"""Checks the specified image for security vulnerabilities."""

import argparse
import json
import logging
import sys
import subprocess


_GCLOUD_CMD = ['gcloud', 'beta', 'container', 'images', '--format=json']


# Severities
_LOW = 'LOW'
_MEDIUM = 'MEDIUM'
_HIGH = 'HIGH'

_SEV_MAP = {
    _LOW: 0,
    _MEDIUM: 1,
    _HIGH: 2
}


def _run_gcloud(cmd):
    full_cmd = _GCLOUD_CMD + cmd
    output = subprocess.check_output(full_cmd)
    return json.loads(output)


def _check_image(image, severity):
    digest = _resolve_latest(image)
    full_name = '%s@%s' % (image, digest)
    parsed = _run_gcloud(['describe', full_name])

    unpatched = 0
    for vuln in parsed['vulz_analysis']['FixesAvailable']:
        if _filter_severity(vuln['severity'], severity):
            unpatched += 1

    if unpatched:
        logging.info('Found %s unpatched vulnerabilities in %s. Run '
                     '[gcloud beta container images describe %s] '
                     'to see the full list.',
                     unpatched, image, full_name)
    return unpatched


def _resolve_latest(image):
    parsed = _run_gcloud(['list-tags', image, '--no-show-occurrences'])
    for digest in parsed:
        if 'latest' in digest['tags']:
            return digest['digest']
    raise Exception("Unable to find digest of 'latest' tag for %s" % image)


def _filter_severity(sev1, sev2):
    """Returns whether sev1 is higher than sev2"""
    return _SEV_MAP[sev1] > _SEV_MAP[sev2]


def _main():
    parser = argparse.ArgumentParser()
    parser.add_argument('image', help='The image to test')
    parser.add_argument('--severity', choices=[_LOW, _MEDIUM, _HIGH],
                        default=_MEDIUM,
                        help='The minimum severity to filter on.')
    args = parser.parse_args()

    logging.basicConfig(level=logging.DEBUG)
    return _check_image(args.image, args.severity)


if __name__ == '__main__':
    sys.exit(_main())

"""Checks the specified image for security vulnerabilities."""

import argparse
import json
import logging
import sys
import subprocess


_GCLOUD_CMD = ['gcloud', 'beta', 'container', 'images', '--format=json']


# Severities
_LOW = 'LOW'
_MEDIUM = 'MEDIUM'
_HIGH = 'HIGH'
_CRITICAL = 'CRITICAL'

_SEV_MAP = {
    _LOW: 0,
    _MEDIUM: 1,
    _HIGH: 2,
    _CRITICAL: 3,
}


def _run_gcloud(cmd):
    full_cmd = _GCLOUD_CMD + cmd
    output = subprocess.check_output(full_cmd)
    return json.loads(output)


def _check_image(image, severity):
    digest = _resolve_latest(image)
    full_name = '%s@%s' % (image, digest)
    parsed = _run_gcloud(['describe', full_name])

    unpatched = 0
    for vuln in parsed.get('vulz_analysis', {}).get('FixesAvailable', []):
        if _filter_severity(vuln['severity'], severity):
            unpatched += 1

    if unpatched:
        logging.info('Found %s unpatched vulnerabilities in %s. Run '
                     '[gcloud beta container images describe %s] '
                     'to see the full list.',
                     unpatched, image, full_name)
    return unpatched


def _resolve_latest(image):
    parsed = _run_gcloud(['list-tags', image, '--no-show-occurrences'])
    for digest in parsed:
        if 'latest' in digest['tags']:
            return digest['digest']
    raise Exception("Unable to find digest of 'latest' tag for %s" % image)


def _filter_severity(sev1, sev2):
    """Returns whether sev1 is higher than sev2"""
    return _SEV_MAP.get(sev1, _LOW) >= _SEV_MAP.get(sev2, _LOW)


def _main():
    parser = argparse.ArgumentParser()
    parser.add_argument('image', help='The image to test')
    parser.add_argument('--severity',
                        choices=[_LOW, _MEDIUM, _HIGH, _CRITICAL],
                        default=_MEDIUM,
                        help='The minimum severity to filter on.')
    args = parser.parse_args()

    logging.basicConfig(level=logging.DEBUG)
    return _check_image(args.image, args.severity)


if __name__ == '__main__':
    sys.exit(_main())

Fix the security filtering to handle None as a severity.