/usr/bin/paranoia

Paranoia is a command-line tool to inspect the certificate authorities present in a container image.
It is capable of scanning not only well-known locations (such as PEM-encoded files under /etc/ssl/certs/), but finding
certificates embedded in text files and even inside of binaries.

## LIMITATIONS

Paranoia will detect certificate authorities in most cases, and is especially useful at finding accidental inclusion or for conducting a certificate authority inventory. However there are some limitations to bear in mind while using Paranoia:

- Paranoia only functions on container images, not running containers.
  Anything added into the container at runtime is not seen.
- If a certificate is found, that doesn’t guarantee that the container will trust it as a certificate authority.
  It could, for example, be an unused leftover file.
- It’s possible for an attacker to ‘hide’ a certificate authority from Paranoia (e.g., by encoding it in a format Paranoia doesn’t understand).
  In general Paranoia isn’t designed to defend against an adversary with supply chain write access intentionally sneaking obfuscated certificate authorities into container images.

## CERTIFICATE DETECTION

Paranoia runs a number of parsers over the data contained within a container image.
This includes searching through files for strings, including binary files.

Container images are comprised of layers.
Each layer may remove or replace files from previous layers.
Paranoia only considers the final state of the image, available to the application at runtime.
Certificates in intermediate layers which are removed or replaced in later layers are not detected by Paranoia.

### Partial Certificates

Paranoia can also detect "partial" certificates.
A partial certificate is where Paranoia has detected data that appears to be a certificate but is incomplete or invalid.
These can be false-positives, but are often worthy of further investigation.

## LOCAL IMAGES

Paranoia can be invoked on any container image by name.
This can include a tag, or a SHA256 fingerprint.
Paranoia can also read from STDIN to handle local images that are exported as tar files.

To enable this behaviour, use "-" as the image name.

	$ docker save my-local-image:sometag | paranoia export -

Usage:
  paranoia [command]

Available Commands:
  completion  Generate the autocompletion script for the specified shell
  export      Export all certificate authorities in the given container image
  help        Help about any command
  inspect     Summarise potential issues with certificates
  validate    Validate that the certificates in a container image conform to a provided config

Flags:
  -h, --help   help for paranoia

Use "paranoia [command] --help" for more information about a command.