@soos-io/soos-sbom 0.1.0-pre.1

package/README.md

@@ -0,0 +1,8 @@
+# soos-sbom
+SOOS wrapper script to upload SBOMS.
+
+## Installation
+run `npm i -g @soos-io/soos-sbom@1.0.0-pre.2`
+
+## Usage
+run `soos-sbom` from any terminal.

package/bin/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/bin/index.js

@@ -0,0 +1,248 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+const api_client_1 = require("@soos-io/api-client");
+const utilities_1 = require("@soos-io/api-client/dist/utilities");
+const argparse_1 = require("argparse");
+const FileSystem = tslib_1.__importStar(require("fs"));
+const Path = tslib_1.__importStar(require("path"));
+const form_data_1 = tslib_1.__importDefault(require("form-data"));
+const constants_1 = require("./utils/constants");
+const process_1 = require("process");
+const SOOSAnalysisApiClient_1 = tslib_1.__importDefault(require("@soos-io/api-client/dist/api/SOOSAnalysisApiClient"));
+class SOOSSBOMAnalysis {
+    constructor(args) {
+        this.args = args;
+    }
+    static parseArgs() {
+        const parser = new argparse_1.ArgumentParser({ description: "SOOS SBOM" });
+        parser.add_argument("--apiKey", {
+            help: "SOOS API Key - get yours from https://app.soos.io/integrate/sbom",
+            default: (0, utilities_1.getEnvVariable)(constants_1.CONSTANTS.SOOS.API_KEY_ENV_VAR),
+            required: false,
+        });
+        parser.add_argument("--apiURL", {
+            help: "SOOS API URL - Intended for internal use only, do not modify.",
+            default: "https://api.soos.io/api/",
+            required: false,
+        });
+        parser.add_argument("--appVersion", {
+            help: "App Version - Intended for internal use only.",
+            required: false,
+        });
+        parser.add_argument("--branchName", {
+            help: "The name of the branch from the SCM System.",
+            default: null,
+            required: false,
+        });
+        parser.add_argument("--branchURI", {
+            help: "The URI to the branch from the SCM System.",
+            default: null,
+            required: false,
+        });
+        parser.add_argument("--buildURI", {
+            help: "URI to CI build info.",
+            default: null,
+            required: false,
+        });
+        parser.add_argument("--buildVersion", {
+            help: "Version of application build artifacts.",
+            default: null,
+            required: false,
+        });
+        parser.add_argument("--clientId", {
+            help: "SOOS Client ID - get yours from https://app.soos.io/integrate/sbom",
+            default: (0, utilities_1.getEnvVariable)(constants_1.CONSTANTS.SOOS.CLIENT_ID_ENV_VAR),
+            required: false,
+        });
+        parser.add_argument("--commitHash", {
+            help: "The commit hash value from the SCM System.",
+            default: null,
+            required: false,
+        });
+        parser.add_argument("--integrationName", {
+            help: "Integration Name - Intended for internal use only.",
+            required: false,
+        });
+        parser.add_argument("--integrationType", {
+            help: "Integration Type - Intended for internal use only.",
+            required: false,
+        });
+        parser.add_argument("--logLevel", {
+            help: "Minimum level to show logs: PASS, IGNORE, INFO, WARN or FAIL.",
+            default: api_client_1.LogLevel.INFO,
+            required: false,
+            type: (value) => {
+                const upperCaseValue = value.toUpperCase();
+                if (upperCaseValue in api_client_1.LogLevel) {
+                    return api_client_1.LogLevel[upperCaseValue];
+                }
+                else {
+                    throw new Error(`Invalid log level: ${value}`);
+                }
+            },
+        });
+        parser.add_argument("--onFailure", {
+            help: "Action to perform when the scan fails. Options: fail_the_build, continue_on_failure.",
+            default: "continue_on_failure",
+            required: false,
+        });
+        parser.add_argument("--operatingEnvironment", {
+            help: "Set Operating environment for information purposes only.",
+            default: null,
+            required: false,
+        });
+        parser.add_argument("--otherOptions", {
+            help: "Other Options to pass to syft.",
+            default: null,
+            required: false,
+        });
+        parser.add_argument("--projectName", {
+            help: "Project Name - this is what will be displayed in the SOOS app.",
+            required: true,
+        });
+        parser.add_argument("--scriptVersion", {
+            help: "Script Version - Intended for internal use only.",
+            required: false,
+        });
+        parser.add_argument("--verbose", {
+            help: "Enable verbose logging.",
+            action: "store_true",
+            default: false,
+            required: false,
+        });
+        parser.add_argument("sbomPath", {
+            help: "The SBOM File to scan, it could be the location of the file or the file itself. When location is specified only the first file found will be scanned.",
+        });
+        api_client_1.soosLogger.info("Parsing arguments");
+        return parser.parse_args();
+    }
+    runAnalysis() {
+        var _a;
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            let projectHash;
+            let branchHash;
+            let analysisId;
+            const filePath = yield this.findSbomFilePath();
+            const soosAnalysisApiClient = new SOOSAnalysisApiClient_1.default(this.args.apiKey, this.args.apiURL);
+            try {
+                api_client_1.soosLogger.info("Starting SOOS SBOM Analysis");
+                api_client_1.soosLogger.info(`Creating scan for project '${this.args.projectName}'...`);
+                api_client_1.soosLogger.info(`Branch Name: ${this.args.branchName}`);
+                const result = yield soosAnalysisApiClient.createScan({
+                    clientId: this.args.clientId,
+                    projectName: this.args.projectName,
+                    commitHash: this.args.commitHash,
+                    branch: this.args.branchName,
+                    buildVersion: this.args.buildVersion,
+                    buildUri: this.args.buildUri,
+                    branchUri: this.args.branchUri,
+                    integrationType: this.args.integrationType,
+                    operatingEnvironment: this.args.operatingEnvironment,
+                    integrationName: this.args.integrationName,
+                    appVersion: this.args.appVersion,
+                    scriptVersion: null,
+                    contributingDeveloperAudit: undefined,
+                    scanType: api_client_1.ScanType.SBOM,
+                    toolName: null,
+                    toolVersion: null,
+                });
+                projectHash = result.projectHash;
+                branchHash = result.branchHash;
+                analysisId = result.analysisId;
+                api_client_1.soosLogger.info(`Project Hash: ${projectHash}`);
+                api_client_1.soosLogger.info(`Branch Hash: ${branchHash}`);
+                api_client_1.soosLogger.info(`Scan Id: ${analysisId}`);
+                api_client_1.soosLogger.info("Scan created successfully.");
+                api_client_1.soosLogger.logLineSeparator();
+                api_client_1.soosLogger.info("Uploading SBOM File");
+                const formData = yield this.getSbomAsFormData(filePath);
+                const uploadManifestFilesResponse = yield soosAnalysisApiClient.uploadManifestFiles({
+                    clientId: this.args.clientId,
+                    projectHash,
+                    branchHash,
+                    analysisId,
+                    manifestFiles: formData,
+                });
+                api_client_1.soosLogger.info(` SBOM Files: \n`, `  ${uploadManifestFilesResponse.message} \n`, (_a = uploadManifestFilesResponse.manifests) === null || _a === void 0 ? void 0 : _a.map((m) => `  ${m.name}: ${m.statusMessage}`).join("\n"));
+                api_client_1.soosLogger.logLineSeparator();
+                api_client_1.soosLogger.info("Starting SBOM Analysis scan");
+                yield soosAnalysisApiClient.startScan({
+                    clientId: this.args.clientId,
+                    projectHash,
+                    analysisId: analysisId,
+                });
+                api_client_1.soosLogger.info(`Analysis scan started successfully, to see the results visit: ${result.scanUrl}`);
+            }
+            catch (error) {
+                if (projectHash && branchHash && analysisId)
+                    yield soosAnalysisApiClient.updateScanStatus({
+                        clientId: this.args.clientId,
+                        projectHash,
+                        branchHash,
+                        scanType: api_client_1.ScanType.SBOM,
+                        scanId: analysisId,
+                        status: api_client_1.ScanStatus.Error,
+                        message: `Error while performing scan.`,
+                    });
+                api_client_1.soosLogger.error(error);
+                (0, process_1.exit)(1);
+            }
+        });
+    }
+    getSbomAsFormData(filePath) {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            try {
+                const fileReadStream = FileSystem.createReadStream(filePath, {
+                    encoding: api_client_1.SOOS_CONSTANTS.FileUploads.Encoding,
+                });
+                const formData = new form_data_1.default();
+                formData.append("file", fileReadStream);
+                return formData;
+            }
+            catch (error) {
+                api_client_1.soosLogger.error(`Error on getSbomAsFormData: ${error}`);
+                throw error;
+            }
+        });
+    }
+    findSbomFilePath() {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            const sbomPathStat = yield FileSystem.statSync(this.args.sbomPath);
+            if (sbomPathStat.isDirectory()) {
+                const files = yield FileSystem.promises.readdir(this.args.sbomPath);
+                const sbomFile = files.find((file) => constants_1.CONSTANTS.SBOM.FILE_REGEX.test(file));
+                if (!sbomFile) {
+                    throw new Error("No SBOM file found in the directory.");
+                }
+                return Path.join(this.args.sbomPath, sbomFile);
+            }
+            if (!constants_1.CONSTANTS.SBOM.FILE_REGEX.test(this.args.sbomPath)) {
+                throw new Error("The file does not match the required SBOM pattern.");
+            }
+            return this.args.sbomPath;
+        });
+    }
+    static createAndRun() {
+        return tslib_1.__awaiter(this, void 0, void 0, function* () {
+            api_client_1.soosLogger.info("Starting SOOS SBOM Analysis");
+            api_client_1.soosLogger.logLineSeparator();
+            try {
+                const args = this.parseArgs();
+                api_client_1.soosLogger.setMinLogLevel(args.logLevel);
+                api_client_1.soosLogger.setVerbose(args.verbose);
+                api_client_1.soosLogger.info("Configuration read");
+                api_client_1.soosLogger.verboseDebug(JSON.stringify((0, utilities_1.obfuscateProperties)(args, ["apiKey"]), null, 2));
+                api_client_1.soosLogger.logLineSeparator();
+                const soosSBOMAnalysis = new SOOSSBOMAnalysis(args);
+                yield soosSBOMAnalysis.runAnalysis();
+            }
+            catch (error) {
+                api_client_1.soosLogger.error(`Error on createAndRun: ${error}`);
+                (0, process_1.exit)(1);
+            }
+        });
+    }
+}
+SOOSSBOMAnalysis.createAndRun();

package/bin/utils/constants.d.ts

@@ -0,0 +1,9 @@
+export declare const CONSTANTS: {
+    SOOS: {
+        API_KEY_ENV_VAR: string;
+        CLIENT_ID_ENV_VAR: string;
+    };
+    SBOM: {
+        FILE_REGEX: RegExp;
+    };
+};

package/bin/utils/constants.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONSTANTS = void 0;
+exports.CONSTANTS = {
+    SOOS: {
+        API_KEY_ENV_VAR: "SOOS_API_KEY",
+        CLIENT_ID_ENV_VAR: "SOOS_CLIENT_ID",
+    },
+    SBOM: {
+        FILE_REGEX: /\.(cdx|spdx)\.json$/,
+    },
+};

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@soos-io/soos-sbom",
+  "version": "0.1.0-pre.1",
+  "description": "SOOS wrapper script to upload sboms.",
+  "main": "bin/index.js",
+  "scripts": {
+    "setup:install": "npm install",
+    "setup:clean-install": "npm ci",
+    "setup:update": "npx npm-check -u",
+    "setup:clean": "npx rimraf node_modules && npx rimraf package-lock.json",
+    "build": "tsc",
+    "build:clean": "npx rimraf build",
+    "format": "prettier ./src --check",
+    "format:fix": "prettier ./src --write",
+    "typecheck": "tsc --noEmit",
+    "check": "npm run format && npm run typecheck && npm outdated"
+  },
+  "dependencies": {
+    "@soos-io/api-client": "0.1.5",
+    "argparse": "^2.0.1",
+    "axios": "^0.27.2",
+    "tslib": "^2.6.2"
+  },
+  "devDependencies": {
+    "@types/argparse": "^2.0.11",
+    "@types/glob": "^8.1.0",
+    "@types/node": "^20.6.3",
+    "prettier": "^2.8.8",
+    "typescript": "^5.2.2"
+  },
+  "bin": {
+    "soos-sbom": "bin/index.js"
+  },
+  "author": "SOOS",
+  "license": "MIT"
+}