@soos-io/soos-sbom 0.1.3 → 0.1.7

package/README.md

@@ -2,7 +2,7 @@
 
 SOOS is an independent software security company, located in Winooski, VT USA, building security software for your team. [SOOS, Software security, simplified](https://soos.io).
 
-Use SOOS to scan your software for [vulnerabilities](https://app.soos.io/research/vulnerabilities) and [open source license](https://app.soos.io/research/licenses) issues with [SOOS Core SCA](https://soos.io/sca-product). [Generate SBOMs](https://kb.soos.io/help/generating-a-software-bill-of-materials-sbom). Govern your open source dependencies. Run the [SOOS DAST vulnerability scanner](https://soos.io/dast-product) against your web apps or APIs.
+Use SOOS to scan your software for [vulnerabilities](https://app.soos.io/research/vulnerabilities) and [open source license](https://app.soos.io/research/licenses) issues with [SOOS Core SCA](https://soos.io/products/sca). [Generate SBOMs](https://kb.soos.io/help/soos-reports-for-export). Govern your open source dependencies. Run the [SOOS DAST vulnerability scanner](https://soos.io/products/dast) against your web apps or APIs.
 
 [Demo SOOS](https://app.soos.io/demo) or [Register for a Free Trial](https://app.soos.io/register).
 
@@ -12,28 +12,34 @@ If you maintain an Open Source project, sign up for the Free as in Beer [SOOS Co
   - [npm](https://docs.npmjs.com/downloading-and-installing-node-js-and-npm)
   
 ## Installation
+
+### Globally
 run `npm i -g @soos-io/soos-sbom@latest`
+Then Run `soos-sbom` from any terminal and add the parameters you want.
 
-## Usage
-Run `soos-sbom` from any terminal and add the parameters you want.
+### Locally
+run `npm install --prefix ./soos @soos-io/soos-sbom`
+Then run from the same terminal `node ./soos/node_modules/@soos-io/soos-sbom/bin/index.js`
 
 ## Parameters
 
 
 | Argument                | Default                                   | Description                                                                                                                          |
 | ----------------------- | ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
-| `--apiKey`              | `getEnvVariable(CONSTANTS.SOOS.API_KEY_ENV_VAR)` | SOOS API Key - get yours from [SOOS Integration](https://app.soos.io/integrate/sbom).                                           |
-| `--apiURL`              | `"https://api.soos.io/api/"`              | SOOS API URL - Intended for internal use only, do not modify.                                                                       |
+| `--apiKey`              | N/A | SSOOS API Key - get yours from [SOOS Integration](https://app.soos.io/integrate/sbom). Uses `SOOS_API_KEY` env value if present.                                        |
+| `--apiURL`              | N/A                                       | SOOS API URL - Intended for internal use only, do not modify.                                                    |
 | `--appVersion`          | N/A                                       | App Version - Intended for internal use only.                                                                                      |
 | `--branchName`          | `null`                                    | The name of the branch from the SCM System.                                                                                         |
 | `--branchURI`           | `null`                                    | The URI to the branch from the SCM System.                                                                                          |
 | `--buildURI`            | `null`                                    | URI to CI build info.                                                                                                               |
 | `--buildVersion`        | `null`                                    | Version of application build artifacts.                                                                                             |
-| `--clientId`            | `getEnvVariable(CONSTANTS.SOOS.CLIENT_ID_ENV_VAR)` | SOOS Client ID - get yours from [SOOS Integration](https://app.soos.io/integrate/sbom).                                           |
+| `--clientId`            | N/A | SSOOS Client ID - get yours from [SOOS Integration](https://app.soos.io/integrate/sbom). Uses `SOOS_API_CLIENT` env value if present.                                           |
 | `--commitHash`          | `null`                                    | The commit hash value from the SCM System.                                                                                         |
 | `--integrationName`     | N/A                                       | Integration Name - Intended for internal use only.                                                                                 |
 | `--integrationType`     | N/A                                       | Integration Type - Intended for internal use only.                                                                                 |
-| `--logLevel`            | `LogLevel.INFO`                          | Minimum level to show logs: PASS, IGNORE, INFO, WARN, or FAIL.                                                                      |
+| `--logLevel`            | `INFO`                          | Minimum level to show logs: PASS, IGNORE, INFO, WARN, or FAIL.                                                                      |
+
+| `--onFailure`            | `continue_on_failure`                     | Action to perform when the scan fails. Options: fail_the_build, continue_on_failure.                                                 |
 | `--operatingEnvironment`| `null`                                    | Set Operating environment for information purposes only.                                                                           |
 | `--otherOptions`        | `null`                                    | Other Options to pass to syft.                                                                                                      |
 | `--projectName`         | N/A                                       | Project Name - this is what will be displayed in the SOOS app.                                                                     |

package/bin/constants.d.ts

@@ -0,0 +1,3 @@
+export declare const SOOS_SBOM_CONSTANTS: {
+    FileRegex: RegExp;
+};

package/bin/constants.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SOOS_SBOM_CONSTANTS = void 0;
+exports.SOOS_SBOM_CONSTANTS = {
+    FileRegex: /\.(cdx|spdx)\.json$/,
+};

package/bin/index.js

@@ -4,208 +4,122 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const tslib_1 = require("tslib");
 const api_client_1 = require("@soos-io/api-client");
 const utilities_1 = require("@soos-io/api-client/dist/utilities");
-const argparse_1 = require("argparse");
 const FileSystem = tslib_1.__importStar(require("fs"));
 const Path = tslib_1.__importStar(require("path"));
-const form_data_1 = tslib_1.__importDefault(require("form-data"));
-const constants_1 = require("./utils/constants");
 const process_1 = require("process");
-const SOOSAnalysisApiClient_1 = tslib_1.__importDefault(require("@soos-io/api-client/dist/api/SOOSAnalysisApiClient"));
+const AnalysisArgumentParser_1 = tslib_1.__importDefault(require("@soos-io/api-client/dist/services/AnalysisArgumentParser"));
+const package_json_1 = require("../package.json");
+const AnalysisService_1 = tslib_1.__importDefault(require("@soos-io/api-client/dist/services/AnalysisService"));
+const constants_1 = require("./constants");
 class SOOSSBOMAnalysis {
     constructor(args) {
         this.args = args;
     }
     static parseArgs() {
-        const parser = new argparse_1.ArgumentParser({ description: "SOOS SBOM" });
-        parser.add_argument("--apiKey", {
-            help: "SOOS API Key - get yours from https://app.soos.io/integrate/sbom",
-            default: (0, utilities_1.getEnvVariable)(constants_1.CONSTANTS.SOOS.API_KEY_ENV_VAR),
-            required: false,
-        });
-        parser.add_argument("--apiURL", {
-            help: "SOOS API URL - Intended for internal use only, do not modify.",
-            default: "https://api.soos.io/api/",
-            required: false,
-            type: (value) => {
-                return (0, utilities_1.ensureNonEmptyValue)(value, "apiURL");
-            },
-        });
-        parser.add_argument("--appVersion", {
-            help: "App Version - Intended for internal use only.",
-            required: false,
-        });
-        parser.add_argument("--branchName", {
-            help: "The name of the branch from the SCM System.",
-            default: null,
-            required: false,
-        });
-        parser.add_argument("--branchURI", {
-            help: "The URI to the branch from the SCM System.",
-            default: null,
-            required: false,
-        });
-        parser.add_argument("--buildURI", {
-            help: "URI to CI build info.",
-            default: null,
-            required: false,
-        });
-        parser.add_argument("--buildVersion", {
-            help: "Version of application build artifacts.",
-            default: null,
-            required: false,
-        });
-        parser.add_argument("--clientId", {
-            help: "SOOS Client ID - get yours from https://app.soos.io/integrate/sbom",
-            default: (0, utilities_1.getEnvVariable)(constants_1.CONSTANTS.SOOS.CLIENT_ID_ENV_VAR),
-            required: false,
-        });
-        parser.add_argument("--commitHash", {
-            help: "The commit hash value from the SCM System.",
-            default: null,
-            required: false,
-        });
-        parser.add_argument("--integrationName", {
-            help: "Integration Name - Intended for internal use only.",
-            required: false,
-        });
-        parser.add_argument("--integrationType", {
-            help: "Integration Type - Intended for internal use only.",
-            required: false,
-            default: constants_1.CONSTANTS.SOOS.DEFAULT_INTEGRATION_TYPE,
-        });
-        parser.add_argument("--logLevel", {
-            help: "Minimum level to show logs: PASS, IGNORE, INFO, WARN or FAIL.",
-            default: api_client_1.LogLevel.INFO,
-            required: false,
-            type: (value) => {
-                return (0, utilities_1.ensureEnumValue)(api_client_1.LogLevel, value);
-            },
-        });
-        parser.add_argument("--operatingEnvironment", {
-            help: "Set Operating environment for information purposes only.",
-            default: null,
-            required: false,
-        });
-        parser.add_argument("--projectName", {
-            help: "Project Name - this is what will be displayed in the SOOS app.",
-            required: true,
-            type: (value) => {
-                return (0, utilities_1.ensureNonEmptyValue)(value, "projectName");
-            },
-        });
-        parser.add_argument("--scriptVersion", {
-            help: "Script Version - Intended for internal use only.",
-            required: false,
-        });
-        parser.add_argument("--verbose", {
-            help: "Enable verbose logging.",
-            action: "store_true",
-            default: false,
-            required: false,
-        });
-        parser.add_argument("sbomPath", {
+        const analysisArgumentParser = AnalysisArgumentParser_1.default.create(api_client_1.ScanType.SBOM);
+        analysisArgumentParser.addBaseScanArguments(api_client_1.IntegrationName.SoosSbom, api_client_1.IntegrationType.Script, package_json_1.version);
+        analysisArgumentParser.argumentParser.add_argument("sbomPath", {
             help: "The SBOM File to scan, it could be the location of the file or the file itself. When location is specified only the first file found will be scanned.",
         });
         api_client_1.soosLogger.info("Parsing arguments");
-        return parser.parse_args();
+        return analysisArgumentParser.parseArguments();
     }
     async runAnalysis() {
+        const scanType = api_client_1.ScanType.SBOM;
+        const soosAnalysisService = AnalysisService_1.default.create(this.args.apiKey, this.args.apiURL);
         let projectHash;
         let branchHash;
         let analysisId;
-        const filePath = await this.findSbomFilePath();
-        const soosAnalysisApiClient = new SOOSAnalysisApiClient_1.default(this.args.apiKey, this.args.apiURL);
+        let scanStatusUrl;
+        const sbomFilePath = await this.findSbomFilePath();
         try {
-            api_client_1.soosLogger.info("Starting SOOS SBOM Analysis");
-            api_client_1.soosLogger.info(`Creating scan for project '${this.args.projectName}'...`);
-            api_client_1.soosLogger.info(`Branch Name: ${this.args.branchName}`);
-            const result = await soosAnalysisApiClient.createScan({
+            const result = await soosAnalysisService.setupScan({
                 clientId: this.args.clientId,
                 projectName: this.args.projectName,
+                branchName: this.args.branchName,
                 commitHash: this.args.commitHash,
-                branch: this.args.branchName,
                 buildVersion: this.args.buildVersion,
-                buildUri: this.args.buildUri,
-                branchUri: this.args.branchUri,
-                integrationType: this.args.integrationType,
+                buildUri: this.args.buildURI,
+                branchUri: this.args.branchURI,
                 operatingEnvironment: this.args.operatingEnvironment,
                 integrationName: this.args.integrationName,
+                integrationType: this.args.integrationType,
                 appVersion: this.args.appVersion,
-                scriptVersion: null,
-                contributingDeveloperAudit: undefined,
-                scanType: api_client_1.ScanType.SBOM,
-                toolName: null,
-                toolVersion: null,
+                scriptVersion: this.args.scriptVersion,
+                contributingDeveloperAudit: !this.args.contributingDeveloperId ||
+                    !this.args.contributingDeveloperSource ||
+                    !this.args.contributingDeveloperSourceName
+                    ? []
+                    : [
+                        {
+                            contributingDeveloperId: this.args.contributingDeveloperId,
+                            source: this.args.contributingDeveloperSource,
+                            sourceName: this.args.contributingDeveloperSourceName,
+                        },
+                    ],
+                scanType,
             });
             projectHash = result.projectHash;
             branchHash = result.branchHash;
             analysisId = result.analysisId;
-            api_client_1.soosLogger.info(`Project Hash: ${projectHash}`);
-            api_client_1.soosLogger.info(`Branch Hash: ${branchHash}`);
-            api_client_1.soosLogger.info(`Scan Id: ${analysisId}`);
-            api_client_1.soosLogger.info("Scan created successfully.");
+            scanStatusUrl = result.scanStatusUrl;
             api_client_1.soosLogger.logLineSeparator();
-            api_client_1.soosLogger.info("Uploading SBOM File");
-            const formData = await this.getSbomAsFormData(filePath);
-            const uploadManifestFilesResponse = await soosAnalysisApiClient.uploadManifestFiles({
+            api_client_1.soosLogger.info("Uploading SBOM File...");
+            const formData = await soosAnalysisService.getAnalysisFilesAsFormData([sbomFilePath], this.args.sbomPath);
+            const manifestUploadResponse = await soosAnalysisService.analysisApiClient.uploadManifestFiles({
                 clientId: this.args.clientId,
                 projectHash,
                 branchHash,
                 analysisId,
                 manifestFiles: formData,
+                hasMoreThanMaximumManifests: false,
             });
-            api_client_1.soosLogger.info(` SBOM Files: \n`, `  ${uploadManifestFilesResponse.message} \n`, uploadManifestFilesResponse.manifests
-                ?.map((m) => `  ${m.name}: ${m.statusMessage}`)
-                .join("\n"));
+            api_client_1.soosLogger.info(` SBOM Files: \n`, `  ${manifestUploadResponse.message} \n`, manifestUploadResponse.manifests?.map((m) => `  ${m.name}: ${m.statusMessage}`).join("\n"));
             api_client_1.soosLogger.logLineSeparator();
-            api_client_1.soosLogger.info("Starting SBOM Analysis scan");
-            await soosAnalysisApiClient.startScan({
+            await soosAnalysisService.startScan({
                 clientId: this.args.clientId,
                 projectHash,
-                analysisId: analysisId,
+                analysisId,
+                scanType,
+                scanUrl: result.scanUrl,
+            });
+            const scanStatus = await soosAnalysisService.waitForScanToFinish({
+                scanStatusUrl: result.scanStatusUrl,
+                scanUrl: result.scanUrl,
+                scanType,
             });
-            api_client_1.soosLogger.info(`Analysis scan started successfully, to see the results visit: ${result.scanUrl}`);
+            const exitCode = (0, utilities_1.getAnalysisExitCode)(scanStatus, this.args.integrationName, this.args.onFailure);
+            api_client_1.soosLogger.debug(`Exiting with code ${exitCode}`);
+            (0, process_1.exit)(exitCode);
         }
         catch (error) {
-            if (projectHash && branchHash && analysisId)
-                await soosAnalysisApiClient.updateScanStatus({
+            if (projectHash && branchHash && analysisId) {
+                await soosAnalysisService.updateScanStatus({
                     clientId: this.args.clientId,
                     projectHash,
                     branchHash,
-                    scanType: api_client_1.ScanType.SBOM,
-                    scanId: analysisId,
+                    scanType,
+                    analysisId: analysisId,
                     status: api_client_1.ScanStatus.Error,
-                    message: `Error while performing scan.`,
+                    message: "Error while performing scan.",
+                    scanStatusUrl,
                 });
+            }
             api_client_1.soosLogger.error(error);
             (0, process_1.exit)(1);
         }
     }
-    async getSbomAsFormData(filePath) {
-        try {
-            const fileReadStream = FileSystem.createReadStream(filePath, {
-                encoding: api_client_1.SOOS_CONSTANTS.FileUploads.Encoding,
-            });
-            const formData = new form_data_1.default();
-            formData.append("file", fileReadStream);
-            return formData;
-        }
-        catch (error) {
-            api_client_1.soosLogger.error(`Error on getSbomAsFormData: ${error}`);
-            throw error;
-        }
-    }
     async findSbomFilePath() {
         const sbomPathStat = await FileSystem.statSync(this.args.sbomPath);
         if (sbomPathStat.isDirectory()) {
             const files = await FileSystem.promises.readdir(this.args.sbomPath);
-            const sbomFile = files.find((file) => constants_1.CONSTANTS.SBOM.FILE_REGEX.test(file));
+            const sbomFile = files.find((file) => constants_1.SOOS_SBOM_CONSTANTS.FileRegex.test(file));
             if (!sbomFile) {
                 throw new Error("No SBOM file found in the directory.");
             }
             return Path.join(this.args.sbomPath, sbomFile);
         }
-        if (!constants_1.CONSTANTS.SBOM.FILE_REGEX.test(this.args.sbomPath)) {
+        if (!constants_1.SOOS_SBOM_CONSTANTS.FileRegex.test(this.args.sbomPath)) {
             throw new Error("The file does not match the required SBOM pattern.");
         }
         return this.args.sbomPath;
@@ -219,8 +133,6 @@ class SOOSSBOMAnalysis {
             api_client_1.soosLogger.setVerbose(args.verbose);
             api_client_1.soosLogger.info("Configuration read");
             api_client_1.soosLogger.verboseDebug(JSON.stringify((0, utilities_1.obfuscateProperties)(args, ["apiKey"]), null, 2));
-            (0, utilities_1.ensureNonEmptyValue)(args.clientId, "clientId");
-            (0, utilities_1.ensureNonEmptyValue)(args.apiKey, "apiKey");
             api_client_1.soosLogger.logLineSeparator();
             const soosSBOMAnalysis = new SOOSSBOMAnalysis(args);
             await soosSBOMAnalysis.runAnalysis();

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@soos-io/soos-sbom",
-  "version": "0.1.3",
-  "description": "SOOS wrapper script to upload sboms.",
+  "version": "0.1.7",
+  "description": "SOOS wrapper script to upload SBOMs.",
   "main": "bin/index.js",
   "scripts": {
     "setup:install": "npm install",
@@ -15,21 +15,29 @@
     "typecheck": "tsc --noEmit",
     "check": "npm run format && npm run typecheck && npm outdated"
   },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/soos-io/soos-sbom.git"
+  },
+  "author": "SOOS",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/soos-io/soos-sbom/issues"
+  },
+  "homepage": "https://github.com/soos-io/soos-sbom#readme",
   "dependencies": {
-    "@soos-io/api-client": "0.1.8",
+    "@soos-io/api-client": "0.2.18",
     "argparse": "^2.0.1",
+    "glob": "^10.3.10",
     "tslib": "^2.6.2"
   },
   "devDependencies": {
-    "@types/argparse": "^2.0.11",
-    "@types/glob": "^8.1.0",
-    "@types/node": "^20.6.3",
-    "prettier": "^2.8.8",
-    "typescript": "^5.2.2"
+    "@types/argparse": "^2.0.14",
+    "@types/node": "^20.10.5",
+    "prettier": "^3.1.1",
+    "typescript": "^5.3.3"
   },
   "bin": {
     "soos-sbom": "bin/index.js"
-  },
-  "author": "SOOS",
-  "license": "MIT"
+  }
 }

package/bin/utils/constants.d.ts

@@ -1,10 +0,0 @@
-export declare const CONSTANTS: {
-    SBOM: {
-        FILE_REGEX: RegExp;
-    };
-    SOOS: {
-        API_KEY_ENV_VAR: string;
-        CLIENT_ID_ENV_VAR: string;
-        DEFAULT_INTEGRATION_TYPE: string;
-    };
-};

package/bin/utils/constants.js

@@ -1,13 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CONSTANTS = void 0;
-exports.CONSTANTS = {
-    SBOM: {
-        FILE_REGEX: /\.(cdx|spdx)\.json$/,
-    },
-    SOOS: {
-        API_KEY_ENV_VAR: "SOOS_API_KEY",
-        CLIENT_ID_ENV_VAR: "SOOS_CLIENT_ID",
-        DEFAULT_INTEGRATION_TYPE: "Script",
-    },
-};