From c8be38a21365799f051a047aa4117b9ec36a97af Mon Sep 17 00:00:00 2001
From: juvdiaz <juvenal.diaz@oracle.com>
Date: Mon, 29 Jun 2026 14:28:48 -0600
Subject: [PATCH] Add security scan preparation command

---
 docs/jeannie.1.md     |  9 +++++++++
 jeannie               | 10 +++++++++-
 scripts/security-scan | 40 +++++++++++++++++++++++++++++++++++++++-
 security/README.md    |  3 +++
 4 files changed, 60 insertions(+), 2 deletions(-)

diff --git a/docs/jeannie.1.md b/docs/jeannie.1.md
index bcfcaa1..fccb3a6 100644
--- a/docs/jeannie.1.md
+++ b/docs/jeannie.1.md
@@ -133,6 +133,9 @@ when the backstage helper is enabled.
 : Run the default defensive scan set: Trivy repo/IaC scans plus OWASP ZAP
 baseline passive scans for targets in `security/targets.txt`.
 
+`security-prepare`
+: Validate Docker and report prerequisites, then pre-pull scanner images.
+
 `security-zap`
 : Run only OWASP ZAP baseline passive scans against public targets.
 
@@ -313,6 +316,12 @@ Run the default defensive scan set:
 ./jeannie security-scan
 ```
 
+Prepare scanner images before the first run:
+
+```sh
+./jeannie security-prepare
+```
+
 Run a ZAP baseline scan against one URL:
 
 ```sh
diff --git a/jeannie b/jeannie
index 10b81a6..51dde66 100755
--- a/jeannie
+++ b/jeannie
@@ -5765,6 +5765,11 @@ security_scan() {
     "${REPO_ROOT}/scripts/security-scan" all
 }
 
+security_prepare() {
+    require_debian_server "security-prepare"
+    "${REPO_ROOT}/scripts/security-scan" prepare
+}
+
 security_zap() {
     require_debian_server "security-zap"
     "${REPO_ROOT}/scripts/security-scan" zap
@@ -5889,6 +5894,9 @@ case "${1:-}" in
     security-scan)
         security_scan
         ;;
+    security-prepare)
+        security_prepare
+        ;;
     security-zap)
         security_zap
         ;;
@@ -5912,7 +5920,7 @@ case "${1:-}" in
         echo "Log: ${JEANNIE_LOG_FILE}"
         ;;
     *)
-        echo "Usage: $0 {up|plan [all|provisioning|cluster|platform|apps|edge]|rebuild-cluster|stop-cluster|start-cluster|status|apps|website-translation-model|website-ollama-listen|ollama-setup|deploy-gitea|rpi-services|bootstrap-gitea-repo|backup-gitea|drill-gitea-restore|install-gitea-runner|move-prometheus-stack-workers|doctor-versions|doctor-edge|doctor-gitea|doctor-rpi|doctor-cluster|preflight|doctor-preapply|inventory-check|state-backup|fix-debian-docker-root|secrets-init|secrets-check|tailnet-policy-check|ai-index|ai-check|security-scan|security-zap|security-k8s|security-trivy|security-nuclei|openwrt|nuke}"
+        echo "Usage: $0 {up|plan [all|provisioning|cluster|platform|apps|edge]|rebuild-cluster|stop-cluster|start-cluster|status|apps|website-translation-model|website-ollama-listen|ollama-setup|deploy-gitea|rpi-services|bootstrap-gitea-repo|backup-gitea|drill-gitea-restore|install-gitea-runner|move-prometheus-stack-workers|doctor-versions|doctor-edge|doctor-gitea|doctor-rpi|doctor-cluster|preflight|doctor-preapply|inventory-check|state-backup|fix-debian-docker-root|secrets-init|secrets-check|tailnet-policy-check|ai-index|ai-check|security-scan|security-prepare|security-zap|security-k8s|security-trivy|security-nuclei|openwrt|nuke}"
         exit 1
         ;;
 esac
diff --git a/scripts/security-scan b/scripts/security-scan
index 2cac648..7a5a633 100755
--- a/scripts/security-scan
+++ b/scripts/security-scan
@@ -12,7 +12,7 @@ NUCLEI_IMAGE="${NUCLEI_IMAGE:-projectdiscovery/nuclei:latest}"
 
 usage() {
     cat <<'EOF'
-Usage: scripts/security-scan {all|trivy|zap|kube-bench|nuclei}
+Usage: scripts/security-scan {all|prepare|trivy|zap|kube-bench|nuclei}
 
 Environment:
   SECURITY_REPORT_DIR    Report output directory.
@@ -37,6 +37,41 @@ require_docker() {
     fi
 }
 
+prepare_security_scans() {
+    local image
+    local -a images=(
+        "${TRIVY_IMAGE}"
+        "${ZAP_IMAGE}"
+        "${KUBE_BENCH_IMAGE}"
+        "${NUCLEI_IMAGE}"
+    )
+
+    ensure_report_dir
+    require_docker
+
+    if ! docker info >/dev/null 2>&1; then
+        echo "docker is installed but not reachable by this user." >&2
+        exit 1
+    fi
+    if [[ ! -s "${SECURITY_TARGETS_FILE}" ]]; then
+        echo "Missing target file: ${SECURITY_TARGETS_FILE}" >&2
+        exit 1
+    fi
+    if [[ ! -w "${SECURITY_REPORT_DIR}" ]]; then
+        echo "Report directory is not writable: ${SECURITY_REPORT_DIR}" >&2
+        exit 1
+    fi
+
+    echo "Preparing security scan images..."
+    for image in "${images[@]}"; do
+        echo "--> docker pull ${image}"
+        docker pull "${image}"
+    done
+
+    echo "Security scan prerequisites are ready."
+    echo "Report directory: ${SECURITY_REPORT_DIR}"
+}
+
 run_trivy() {
     local stamp
     stamp="$(timestamp)"
@@ -152,6 +187,9 @@ case "${1:-all}" in
         run_trivy
         run_zap
         ;;
+    prepare)
+        prepare_security_scans
+        ;;
     trivy)
         run_trivy
         ;;
diff --git a/security/README.md b/security/README.md
index e995250..02ec5b7 100644
--- a/security/README.md
+++ b/security/README.md
@@ -6,6 +6,7 @@ website. These checks are for assets owned by this lab only.
 Use Jeannie from the Debian homelab host:
 
 ```bash
+./jeannie security-prepare
 ./jeannie security-scan
 ./jeannie security-zap
 ./jeannie security-k8s
@@ -18,6 +19,8 @@ The default `security-scan` runs:
 
 The focused commands are:
 
+- `security-prepare`: validate Docker/report prerequisites and pre-pull scanner
+  images.
 - `security-zap`: OWASP ZAP baseline scan only.
 - `security-k8s`: kube-bench CIS checks against the kubeadm host.
 - `security-trivy`: Trivy repo and IaC/config scans only.