// 关键点：
// - serverConfigA 不设置 SessionTicketKey / 不调用 SetSessionTicketKeys
// - 先让 A 被用过（完成一次握手）
// - 再 Clone() 得到 B
// - client 使用 ClientSessionCache，第二次连接时才可能 resumption

# 官方安装脚本（Linux/macOS/Windows）
curl -sSfL https://get.anchore.io/grype | sudo sh -s -- -b /usr/local/bin

# Homebrew（macOS）
brew tap anchore/grype
brew install grype

# 扫本地 docker daemon 里的 image
grype alpine:latest

# 直接从 registry 拉（不依赖本地容器运行时）
grype registry:yourrepo/yourimage:tag

# 只看有修复版本（fixed）的漏洞，降低噪音
grype yourimage:tag --only-fixed

# 输出为 table/json/sarif 等
grype yourimage:tag -o table
grype yourimage:tag -o json

# 若发现 >= high 的漏洞，直接让命令返回非 0（用于 CI 阻断）
grype yourimage:tag --fail-on high

# 扫目录
grype dir:/path/to/rootfs

# 扫单个文件（比如某个可执行文件）
grype file:/path/to/your-binary

{
  "bomFormat": "CycloneDX",
  "specVersion": "1.5",
  "version": 1,
  "metadata": {
    "component": {
      "type": "container",
      "name": "example/app",
      "version": "1.0.0"
    }
  },
  "components": [
    {
      "type": "library",
      "name": "golang.org/x/crypto",
      "version": "v0.18.0",
      "purl": "pkg:golang/golang.org/x/crypto@v0.18.0"
    },
    {
      "type": "library",
      "name": "github.com/anchore/grype",
      "version": "v0.104.1",
      "purl": "pkg:golang/github.com/anchore/grype@v0.104.1"
    }
  ]
}

# 安装 Syft（官方脚本）
curl -sSfL https://get.anchore.io/syft | sudo sh -s -- -b /usr/local/bin

# macOS 也可以用 Homebrew
brew install syft

# 1) 给镜像生成 SBOM（CycloneDX JSON）
syft yourimage:tag -o cyclonedx-json=sbom.json

# 2) 给目录/rootfs 生成 SBOM
syft dir:/path/to/rootfs -o cyclonedx-json=sbom.json

# 3) 给单个二进制生成 SBOM
syft file:/path/to/your-binary -o cyclonedx-json=sbom.json

# 直接扫一个 Syft JSON（SBOM）
grype sbom:./sbom.json

# 或者把 SBOM 从 stdin pipe 进去
cat ./sbom.json | grype

# 结果尽量按 CVE 聚合（能转成 CVE 时）
grype yourimage:tag --by-cve

# 扫全层（all-layers）而不只是 squashed（更严格，但结果可能更多）
grype yourimage:tag --scope all-layers

# 对缺 CPE 的包尝试生成 CPE（有时能补齐匹配）
grype yourimage:tag --add-cpes-if-none

# 更新 vulnerability DB（排查“为啥扫不出某个 CVE”时很有用）
grype db update

@startuml
title CVE-2025-68121 (crypto/tls): Session Resumption Pitfalls

actor Client
participant "Server (Config A)\n(no explicit ticket keys)" as SrvA
participant "Config.Clone()" as Clone
participant "Server (Config B)\n(mutated policy/certs)" as SrvB
participant "PKI Chain\n(leaf + intermediate + root)" as Chain

== Issue 1: Config.Clone copies auto-generated ticket keys ==

Client -> SrvA: 1) Full handshake (TLS)\n(session tickets enabled)
note right of SrvA
If SessionTicketKey is not set and
SetSessionTicketKeys not called,
crypto/tls auto-generates & rotates
session ticket keys.
end note
SrvA --> Client: SessionTicket (encrypted with auto keys)

SrvA -> Clone: 2) Clone used Config A\n( AFTER handshake )
Clone --> SrvB: Config B contains\ncopied auto ticket keys (pre-fix)
note right of SrvB
Unexpected: Config A and Config B
share the same ticket keys.
end note

Client -> SrvB: 3) Connect to B\n(with cached session)
SrvB --> Client: Session resumption succeeds\n(should be isolated by policy)

== Issue 2: Resumption checks leaf only (pre-fix) ==

note over Client,SrvB
Assume the original handshake used a certificate chain.
Later, an intermediate/root expires.
end note

Client -> Chain: 4) Time passes\nintermediate/root expires
Client -> SrvB: 5) Resume session
SrvB -> Chain: Validate for resumption\n(pre-fix: leaf only)
Chain --> SrvB: leaf OK, chain expired
SrvB --> Client: Resumption allowed\n(should fail if full chain checked)

== Fixed behavior (expected) ==
note over SrvB
- Clone() does NOT copy auto ticket keys
  (only explicitly set keys are copied)
- Resumption checks full certificate chain expiry
end note
@enduml

@startmindmap
<style>
mindmapDiagram {
  node { BackgroundColor #FAFAFA }
  :depth(0) { BackgroundColor #FFD700 }
  :depth(1) { BackgroundColor #E3F2FD }
  :depth(2) { BackgroundColor #F5F5F5 }
}
</style>
* CVE-2025-68121\nGo crypto/tls
** What
*** Clone 复制自动生成 ticket keys\n(跨 Config 共享)
*** Resumption 只检查 leaf\n(忽略完整链过期)
** Why / Impact
*** 配置隔离语义被削弱
*** 证书链过期策略被绕开\n(审计/合规风险)
** Repro (思路)
*** Config A 握手生成 keys
*** Clone(A)->B 并修改策略
*** Client 用 cache 连接 B\n观察是否 resumption
*** 构造链 + intermediate 过期\n观察是否仍可恢复
** Fix / Avoid
*** 升级 Go >= 1.25.7
*** 显式隔离 ticket keys\n(SetSessionTicketKeys)
*** 强隔离：禁用 tickets\n(SessionTicketsDisabled)
*** 证书链轮换/过期\n结合 session 生命周期评估
** Detect (推荐 Grype)
*** 扫 image/dir/file
*** 更稳：SBOM → scan SBOM
**** Syft 生成 SBOM\n(CycloneDX/SPDX)
**** Grype 扫 sbom.json
** References
*** Go issues: 77113 / 77115
*** Anchore: Grype / Syft
@endmindmap