boman-cli 2.0__tar.gz → 2.1.1__tar.gz

{boman-cli-2.0 → boman-cli-2.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: boman-cli
-Version: 2.0
+Version: 2.1.1
 Summary: CLI tool of boman.ai
 Home-page: https://boman.ai
 Author: Sumeru Software Solutions Pvt. Ltd.
@@ -83,11 +83,15 @@ Example: boman-cli -a run -zap_session_script ./session.js
 
 ### Release Note:
 
+### V2.1
+    - New scan added: SBOM.
+
 ### V2.0
 
     - New scan added: Container scan.
     - New Tool added for SCA scan type.
 
+
 ### V1.9:
 
     - [Bug fix] Updated the Upload Logs success message

{boman-cli-2.0 → boman-cli-2.1.1}/README.md

@@ -68,11 +68,15 @@ Example: boman-cli -a run -zap_session_script ./session.js
 
 ### Release Note:
 
+### V2.1
+    - New scan added: SBOM.
+
 ### V2.0
 
     - New scan added: Container scan.
     - New Tool added for SCA scan type.
 
+
 ### V1.9:
 
     - [Bug fix] Updated the Upload Logs success message

{boman-cli-2.0 → boman-cli-2.1.1}/boman_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: boman-cli
-Version: 2.0
+Version: 2.1.1
 Summary: CLI tool of boman.ai
 Home-page: https://boman.ai
 Author: Sumeru Software Solutions Pvt. Ltd.
@@ -83,11 +83,15 @@ Example: boman-cli -a run -zap_session_script ./session.js
 
 ### Release Note:
 
+### V2.1
+    - New scan added: SBOM.
+
 ### V2.0
 
     - New scan added: Container scan.
     - New Tool added for SCA scan type.
 
+
 ### V1.9:
 
     - [Bug fix] Updated the Upload Logs success message

{boman-cli-2.0 → boman-cli-2.1.1}/bomancli/Config.py

@@ -25,6 +25,7 @@ class Config:
     sast_upload_status = None
     sast_message = None
     sast_errors = None
+    sast_ignore = False
 
     dast_present = None
     dast_target = None
@@ -56,6 +57,8 @@ class Config:
     sca_upload_status = None
     sca_message = None
     sca_errors = None
+    sca_ignore = False
+    sca_exclude_paths=None
 
     app_token = None
     customer_token = None
@@ -115,7 +118,7 @@ class Config:
 
     log_level = "INFO"
 
-    version = 'v2.0'
+    version = 'v2.1.1'
 
     boman_config_file = 'boman.yaml'
     
@@ -149,4 +152,14 @@ class Config:
     con_scan_upload_status=None
     con_scan_status=None
     con_scan_type=None
-    con_scan_target=None
+    con_scan_target=None
+    
+     #sbom
+    sbom_present=None
+    sbom_build_dir=None
+    sbom_message=None
+    sbom_response=None
+    sbom_errors=None
+    sbom_upload_status=None
+    sbom_scan_status=None
+    sbom_target=None

{boman-cli-2.0 → boman-cli-2.1.1}/bomancli/auth.py

@@ -46,7 +46,7 @@ def authorize():
         
         logging.info(f"Boman opted for: {Config.sca_lang} scan")
     logging.info('Authenticating with boman server')    
-    data = {'app_token': Config.app_token, 'customer_token': Config.customer_token, 'sast':Config.sast_present,"dast":Config.dast_present,"dast_type":Config.dast_type,"dast_auth_enabled":Config.dast_auth_present,"sast_langs":Config.sast_lang,"sca":Config.sca_present,"sca_langs":Config.sca_lang,"sca_scan_type":Config.sca_type,"secret_scan":Config.secret_scan_present,'container_scan': Config.con_scan_present,'container_scan_type': Config.con_scan_type}
+    data = {'app_token': Config.app_token, 'customer_token': Config.customer_token, 'sast':Config.sast_present,"dast":Config.dast_present,"dast_type":Config.dast_type,"dast_auth_enabled":Config.dast_auth_present,"sast_langs":Config.sast_lang,"sca":Config.sca_present,"sca_langs":Config.sca_lang,"sca_scan_type":Config.sca_type,"secret_scan":Config.secret_scan_present,'container_scan': Config.con_scan_present,'container_scan_type': Config.con_scan_type,"sbom":Config.sbom_present}
     headers = {'Content-type': 'application/json', 'Accept': 'text/plain'}
     try:
         res = requests.post(url, json=data, headers=headers)
@@ -69,7 +69,8 @@ def authorize():
                 Config.secret_scan_response = json_response['data']['secret_scan']
                 Config.scan_token = json_response['data']['scan_token']    
                 Config.scan_name = json_response['data']['scan_name']
-                Config.con_scan_response = json_response['data']['cs']    
+                Config.con_scan_response = json_response['data']['cs']
+                Config.sbom_response = json_response['data']['sbom']    
 
                 return 1    
             except:

{boman-cli-2.0 → boman-cli-2.1.1}/bomancli/main.py

@@ -125,6 +125,12 @@ def runImage(data=None,type=None):
 
 
     if type == 'SAST':
+        if Config.sast_ignore:
+            if Utils.copy_file('.bomanignore','.semgrepignore'):
+                logging.info("Files and Folders to be ignored is added to .semgrepignore file")
+            else:
+                logging.error(".bomanignore file was not found")
+                exit(4)
         target_file = Config.sast_target
         Utils.checkImageAlreadyExsist(docker_image)
 
@@ -220,7 +226,8 @@ def runImage(data=None,type=None):
 
 
         try:
-
+            if Config.sast_ignore:
+                os.remove('.semgrepignore')
             if will_generate_output == 1:
                 #logging.info('WILL GENERATE OUTPUT')
                 if uploadReport(output_file,tool_name,tool_id,scan_details_id,'SAST'):
@@ -446,7 +453,12 @@ def runImage(data=None,type=None):
                     container_output = docker.containers.run(docker_image, command_line, volumes={Config.sca_build_dir: {
                             'bind': data['bind']}}, user=uid)
                     logging.info('[SUCCESS]: %s Scan Completed',tool_name)
-            else:   
+            else:
+                if Config.sca_ignore:
+                    Config.sca_exclude_files = Utils.read_bomanignore('.bomanignore')
+                    if Config.sca_exclude_files:
+                        command_line = f'{command_line} {Config.sca_exclude_files}'
+                        logging.info('Comment for SCA with ignore %s',command_line)
                 Config.build_dir = Config.sca_build_dir
                 container_output = docker.containers.run(docker_image, command_line, volumes={Config.sca_build_dir: {
                         'bind': data['bind']}}, user=uid)
@@ -535,7 +547,48 @@ def runImage(data=None,type=None):
             msg = 'Error recorded while uploading the report'
             Utils.logError(msg,str(e))    
         
+    if type == 'sbom':
+        Utils.checkImageAlreadyExsist(docker_image)
+        logging.info('Running %s',tool_name)
+        
+        try:
+            Config.build_dir = Config.sbom_build_dir
+            command_line = "% s" % command_line.format(target = 'src/')
+            container_output = docker.containers.run(docker_image, command_line, volumes={Config.sbom_build_dir: {
+                        'bind': data['bind']}}, user=uid)
+            logging.info('[SUCCESS]: %s Scan Completed',tool_name)
+            Config.sbom_message ='SBOM scan completed'
+            Config.sbom_scan_status ='Completed'
+        except errors.ContainerError as exc:
+           logging.error('Some Error recorded while scanning %s',tool_name)
+           logging.error('%s',str(exc))
+           msg='\n The following error has been recorded while scanning sca'
+           Config.sbom_scan_status ='Completed'
+           Config.sbom_errors ='Some Error recorded while scanning [',str(exc),']'
+           Utils.logError(msg,str(exc))
+           
+        try:
+            if will_generate_output == 1:
+                logging.info('Uploading %s to the server',output_file)
+                if uploadReport(output_file,tool_name,tool_id,scan_details_id,'sbom'):
+                    Config.sbom_scan_status ='Completed'
+                    Config.sbom_upload_status = 'Completed'
+                    Config.sbom_message ='Scan Completed'
+                else:
+                    Config.sbom_scan_status ='Failed'
+                    Config.sbom_upload_status = 'Failed'
+                    Config.sbom_message ='Error occured while uploading the report, Please check the cli logs'
+            else:
+                logging.error('Cant upload files to the server',tool_name)
+                Config.sbom_message ='Cant upload files to the server for SBOM,Please check your directory for the files.'
 
+        except EnvironmentError as e:
+            logging.error('Error recorded while uploading the report %s',tool_name)
+            logging.error('%s',str(e))
+            Config.sbom_message ='Error recorded while uploading the report of SBOM, Please check your directory for the files.'           ## need to change logic here -- MM
+            msg = 'Error recorded while uploading the report'
+            Utils.logError(msg,str(e))    
+        
 
 #### function to upload the test report to the server with other data -- MM ------------------------------------
 def uploadReport(filename,toolname,tool_id,scan_details_id,type):
@@ -563,6 +616,9 @@ def uploadReport(filename,toolname,tool_id,scan_details_id,type):
             elif type =="container_scan":
                 message = Config.con_scan_message
                 errors = Config.con_scan_errors
+            elif type =="sbom":
+                message = Config.sbom_message
+                errors = Config.sbom_errors
         except:
             message = 'NA'
             errors = 'NA'
@@ -743,7 +799,7 @@ def main():
 
     init()
     Validation.yamlValidation()
-    if Config.secret_scan_present == True or Config.sast_present is True or Config.dast_present is True or Config.sca_present is True or Config.con_scan_present is True:
+    if Config.secret_scan_present == True or Config.sast_present is True or Config.dast_present is True or Config.sca_present is True or Config.con_scan_present is True or Config.sbom_present:
         Utils.testServer()
     else:
         content = Auth.authorize()
@@ -882,6 +938,20 @@ def main():
                 runImage(data=data,type='container_scan')
     else:
         logging.info('Ignoring Container Scan')
+        
+    if Config.sbom_present is True:
+        logging.info("Preparing SBOM requirements")
+        
+        for data in Config.sbom_response:
+
+            if data['scan_status'] == 0 :   
+                logging.info('No SBOM Configuration found from SaaS')    
+                logging.info('Ignoring SBOM')
+            else:
+                runImage(data=data,type='sbom')
+    else:
+        logging.info('Ignoring SBOM')
+    
     exitFunction()
     return 1
 

{boman-cli-2.0 → boman-cli-2.1.1}/bomancli/utils.py

@@ -328,6 +328,16 @@ def showSummary():
         logging.info('SCAN MESSAGE : %s', Config.con_scan_message)   
     logging.info('-------------------------------------')
     
+    logging.info('-------- SBOM SCAN STATUS --------- ')
+    if Config.sbom_present:
+        logging.info('SCAN STATUS: %s',Config.sbom_scan_status)
+        logging.info('UPLOAD STATUS: %s',Config.sbom_upload_status)
+        logging.info('SCAN MESSAGE : %s', Config.sbom_message)
+        
+        logging.info('ERRORS: %s',Config.sbom_errors)
+    else:
+        logging.info('SCAN MESSAGE : %s', Config.sbom_message)   
+    logging.info('-------------------------------------')
 
 
 
@@ -879,4 +889,31 @@ def uploadLogs():
 
 def remove_leading_slash(s):
     # Check if the first character is a slash and remove it
-    return s[1:] if s.startswith('/') else s
+    return s[1:] if s.startswith('/') else s
+
+def read_bomanignore(file_path):
+    exclude_paths = []
+    try:
+        with open(file_path, 'r') as file:
+            for line in file:
+                # Skip comments and empty lines
+                line = line.strip()
+                if line and not line.startswith('#'):
+                    full_command = " --exclude "+line
+                    exclude_paths.append(full_command)
+    except FileNotFoundError:
+        logging.info(f"Error: {file_path} not found.")
+        return False
+    # Join the list into a space separated string
+    return ''.join(exclude_paths)
+
+def copy_file(source_path, dest_path):
+    try:
+        with open(source_path, 'r') as source_file:
+            source_content = source_file.read()
+        with open(dest_path, 'w') as dest_file:
+            dest_file.write(source_content)
+        return True  # Successfully copied
+    except FileNotFoundError:
+        logging.info(f"Error: {source_path} not found.")
+        return False  # Source file not found

{boman-cli-2.0 → boman-cli-2.1.1}/bomancli/validation.py

@@ -61,6 +61,13 @@ def yamlValidation():
             except KeyError: 
                 logging.info('work dir not specified in config, choosing the default sast working directory')
                 Config.sast_build_dir = os.getcwd()+'/'
+                
+            try:
+                logging.info('Ignoring file and folder check')
+                Config.sast_ignore =  Config.config_data['SAST']['ignore_files']
+            except KeyError: 
+                logging.info('ignore_files config was not found')
+                
 
             #logging.info('snyk is choosen, and the env var declared was %s', str('s'))
 
@@ -170,6 +177,11 @@ def yamlValidation():
             #     ##after sbom and lockfile type check
             #     Config.sca_build_dir = os.getcwd()+'/'
                 
+            try:
+                logging.info('Ignoring file and folder check')
+                Config.sca_ignore =  Config.config_data['SCA']['ignore_files']
+            except KeyError: 
+                logging.info('ignore_files config was not found')    
                 
             try:
                 logging.info('Configuring target for SCA')
@@ -263,10 +275,27 @@ def yamlValidation():
         logging.warning('Container Scan is not properly configured. Cant read the "container_scan" configuration.')   
         Config.con_scan_message ='Container Scan is not properly configured'
 
-
+    try:
+        if "SBOM" in Config.config_data:
+            if Config.config_data['SBOM']:
+                Config.sbom_present = True
+                Config.sbom_build_dir = os.getcwd()+"/"
+                logging.info('SBOM is properly configured and ready to scan')
+            else:
+                Config.sbom_present = False
+                logging.warning('SBOM is not properly configured. Cant read the "sbom" configuration.')   
+                Config.sbom_message ='sbom is not properly configured'
+           
+        else:
+            Config.sbom_present = False
+            logging.warning('SBOM is not properly configured. Cant read the "sbom" configuration.')   
+            Config.sbom_message ='sbom is not properly configured'
+    except:
+        Config.sbom_present = False  
+        logging.warning('SBOM is not properly configured. Cant read the "sbom" configuration.')   
+        Config.sbom_message ='sbom is not properly configured'
         
-
-    
+   
 
 ## need to use lingudetect here, but the results are not trustable and misleading ------ MM -------------------
 def findLang():

{boman-cli-2.0 → boman-cli-2.1.1}/setup.cfg

@@ -1,6 +1,6 @@
 [metadata]
 environment = prod
-version = 2.0
+version = 2.1.1
 name = boman-cli
 saas_base_url = 
 https = //dashboard.boman.ai/