pipedawg 0.2.2 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b1df968015369cc666fc521d546b3194e82f04ec28b9a2473dbc2452b5c37780
-  data.tar.gz: 5afe211e7fb69ac10808af059e02dc5706c882ad86d2309901d2f943e0ec6a6d
+  metadata.gz: 53733705295ce1c9b2ae80fc1c8368e7e08e7d7a0e1fcf3727fe972dd5714fb1
+  data.tar.gz: 10e86751592488fbb9972605892d79af662e60e3a3da070292cf4933f31b7981
 SHA512:
-  metadata.gz: 7348909008c56e40d693f388da3b6eb8210c380a357c87c5e1cf906932a9c66246af77a9328f0746d70b2213943c95f73256d835b5163ca17348a9068998a5ac
-  data.tar.gz: 9f3b4d44c1e2e5e2b955ecd135ccdcfd100d15fbcc137f40dca0af2797a0aa3637444e2e75ec910ac428a953147d883ecb24414c6e10bba17dfb0d40f3881b70
+  metadata.gz: 11584d541a5d63f54761dee9ca878e3c79ba168ee1e5e93ec9ddccd559d869672a900a6aa25d966df4ef807a56ac0c75385644baf3bce5498ac7a68a29fd8a9a
+  data.tar.gz: 97f20d550f1cbe4bf298a2f6884f02754cd385e317d777887d11a8748d7436d8bb6db035944c6f59d2593b4e3a615db76f28c678bb392cf16ef3e6c6f92770a9

data/lib/pipedawg/helm_copy_job.rb

@@ -0,0 +1,115 @@
+# frozen_string_literal: true
+
+module Pipedawg
+  # helm_copy_job class
+  class HelmCopyJob < Job
+    attr_accessor :helm_opts
+
+    def initialize(name = 'build', opts = {}, helm_opts = {})
+      @helm_opts = {
+        chart: name, debug: true,
+        destinations: [{ user: nil, password: nil, url: nil }],
+        helm: 'helm',
+        image: { entrypoint: [''], name: 'alpine/helm' },
+        password: nil, url: nil, user: nil, version: nil
+      }.merge(helm_opts)
+      super name, opts
+      update
+    end
+
+    def update # rubocop:disable Metrics/AbcSize
+      opts[:image] = helm_opts[:image] if helm_opts[:image]
+      opts[:script] = debug + pull + (helm_opts[:destinations].map { |d| push(d) }).flatten(1)
+    end
+
+    private
+
+    def debug
+      if helm_opts[:debug]
+        Pipedawg::Util.echo_proxy_vars
+      else
+        []
+      end
+    end
+
+    def pull
+      case helm_opts[:url]
+      when nil
+        []
+      when %r{^oci://}
+        pull_oci
+      else
+        pull_classic
+      end
+    end
+
+    def push(destination)
+      case destination[:url]
+      when nil
+        []
+      when %r{^oci://}
+        push_oci(destination)
+      else
+        push_classic(destination)
+      end
+    end
+
+    def pull_oci # rubocop:disable Metrics/AbcSize
+      script = []
+      if helm_opts[:url] && helm_opts[:chart] && helm_opts[:version]
+        script = ['export HELM_EXPERIMENTAL_OCI=1']
+        script << login_oci(helm_opts) if helm_opts[:user] && helm_opts[:password]
+        script << "\"#{helm_opts[:helm]}\" pull \"#{helm_opts[:url]}/#{helm_opts[:chart]}\" --version \"#{helm_opts[:version]}\"" # rubocop:disable Layout/LineLength
+      end
+      script
+    end
+
+    def push_oci(destination) # rubocop:disable Metrics/AbcSize
+      script = []
+      if destination[:url] && helm_opts[:chart] && helm_opts[:version]
+        script = ['export HELM_EXPERIMENTAL_OCI=1']
+        script << login_oci(destination) if destination[:user] && destination[:password]
+        script << "\"#{helm_opts[:helm]}\" push \"#{helm_opts[:chart]}-#{helm_opts[:version]}.tgz\" \"#{destination[:url]}\"" # rubocop:disable Layout/LineLength
+      end
+      script
+    end
+
+    def login_oci(login_opts)
+      require 'uri'
+      "echo \"#{login_opts[:password]}\" | \"#{helm_opts[:helm]}\" registry login --username \"#{login_opts[:user]}\" --password-stdin \"#{URI(login_opts[:url]).host}\"" # rubocop:disable Layout/LineLength
+    end
+
+    def pull_classic # rubocop:disable Metrics/AbcSize
+      script = []
+      if helm_opts[:url] && helm_opts[:chart] && helm_opts[:version]
+        suffix = login_classic(helm_opts)
+        script << "\"#{helm_opts[:helm]}\" repo add source \"#{helm_opts[:url]}\"#{suffix}"
+        script << "\"#{helm_opts[:helm]}\" repo update"
+        script << "\"#{helm_opts[:helm]}\" pull \"source/#{helm_opts[:chart]}\" --version \"#{helm_opts[:version]}\""
+      end
+      script
+    end
+
+    def push_classic(destination)
+      script = []
+      if destination[:url] && helm_opts[:chart] && helm_opts[:version]
+        script << plugin_classic
+        suffix = login_classic(destination)
+        script << "\"#{helm_opts[:helm]}\" cm-push \"#{helm_opts[:chart]}-#{helm_opts[:version]}.tgz\" \"#{destination[:url]}\"#{suffix}" # rubocop:disable Layout/LineLength
+      end
+      script
+    end
+
+    def login_classic(login_opts)
+      if login_opts[:user] && login_opts[:password]
+        " --username \"#{login_opts[:user]}\" --password \"#{login_opts[:password]}\""
+      else
+        ''
+      end
+    end
+
+    def plugin_classic
+      "\"#{helm_opts[:helm]}\" plugin list | grep -q cm-push || \"#{helm_opts[:helm]}\" plugin install https://github.com/chartmuseum/helm-push"
+    end
+  end
+end

data/lib/pipedawg/kaniko_job.rb

@@ -9,82 +9,100 @@ module Pipedawg
       @kaniko_opts = {
         build_args: {},
         config: {
-          '$CI_REGISTRY': {
-            username: '$CI_REGISTRY_USER',
-            password: '$CI_REGISTRY_PASSWORD'
-          }
+          '$CI_REGISTRY': { username: '$CI_REGISTRY_USER', password: '$CI_REGISTRY_PASSWORD' }
         },
-        config_file: '/kaniko/.docker/config.json',
-        context: '${CI_PROJECT_DIR}',
-        destinations: [],
-        dockerfile: 'Dockerfile',
-        executor: '/kaniko/executor',
-        external_files: {},
-        flags: [],
-        ignore_paths: [],
-        insecure_registries: [],
-        kaniko_image: {
-          entrypoint: [''],
-          name: 'gcr.io/kaniko-project/executor:debug'
-        },
-        options: {},
-        registry_certificates: {},
-        registry_mirrors: [],
-        skip_tls_verify_registry: [],
-        trusted_ca_cert_source_files: [],
-        trusted_ca_cert_target_file: '/kaniko/ssl/certs/ca-certificates.crt'
+        config_file: '/kaniko/.docker/config.json', context: '${CI_PROJECT_DIR}', debug: true,
+        destinations: [], dockerfile: 'Dockerfile', executor: '/kaniko/executor', external_files: {},
+        flags: [], ignore_paths: [], insecure_registries: [],
+        image: { entrypoint: [''], name: 'gcr.io/kaniko-project/executor:debug' }, options: {},
+        registry_certificates: {}, registry_mirrors: [], skip_tls_verify_registry: [],
+        trusted_ca_cert_source_files: [], trusted_ca_cert_target_file: '/kaniko/ssl/certs/ca-certificates.crt'
       }.merge(kaniko_opts)
       super name, opts
       update
     end
 
-    def update # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
+    def update # rubocop:disable Metrics/AbcSize
       require 'json'
-      opts[:image] = kaniko_opts[:image]
-      script = ["echo #{kaniko_opts[:config].to_json.inspect} > \"#{kaniko_opts[:config_file]}\""]
-      cert_copies = Array(kaniko_opts[:trusted_ca_cert_source_files]).map do |cert|
+      opts[:image] = kaniko_opts[:image] if kaniko_opts[:image]
+      opts[:script] = debug + config + cert_copies + file_copies + Array(kaniko_cmd)
+    end
+
+    private
+
+    def debug
+      if kaniko_opts[:debug]
+        Pipedawg::Util.echo_proxy_vars
+      else
+        []
+      end
+    end
+
+    def config
+      ["echo #{kaniko_opts[:config].to_json.inspect} > \"#{kaniko_opts[:config_file]}\""]
+    end
+
+    def cert_copies
+      Array(kaniko_opts[:trusted_ca_cert_source_files]).map do |cert|
         "cat \"#{cert}\" >> \"#{kaniko_opts[:trusted_ca_cert_target_file]}\""
       end
-      script.concat cert_copies
-      file_copies = kaniko_opts[:external_files].map do |source, dest|
+    end
+
+    def file_copies
+      kaniko_opts[:external_files].map do |source, dest|
         "cp \"#{source}\" \"#{kaniko_opts[:context]}/#{dest}\""
       end
-      script.concat file_copies
+    end
+
+    def kaniko_cmd # rubocop:disable Metrics/AbcSize
+      ["\"#{kaniko_opts[:executor]}\" --context \"#{kaniko_opts[:context]}\"",
+       "--dockerfile \"#{kaniko_opts[:dockerfile]}\"", flags, options, build_args,
+       ignore_paths, insecure_registries, registry_certificates, registry_mirrors,
+       destinations, skip_tls_verify_registries].reject(&:empty?).join(' ')
+    end
+
+    def flags
       flags = kaniko_opts[:flags].clone
       flags << 'no-push' if kaniko_opts[:destinations].empty?
-      flags_cli = flags.uniq.map { |f| "--#{f}" }.join(' ')
-      options_cli =  kaniko_opts[:options].map { |k, v| "--#{k}=\"#{v}\"" }.join(' ')
-      build_args_cli = kaniko_opts[:build_args].map { |k, v| "--build-arg #{k}=\"#{v}\"" }.join(' ')
-      ignore_paths_cli = Array(kaniko_opts[:ignore_paths]).map { |p| "--ignore-path #{p}" }.join(' ')
-      insecure_registries_cli = Array(kaniko_opts[:insecure_registries]).map do |r|
+      flags.uniq.map { |f| "--#{f}" }.join(' ')
+    end
+
+    def options
+      kaniko_opts[:options].map { |k, v| "--#{k}=\"#{v}\"" }.join(' ')
+    end
+
+    def build_args
+      kaniko_opts[:build_args].map { |k, v| "--build-arg #{k}=\"#{v}\"" }.join(' ')
+    end
+
+    def ignore_paths
+      Array(kaniko_opts[:ignore_paths]).map { |p| "--ignore-path #{p}" }.join(' ')
+    end
+
+    def insecure_registries
+      Array(kaniko_opts[:insecure_registries]).map do |r|
         "--insecure-registry #{r}"
       end.join(' ')
-      registry_certificates_cli = kaniko_opts[:registry_certificates].map do |k, v|
+    end
+
+    def registry_certificates
+      kaniko_opts[:registry_certificates].map do |k, v|
         "--registry-certificate #{k}=\"#{v}\""
       end.join(' ')
-      registry_mirrors_cli = Array(kaniko_opts[:registry_mirrors]).map { |r| "--registry-mirror #{r}" }.join(' ')
-      skip_tls_verify_registrys_cli = Array(kaniko_opts[:skip_tls_verify_registry]).map do |r|
+    end
+
+    def registry_mirrors
+      Array(kaniko_opts[:registry_mirrors]).map { |r| "--registry-mirror #{r}" }.join(' ')
+    end
+
+    def destinations
+      kaniko_opts[:destinations].map { |d| "--destination #{d}" }.join(' ')
+    end
+
+    def skip_tls_verify_registries
+      Array(kaniko_opts[:skip_tls_verify_registry]).map do |r|
         "--skip-tls-verify-registry #{r}"
       end.join(' ')
-      destinations_cli = kaniko_opts[:destinations].map { |d| "--destination #{d}" }.join(' ')
-      kaniko_cmds = [
-        "\"#{kaniko_opts[:executor]}\"",
-        '--context',
-        "\"#{kaniko_opts[:context]}\"",
-        '--dockerfile',
-        "\"#{kaniko_opts[:dockerfile]}\"",
-        flags_cli,
-        options_cli,
-        build_args_cli,
-        ignore_paths_cli,
-        insecure_registries_cli,
-        registry_certificates_cli,
-        registry_mirrors_cli,
-        destinations_cli,
-        skip_tls_verify_registrys_cli
-      ].reject(&:empty?)
-      script << kaniko_cmds.join(' ')
-      opts[:script] = script
     end
   end
 end

data/lib/pipedawg/qualys_scan_job.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+module Pipedawg
+  # qualys_scan_job class
+  class QualysScanJob < Job
+    attr_accessor :qualys_opts
+
+    def initialize(name = 'build', opts = {}, qualys_opts = {})
+      @qualys_opts = {
+        acceptable_risk: '${QUALYS_ACCEPTABLE_IMAGE_RISK}',
+        artifacts: {
+          expire_in: '1 month', paths: ['software.json', 'vulnerabilities.json'], when: 'always'
+        }, debug: true, gateway: '${QUALYS_GATEWAY}', image: nil, password: '${QUALYS_PASSWORD}', rules: nil,
+        scan_image: '${QUALYS_IMAGE}', scan_target_prefix: 'qualys_scan_target', tags: nil, user: '${QUALYS_USERNAME}',
+        variables: { GIT_STRATEGY: 'clone' }
+      }.merge(qualys_opts)
+      super name, opts
+      update
+    end
+
+    def update # rubocop:disable Metrics/AbcSize
+      require 'json'
+      opts[:artifacts] = qualys_opts[:artifacts] if qualys_opts[:artifacts]
+      opts[:image] = qualys_opts[:image]
+      opts[:rules] = qualys_opts[:rules] if qualys_opts[:rules]
+      opts[:tags] = qualys_opts[:tags] if qualys_opts[:tags]
+      opts[:variables] = qualys_opts[:variables] if qualys_opts[:variables]
+      opts[:script] = debug + image + token + scan_start + scan_complete + artifacts + severities + outputs
+    end
+
+    private
+
+    def debug # rubocop:disable Metrics/MethodLength
+      if qualys_opts[:debug]
+        Pipedawg::Util.echo_proxy_vars + [
+          'echo Qualys settings:',
+          "echo   Qualys gateway: \"#{qualys_opts[:gateway]}\"",
+          "echo   Qualys username: \"#{qualys_opts[:user]}\"",
+          "if [ \"#{qualys_opts[:password]}\" != '' ]; then " \
+          'echo   Qualys password is not empty; else ' \
+          'echo   Qualys password is not set; exit 1; fi'
+        ]
+      else
+        []
+      end
+    end
+
+    def image
+      [
+        "image_target=\"#{qualys_opts[:scan_target_prefix]}:$(echo #{qualys_opts[:scan_image]} | sed 's/^[^/]*\\///'| sed 's/[:/]/-/g')\"", # rubocop:disable Layout/LineLength
+        "docker pull \"#{qualys_opts[:scan_image]}\"",
+        "docker image tag \"#{qualys_opts[:scan_image]}\" \"${image_target}\"",
+        "image_id=$(docker inspect --format=\"{{index .Id}}\" \"#{qualys_opts[:scan_image]}\" | cut -c8-19)",
+        'echo "Image ID: ${image_id}"'
+      ]
+    end
+
+    def token
+      ["token=$(curl -s --location --request POST \"https://#{qualys_opts[:gateway]}/auth\" --header \"Content-Type: application/x-www-form-urlencoded\" --data-urlencode \"username=#{qualys_opts[:user]}\" --data-urlencode \"password=#{qualys_opts[:password]}\" --data-urlencode \"token=true\")"] # rubocop:disable Layout/LineLength
+    end
+
+    def scan_start
+      [
+        'while true; do ' \
+        "result=$(curl -s -o /dev/null -w ''%{http_code}'' --location --request GET \"https://#{qualys_opts[:gateway]}/csapi/v1.2/images/$image_id\" --header \"Authorization: Bearer $token\"); " + # rubocop:disable Layout/LineLength, Style/FormatStringToken
+          'echo "Waiting for scan to start..."; ' \
+          'echo "  Result: ${result}"; ' \
+          'if [ "${result}" = "200" ]; then break; fi; ' \
+          'sleep 10; done'
+      ]
+    end
+
+    def scan_complete
+      [
+        'while true; do ' \
+        "result=$(curl -s --location --request GET \"https://#{qualys_opts[:gateway]}/csapi/v1.2/images/$image_id\" --header \"Authorization: Bearer $token\" | jq -r '.scanStatus'); " + # rubocop:disable Layout/LineLength
+          'echo "Waiting for scan to complete..."; ' \
+          'echo "  Result: ${result}"; ' \
+          'if [ "${result}" = "SUCCESS" ]; then break; fi; ' \
+          'sleep 10; done; sleep 30'
+      ]
+    end
+
+    def artifacts
+      [
+        "curl -s --location --request GET \"https://#{qualys_opts[:gateway]}/csapi/v1.2/images/$image_id/software\" --header \"Authorization: Bearer $token\" | jq . > software.json", # rubocop:disable Layout/LineLength
+        "curl -s --location --request GET \"https://#{qualys_opts[:gateway]}/csapi/v1.2/images/$image_id/vuln\" --header \"Authorization: Bearer $token\" | jq . > vulnerabilities.json" # rubocop:disable Layout/LineLength
+      ]
+    end
+
+    def severities
+      [
+        "response=$(curl -s --location --request GET \"https://#{qualys_opts[:gateway]}/csapi/v1.2/images/$image_id/vuln/count\" --header \"Authorization: Bearer $token\")", # rubocop:disable Layout/LineLength
+        'severity5=$(jq -r ".severity5Count" <<< "${response}")',
+        'severity4=$(jq -r ".severity4Count" <<< "${response}")'
+      ]
+    end
+
+    def outputs # rubocop:disable Metrics/MethodLength
+      [
+        'if [ "$severity5" = "null" ]; then ' \
+        'echo "ERROR: Wrong ImageID or problem during vulnerabilities count." >&2; ' \
+        'exit 1; fi',
+        'if [ "$severity4" = "null" ]; then ' \
+        'echo "ERROR: Wrong ImageID or problem during vulnerabilities count." >&2; ' \
+        'exit 1; fi',
+        'echo "Severity5: $severity5, Severity4: $severity4"',
+        'risk=$((($severity5*3)+($severity4)))',
+        'echo "Risk: $risk"',
+        "if (($risk > \"#{qualys_opts[:acceptable_risk]}\")); then " \
+        'echo "Too many vulnerabilities. Severity5: $severity5, Severity4: $severity4" >&2; ' \
+        'exit 1; fi'
+      ]
+    end
+  end
+end

data/lib/pipedawg/util.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Pipedawg
+  # util class
+  class Util
+    def self.expand_env_vars(item) # rubocop:disable Metrics/MethodLength
+      case item
+      when Array
+        item.map { |i| expand_env_vars(i) }
+      when Hash
+        item.each { |k, v| item[k] = expand_env_vars(v) }
+        item
+      when String
+        item.gsub(/\${([^} ]+)}/) do |e|
+          ENV[e.gsub('${', '').gsub('}', '')]
+        end
+      else
+        item
+      end
+    end
+
+    def self.puts_proxy_vars
+      puts 'Proxy settings:'
+      puts "http_proxy: #{ENV['http_proxy']}"
+      puts "https_proxy: #{ENV['https_proxy']}"
+      puts "no_proxy: #{ENV['no_proxy']}"
+      puts "HTTP_PROXY: #{ENV['HTTP_PROXY']}"
+      puts "HTTPS_PROXY: #{ENV['HTTPS_PROXY']}"
+      puts "NO_PROXY: #{ENV['NO_PROXY']}"
+    end
+
+    def self.echo_proxy_vars
+      script = ['echo Proxy settings:']
+      script << 'echo   http_proxy: "${http_proxy}"'
+      script << 'echo   https_proxy: "${https_proxy}"'
+      script << 'echo   no_proxy: "${no_proxy}"'
+      script << 'echo   HTTP_PROXY: "${HTTP_PROXY}"'
+      script << 'echo   HTTPS_PROXY: "${HTTPS_PROXY}"'
+      script << 'echo   NO_PROXY: "${NO_PROXY}"'
+      script
+    end
+  end
+end

data/lib/pipedawg/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Pipedawg
-  VERSION = '0.2.2'
+  VERSION = '0.5.0'
 end

data/lib/pipedawg.rb

@@ -1,8 +1,11 @@
 # frozen_string_literal: true
 
 require 'pipedawg/job'
+require 'pipedawg/helm_copy_job'
 require 'pipedawg/kaniko_job'
 require 'pipedawg/pipeline'
+require 'pipedawg/qualys_scan_job'
+require 'pipedawg/util'
 require 'pipedawg/version'
 
 module Pipedawg

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pipedawg
 version: !ruby/object:Gem::Version
-  version: 0.2.2
+  version: 0.5.0
 platform: ruby
 authors:
 - harbottle
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-02-01 00:00:00.000000000 Z
+date: 2022-02-08 00:00:00.000000000 Z
 dependencies: []
 description: Generate GitLab CI pipelines.
 email:
@@ -20,9 +20,12 @@ files:
 - LICENSE.txt
 - README.md
 - lib/pipedawg.rb
+- lib/pipedawg/helm_copy_job.rb
 - lib/pipedawg/job.rb
 - lib/pipedawg/kaniko_job.rb
 - lib/pipedawg/pipeline.rb
+- lib/pipedawg/qualys_scan_job.rb
+- lib/pipedawg/util.rb
 - lib/pipedawg/version.rb
 homepage: https://github.com/liger1978/pipedawg
 licenses: