get install openvswitch-common openvswitch-switch python3 libpangocairo-1.0-0 ethtool
+export DEBIAN_FRONTEND=noninteractive
+sudo -E apt-get update && sudo -E apt-get install -y openvswitch-common openvswitch-switch python3 libpangocairo-1.0-0 ethtool
 
 echo Finished installing system dependencies

docs/README.md

@@ -11,6 +11,7 @@
     -  [Test modules](/docs/test/modules.md)
     -  [Test results](/docs/test/statuses.md)
     -  [Device compliance guide](/docs/test/compliant.md)
+    -  [Risk profiles](/docs/risk_profiles.md)
 -  [Developer guidelines](/docs/dev/README.md)
 -  [Accessibility](/docs/ui/accessibility.md)
 -  [Roadmap](/docs/roadmap.pdf)