pipedawg 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 064c29963799087a56d2cde36f785bc9762cd50870dc9eeede4f9efbfc577f0f
-  data.tar.gz: fd51dfa82c3d16c215f284dfd7c84c5600906738fef8d6f6b0d69b22e967af33
+  metadata.gz: 53733705295ce1c9b2ae80fc1c8368e7e08e7d7a0e1fcf3727fe972dd5714fb1
+  data.tar.gz: 10e86751592488fbb9972605892d79af662e60e3a3da070292cf4933f31b7981
 SHA512:
-  metadata.gz: c7241f30f45d72d1d43e03ef7b007c24756b1a16c483f605c179a02eb02c89b900926fd20c93502fbc94585cc9f1fa94ba41fefa27cabf497568b05ff252a75e
-  data.tar.gz: 7c72d19557c1f449dd56315465d1f22d66277005dfb39c59a67d83ef5389800511fcbbfc7fae3409f235d66834256d5f9566d63d8610f37b1a718c0d4f99285a
+  metadata.gz: 11584d541a5d63f54761dee9ca878e3c79ba168ee1e5e93ec9ddccd559d869672a900a6aa25d966df4ef807a56ac0c75385644baf3bce5498ac7a68a29fd8a9a
+  data.tar.gz: 97f20d550f1cbe4bf298a2f6884f02754cd385e317d777887d11a8748d7436d8bb6db035944c6f59d2593b4e3a615db76f28c678bb392cf16ef3e6c6f92770a9

data/lib/pipedawg/qualys_scan_job.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+module Pipedawg
+  # qualys_scan_job class
+  class QualysScanJob < Job
+    attr_accessor :qualys_opts
+
+    def initialize(name = 'build', opts = {}, qualys_opts = {})
+      @qualys_opts = {
+        acceptable_risk: '${QUALYS_ACCEPTABLE_IMAGE_RISK}',
+        artifacts: {
+          expire_in: '1 month', paths: ['software.json', 'vulnerabilities.json'], when: 'always'
+        }, debug: true, gateway: '${QUALYS_GATEWAY}', image: nil, password: '${QUALYS_PASSWORD}', rules: nil,
+        scan_image: '${QUALYS_IMAGE}', scan_target_prefix: 'qualys_scan_target', tags: nil, user: '${QUALYS_USERNAME}',
+        variables: { GIT_STRATEGY: 'clone' }
+      }.merge(qualys_opts)
+      super name, opts
+      update
+    end
+
+    def update # rubocop:disable Metrics/AbcSize
+      require 'json'
+      opts[:artifacts] = qualys_opts[:artifacts] if qualys_opts[:artifacts]
+      opts[:image] = qualys_opts[:image]
+      opts[:rules] = qualys_opts[:rules] if qualys_opts[:rules]
+      opts[:tags] = qualys_opts[:tags] if qualys_opts[:tags]
+      opts[:variables] = qualys_opts[:variables] if qualys_opts[:variables]
+      opts[:script] = debug + image + token + scan_start + scan_complete + artifacts + severities + outputs
+    end
+
+    private
+
+    def debug # rubocop:disable Metrics/MethodLength
+      if qualys_opts[:debug]
+        Pipedawg::Util.echo_proxy_vars + [
+          'echo Qualys settings:',
+          "echo   Qualys gateway: \"#{qualys_opts[:gateway]}\"",
+          "echo   Qualys username: \"#{qualys_opts[:user]}\"",
+          "if [ \"#{qualys_opts[:password]}\" != '' ]; then " \
+          'echo   Qualys password is not empty; else ' \
+          'echo   Qualys password is not set; exit 1; fi'
+        ]
+      else
+        []
+      end
+    end
+
+    def image
+      [
+        "image_target=\"#{qualys_opts[:scan_target_prefix]}:$(echo #{qualys_opts[:scan_image]} | sed 's/^[^/]*\\///'| sed 's/[:/]/-/g')\"", # rubocop:disable Layout/LineLength
+        "docker pull \"#{qualys_opts[:scan_image]}\"",
+        "docker image tag \"#{qualys_opts[:scan_image]}\" \"${image_target}\"",
+        "image_id=$(docker inspect --format=\"{{index .Id}}\" \"#{qualys_opts[:scan_image]}\" | cut -c8-19)",
+        'echo "Image ID: ${image_id}"'
+      ]
+    end
+
+    def token
+      ["token=$(curl -s --location --request POST \"https://#{qualys_opts[:gateway]}/auth\" --header \"Content-Type: application/x-www-form-urlencoded\" --data-urlencode \"username=#{qualys_opts[:user]}\" --data-urlencode \"password=#{qualys_opts[:password]}\" --data-urlencode \"token=true\")"] # rubocop:disable Layout/LineLength
+    end
+
+    def scan_start
+      [
+        'while true; do ' \
+        "result=$(curl -s -o /dev/null -w ''%{http_code}'' --location --request GET \"https://#{qualys_opts[:gateway]}/csapi/v1.2/images/$image_id\" --header \"Authorization: Bearer $token\"); " + # rubocop:disable Layout/LineLength, Style/FormatStringToken
+          'echo "Waiting for scan to start..."; ' \
+          'echo "  Result: ${result}"; ' \
+          'if [ "${result}" = "200" ]; then break; fi; ' \
+          'sleep 10; done'
+      ]
+    end
+
+    def scan_complete
+      [
+        'while true; do ' \
+        "result=$(curl -s --location --request GET \"https://#{qualys_opts[:gateway]}/csapi/v1.2/images/$image_id\" --header \"Authorization: Bearer $token\" | jq -r '.scanStatus'); " + # rubocop:disable Layout/LineLength
+          'echo "Waiting for scan to complete..."; ' \
+          'echo "  Result: ${result}"; ' \
+          'if [ "${result}" = "SUCCESS" ]; then break; fi; ' \
+          'sleep 10; done; sleep 30'
+      ]
+    end
+
+    def artifacts
+      [
+        "curl -s --location --request GET \"https://#{qualys_opts[:gateway]}/csapi/v1.2/images/$image_id/software\" --header \"Authorization: Bearer $token\" | jq . > software.json", # rubocop:disable Layout/LineLength
+        "curl -s --location --request GET \"https://#{qualys_opts[:gateway]}/csapi/v1.2/images/$image_id/vuln\" --header \"Authorization: Bearer $token\" | jq . > vulnerabilities.json" # rubocop:disable Layout/LineLength
+      ]
+    end
+
+    def severities
+      [
+        "response=$(curl -s --location --request GET \"https://#{qualys_opts[:gateway]}/csapi/v1.2/images/$image_id/vuln/count\" --header \"Authorization: Bearer $token\")", # rubocop:disable Layout/LineLength
+        'severity5=$(jq -r ".severity5Count" <<< "${response}")',
+        'severity4=$(jq -r ".severity4Count" <<< "${response}")'
+      ]
+    end
+
+    def outputs # rubocop:disable Metrics/MethodLength
+      [
+        'if [ "$severity5" = "null" ]; then ' \
+        'echo "ERROR: Wrong ImageID or problem during vulnerabilities count." >&2; ' \
+        'exit 1; fi',
+        'if [ "$severity4" = "null" ]; then ' \
+        'echo "ERROR: Wrong ImageID or problem during vulnerabilities count." >&2; ' \
+        'exit 1; fi',
+        'echo "Severity5: $severity5, Severity4: $severity4"',
+        'risk=$((($severity5*3)+($severity4)))',
+        'echo "Risk: $risk"',
+        "if (($risk > \"#{qualys_opts[:acceptable_risk]}\")); then " \
+        'echo "Too many vulnerabilities. Severity5: $severity5, Severity4: $severity4" >&2; ' \
+        'exit 1; fi'
+      ]
+    end
+  end
+end

data/lib/pipedawg/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Pipedawg
-  VERSION = '0.4.0'
+  VERSION = '0.5.0'
 end

data/lib/pipedawg.rb

@@ -4,6 +4,7 @@ require 'pipedawg/job'
 require 'pipedawg/helm_copy_job'
 require 'pipedawg/kaniko_job'
 require 'pipedawg/pipeline'
+require 'pipedawg/qualys_scan_job'
 require 'pipedawg/util'
 require 'pipedawg/version'
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pipedawg
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - harbottle
@@ -24,6 +24,7 @@ files:
 - lib/pipedawg/job.rb
 - lib/pipedawg/kaniko_job.rb
 - lib/pipedawg/pipeline.rb
+- lib/pipedawg/qualys_scan_job.rb
 - lib/pipedawg/util.rb
 - lib/pipedawg/version.rb
 homepage: https://github.com/liger1978/pipedawg