boman-cli 2.5.15__tar.gz → 2.6.2__tar.gz

{boman_cli-2.5.15 → boman_cli-2.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.1
 Name: boman-cli
-Version: 2.5.15
+Version: 2.6.2
 Summary: CLI tool of boman.ai
 Home-page: https://boman.ai
 Author: Sumeru Software Solutions Pvt. Ltd.
@@ -19,15 +19,6 @@ Requires-Dist: xmltodict<=0.13.0
 Requires-Dist: pyfiglet<=1.0.2
 Requires-Dist: aiohttp>=3.8.0
 Requires-Dist: packageurl-python>=0.11.0
-Dynamic: author
-Dynamic: author-email
-Dynamic: classifier
-Dynamic: description
-Dynamic: description-content-type
-Dynamic: home-page
-Dynamic: license
-Dynamic: requires-dist
-Dynamic: summary
 
 # Introduction 
 Boman CLI is a Orchestration script written in python to run security scans on the local or CI/CD environment and upload the results to Boman.ai SaaS server.
@@ -110,10 +101,22 @@ Example: boman-cli -a run -zap_session_script ./session.js
 
 
 
-### Release Note:
+# Release Notes:
+
+### 2.6.1
+- **Updated tools** - updated SAST, SCA and Secret scan tools
+
+### 2.5.12
+- **Added Cache Dir for Container Scan** - Added Custom cache dir location for Container Scan to eliminate permission issue
+
+### 2.5.11
+- **Added Cache Dir for SBOM** - Added Custom cache dir location for SBOM to eliminate permission issue
+
+### 2.5.10
+- **Reachability (Depricated)** - Reachability is completely depricated to optimize consumption of CICD minutes
 
 ### 2.5.9
-- **SBOM API BUg** - New Feature. Additional sbom columns were added
+- **SBOM API BUG** - New Feature. Additional sbom columns were added
 
 ###  2.5.8
 

{boman_cli-2.5.15 → boman_cli-2.6.2}/README.md

@@ -79,10 +79,22 @@ Example: boman-cli -a run -zap_session_script ./session.js
 
 
 
-### Release Note:
+# Release Notes:
+
+### 2.6.1
+- **Updated tools** - updated SAST, SCA and Secret scan tools
+
+### 2.5.12
+- **Added Cache Dir for Container Scan** - Added Custom cache dir location for Container Scan to eliminate permission issue
+
+### 2.5.11
+- **Added Cache Dir for SBOM** - Added Custom cache dir location for SBOM to eliminate permission issue
+
+### 2.5.10
+- **Reachability (Depricated)** - Reachability is completely depricated to optimize consumption of CICD minutes
 
 ### 2.5.9
-- **SBOM API BUg** - New Feature. Additional sbom columns were added
+- **SBOM API BUG** - New Feature. Additional sbom columns were added
 
 ###  2.5.8
 

{boman_cli-2.5.15 → boman_cli-2.6.2}/boman_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.1
 Name: boman-cli
-Version: 2.5.15
+Version: 2.6.2
 Summary: CLI tool of boman.ai
 Home-page: https://boman.ai
 Author: Sumeru Software Solutions Pvt. Ltd.
@@ -19,15 +19,6 @@ Requires-Dist: xmltodict<=0.13.0
 Requires-Dist: pyfiglet<=1.0.2
 Requires-Dist: aiohttp>=3.8.0
 Requires-Dist: packageurl-python>=0.11.0
-Dynamic: author
-Dynamic: author-email
-Dynamic: classifier
-Dynamic: description
-Dynamic: description-content-type
-Dynamic: home-page
-Dynamic: license
-Dynamic: requires-dist
-Dynamic: summary
 
 # Introduction 
 Boman CLI is a Orchestration script written in python to run security scans on the local or CI/CD environment and upload the results to Boman.ai SaaS server.
@@ -110,10 +101,22 @@ Example: boman-cli -a run -zap_session_script ./session.js
 
 
 
-### Release Note:
+# Release Notes:
+
+### 2.6.1
+- **Updated tools** - updated SAST, SCA and Secret scan tools
+
+### 2.5.12
+- **Added Cache Dir for Container Scan** - Added Custom cache dir location for Container Scan to eliminate permission issue
+
+### 2.5.11
+- **Added Cache Dir for SBOM** - Added Custom cache dir location for SBOM to eliminate permission issue
+
+### 2.5.10
+- **Reachability (Depricated)** - Reachability is completely depricated to optimize consumption of CICD minutes
 
 ### 2.5.9
-- **SBOM API BUg** - New Feature. Additional sbom columns were added
+- **SBOM API BUG** - New Feature. Additional sbom columns were added
 
 ###  2.5.8
 

{boman_cli-2.5.15 → boman_cli-2.6.2}/boman_cli.egg-info/SOURCES.txt

@@ -17,4 +17,5 @@ bomancli/main.py
 bomancli/sbom_enricher.py
 bomancli/utils.py
 bomancli/validation.py
+bomancli/malware_rules/boman/js/boman-malware-detection.yml
 bomancli/templates/template_plan.yaml

{boman_cli-2.5.15 → boman_cli-2.6.2}/bomancli/Config.py

@@ -121,31 +121,39 @@ class Config:
 
     log_level = "INFO"
 
-    version = 'v2.5.15'
+    version = 'v2.6.2'
 
     boman_config_file = 'boman.yaml'
     
     osv_supported_files = [
+    "conan.lock",
+    "pubspec.lock",
+    "mix.lock",
+    "go.mod",
+    "cabal.project.freeze",
+    "stack.yaml.lock",
     "buildscript-gradle.lockfile",
     "gradle.lockfile",
+    "gradle/verification-metadata.xml",
     "pom.xml",
-    "go.mod",
-    "mix.lock",
-    "pubspec.lock",
-    "conan.lock",
+    "bun.lock",
     "package-lock.json",
     "pnpm-lock.yaml",
     "yarn.lock",
+    "deps.json",
+    "packages.config",
     "composer.lock",
     "Pipfile.lock",
     "poetry.lock",
     "requirements.txt",
     "pdm.lock",
-    "Cargo.lock",
+    "pylock.toml",
+    "uv.lock",
+    "renv.lock",
     "Gemfile.lock",
-    "renv.lock"
+    "gems.locked",
+    "Cargo.lock"
 ]
-
     #Container scan
     con_scan_present=None
     con_scan_build_dir=None
@@ -208,7 +216,7 @@ class Config:
         "c++"
     ]
     
-    reachability_present=None
+    reachability_present=False
     reachability_build_dir=None
     reachability_message=None
     reachability_response=None
@@ -219,7 +227,7 @@ class Config:
     
     fail_build = False
     sla_fail_build = False
-    polling_time = 60
+    polling_time = 100
     polling_frequency = 10
     
     ml_success = False

{boman_cli-2.5.15 → boman_cli-2.6.2}/bomancli/auth.py

@@ -60,19 +60,21 @@ def new_authorize():
         Config.sca_target = sca_configuration['target']
         Config.sca_ignore = True if sca_configuration['ignore_files'].lower() == "true" else False
         Config.sca_ignore_folders_and_files = sca_configuration['sca_ignore_file_data']
+        # logging.info(f"SCA Target for SCA scan is {Config.sca_target}")
         if Config.sca_type == "directory":
             file_present = False     
             for filename in Config.osv_supported_files:
-                if Config.sca_target is None:
+                if Config.sca_target is None or Config.sca_target == "":
                     if recursive_file_present_check(Config.sca_build_dir,filename):
                         file_present =True
                         Config.sca_target= ""
                         logging.info(f"New Authorization: Boman has found the dependency file: {filename} in the path: {os.path.join(Config.sca_build_dir,Config.sca_target)}")
                         break                
                 else:    
-                    if recursive_file_present_check(os.path.join(Config.sca_build_dir,Config.sca_target),filename):
+                    target = recursive_file_present_check(os.path.join(Config.sca_build_dir,Config.sca_target),filename)
+                    if target:    
                         file_present =True
-                        Config.sca_target= os.path.join(Config.sca_target,filename)
+                        Config.sca_target= target
                         logging.info(f"New Authorization: Boman has found the dependency file: {filename} in the path: {os.path.join(Config.sca_build_dir,Config.sca_target)}")
                         break
             if file_present:
@@ -90,6 +92,7 @@ def new_authorize():
             exit(4)
         
         logging.info(f"Boman opted for: {Config.sca_lang} scan.")
+        # logging.info(f"SCA Target for SCA scan is {Config.sca_target}")
         
                 
                
@@ -103,16 +106,17 @@ def authorize():
         if Config.sca_type == "directory":
             file_present = False     
             for filename in Config.osv_supported_files:
-                if Config.sca_target is None:
+                if Config.sca_target is None or Config.sca_target == "":
                     if recursive_file_present_check(Config.sca_build_dir,filename):
                         file_present =True
                         Config.sca_target= ""
                         logging.info(f"Authorization: Boman has found the dependency file: {filename} in the path: {os.path.join(Config.sca_build_dir,Config.sca_target)}")
                         break                
-                else:    
-                    if recursive_file_present_check(os.path.join(Config.sca_build_dir,Config.sca_target),filename):
+                else:
+                    target = recursive_file_present_check(os.path.join(Config.sca_build_dir,Config.sca_target),filename)
+                    if target:
                         file_present =True
-                        Config.sca_target= os.path.join(Config.sca_target,filename)
+                        Config.sca_target= target
                         logging.info(f"Authorization: Boman has found the dependency file: {filename} in the path: {os.path.join(Config.sca_build_dir,Config.sca_target)}")
                         break
             if file_present:
@@ -184,6 +188,8 @@ def authorize():
                     Config.reachability_present = False
                     logging.warning("Reachability: Not Configured!!!! Message: Tool configuration data was not found on JSON Response")   
 
+                # As to keep reachability logic. Due to reachbility not yielding any result and time consuming in runtime making it false without removeing the logic. 
+                Config.reachability_present = False
                 return 1    
             except:
                 logging.info("Authorization: Failed!!!  exit code: 1 (Server ERROR) Message: Problem occured while authorizing the scan, Please contact boman.ai team")

{boman_cli-2.5.15 → boman_cli-2.6.2}/bomancli/dev_attribution.py

@@ -4,6 +4,7 @@ import argparse
 import os
 import datetime
 import re
+import sys
 from docker import errors
 from bomancli.base_logger import logging
 from bomancli.Config import Config
@@ -26,7 +27,7 @@ def ensure_full_git_history():
             logging.info("[INFO] Repository already has full history.")
 
     except Exception as e:
-        logging.error(f"[WARN] Could not determine git history depth: {e}", file=sys.stderr)
+        logging.error(f"[WARN] Could not determine git history depth: {e}")
 
 
 

{boman_cli-2.5.15 → boman_cli-2.6.2}/bomancli/main.py

@@ -12,6 +12,7 @@ from pathlib import Path
 import sys
 import pyfiglet
 import atexit
+import shutil
 
 ##importing required files
 
@@ -179,7 +180,9 @@ def runImage(data=None,type=None):
             try:
                 
                 # logging.info('Semgrep token present')
-
+                logging.info("copying custom opengrep rules to the build directory")
+                Utils.copy_rules_to_base_docker('malware_rules', Config.sast_build_dir)
+                command_line  = f"{command_line} --config auto --config /src/malware_rules --exclude='/src/malware_rules/**' --exclude='/src/boman_opengrep.json'"
                 if Config.jenkins == 'yes':
 
                     logging.info('SAST Docker: Preparing %s scan for jenkins env with %s user ', tool_name , userid)    
@@ -196,13 +199,16 @@ def runImage(data=None,type=None):
                     container_output = docker.containers.run(docker_image, command_line, volumes={Config.sast_build_dir: {
                                 'bind': data['bind']}},user=userid,detach=detach,environment=env_var,remove=True)          
                     logging.info('SAST Docker: SUCCESS !!!. Message: %s Scan Completed',tool_name)
-
+                logging.info('SAST Docker: Deleting custom opengrep rules from the build directory')
+                shutil.rmtree('malware_rules')
             except errors.ContainerError as exc:
                 msg='\n The following error has been recorded while scanning SAST'
                 Utils.logError(msg,str(exc))
                 logging.error(f'SAST Docker: Failed !!!, Message: Some Error recorded while scanning {str(exc)}')
                 Config.sast_scan_status = 'Failed'
                 Config.sast_errors = f'Exit Status {exc.exit_status}:{str(exc)}]'
+                logging.info('SAST Docker: Deleting custom opengrep rules from the build directory')
+                shutil.rmtree('malware_rules')
 
 
 
@@ -436,8 +442,10 @@ def runImage(data=None,type=None):
             Config.dast_message ='Error recorded while uploading the report of',tool_name
 
     if type == 'SCA':
+        sbom_file = "unknown"
         Utils.checkImageAlreadyExsist(docker_image)
         logging.info('Running %s',tool_name)
+        logging.info("SCA Docker: Target for SCA scan is %s",Config.sca_target)
         try:
             if Config.sca_lang=="osv":
                 if Config.sca_type == "directory":
@@ -451,9 +459,24 @@ def runImage(data=None,type=None):
                     target = Utils.remove_leading_slash(Config.sca_target)
                     Config.build_dir = Config.sca_build_dir
                     command_line = "% s" % command_line.format(target ='/src/'+target)
-                    container_output = docker.containers.run(docker_image, command_line, volumes={Config.sca_build_dir: {
+                    if Config.sca_type == "sbom":
+                        sbom_file = Utils.normalize_sbom_filename(f"{Config.sca_build_dir}/{target}")
+                        logging.info('SCA Docker: SBOM file detected %s',sbom_file)
+                        if sbom_file != "unknown":
+                            command_line = "% s" % command_line.format(target ='/src/'+sbom_file)
+                            logging.info('SCA Docker:  Command ==> %s',command_line)
+                            container_output = docker.containers.run(docker_image, command_line, volumes={Config.sca_build_dir: {
                             'bind': data['bind']}}, user=uid, remove=True)
+                        else:
+                            raise errors.ContainerError("",-1,"","","Given SBOM file is not in SPDX or CycloneDX format",)                           
+                    else:
+                        container_output = docker.containers.run(docker_image, command_line, volumes={Config.sca_build_dir: {
+                                'bind': data['bind']}}, user=uid, remove=True)
                     logging.info('SCA Docker: SUCCESS!!! Message: %s Scan Completed',tool_name)
+                    if sbom_file != "unknown":
+                        logging.info('sbom file detected %s',sbom_file)
+                        logging.info('SCA Docker: Deleting SBOM file %s',sbom_file)
+                        Utils.delete_file_on_error(Config.sca_build_dir + '/' + sbom_file)
             else:
                 if Config.sca_ignore:
                     Config.sca_exclude_files = Utils.read_bomanignore('.bomanignore')
@@ -472,12 +495,22 @@ def runImage(data=None,type=None):
                 if exc.exit_status==1:
                     Config.sca_message ='SCA scan completed'
                     Config.sca_scan_status ='Completed'
+                    if sbom_file != "unknown":
+                        logging.info('sbom file detected %s',sbom_file)
+                        logging.info('SCA Docker: Deleting SBOM file %s',sbom_file)
+                        Utils.delete_file_on_error(Config.sca_build_dir + '/' + sbom_file)
                     logging.info('SCA Docker: SUCCESS!!! Message: %s Scan Completed',tool_name)
-                    logging.info(f'OSV: {exc.stderr}')
+                    logging.error(f'OSV: {exc.stderr}')
+                else:
+                    logging.error('SCA Docker: Failed!!! Message: Some Error recorded while scanning %s',str(exc))
+                    msg='\n The following error has been recorded while scanning sca'
+                    Config.sca_scan_status ='Failed'
+                    Config.sca_errors =f'{str(exc)}]'
+                    Utils.logError(msg,str(exc))
             else:
                 logging.error('SCA Docker: Failed!!! Message: Some Error recorded while scanning %s',str(exc))
                 msg='\n The following error has been recorded while scanning sca'
-                Config.sca_scan_status ='Completed'
+                Config.sca_scan_status ='Failed'
                 Config.sca_errors =f'{str(exc)}]'
                 Utils.logError(msg,str(exc))
 
@@ -836,23 +869,23 @@ def uploadReport(filename,toolname,tool_id,scan_details_id,type):
             r = requests.post(url,json=values)
             return 0 
         
-        try:
-            logging.info('Removing the result file')
-            if type != "sbom" and type != "reachability":
-                logging.info("remvoing file here")
-                os.remove(path)
-            elif Config.reachability_present is not True and type == 'sbom':
-                #print('dmdmd')
-                os.remove(path)    
-            elif type == "reachability":
-                os.remove(path)
-                os.remove(Path(str(Config.sbom_build_dir))/Config.sbom_response[0]['output_file'])
-                os.remove(path_reachability)
-                os.remove(path_bom)
+        # try:
+        #     logging.info('Removing the result file')
+        #     if type != "sbom" and type != "reachability":
+        #         logging.info("removing file %s",path)
+        #         os.remove(path)
+        #     elif Config.reachability_present is not True and type == 'sbom':
+        #         logging.info("removing file %s",path)
+        #         os.remove(path)    
+        #     elif type == "reachability":
+        #         os.remove(path)
+        #         os.remove(Path(str(Config.sbom_build_dir))/Config.sbom_response[0]['output_file'])
+        #         os.remove(path_reachability)
+        #         os.remove(path_bom)
+        #         logging.info("removing file %s, %s, %s, %s", path, path_reachability, path_bom, Path(str(Config.sbom_build_dir))/Config.sbom_response[0]['output_file'])
                 
-                
-        except Exception as e:
-            logging.error(f"unable to remove the file: {path} ---> Error: {e}")
+        # except Exception as e:
+        #     logging.error(f"unable to remove the file: {path} ---> Error: {e}")
 
         tool_output = json.dumps(data, ensure_ascii=False, indent=4)
     
@@ -907,16 +940,19 @@ def initSecertScan(path,data):
 
     try:
         logging.info('Running Secret Scanning on the repository')
+        # logging.info('Command for trufflehog is : %s',command_line_truffle)
         container = Config.docker_client.containers.run(image_name, command_line_truffle, detach=True,volumes={build_dir: {
-                    'bind': bind_dir}})
+                    'bind': bind_dir}}, remove=True)
         op = []
         for iteration_main,line in enumerate(container.logs(stream=True)):
             try:
+                # print(line.strip())
                 op.append(json.loads(line.strip()))
-                #print(op[iteration_main]['stringsFound'])
-                for iteration,key in enumerate(op[iteration_main]['stringsFound']):
-                   #print(key)
-                    op[iteration_main]['stringsFound'][iteration] = Utils.masker(key)
+                formatted_op = Utils.parse_new_output(op)
+                # # print(op[iteration_main]['stringsFound'])
+                # for iteration,key in enumerate(op[iteration_main]['stringsFound']):
+                #    #print(key)
+                #     op[iteration_main]['stringsFound'][iteration] = Utils.masker(key)
 
             except:
                 logging.error('Some Findings from the trufflehog is unrecognisble.Skiping them.')
@@ -940,7 +976,7 @@ def initSecertScan(path,data):
         Config.build_dir = Config.sast_build_dir
         path = Config.sast_build_dir+file_name
         with open(path, 'w', encoding='utf-8') as f:
-            json.dump(op, f, ensure_ascii=False, indent=4)
+            json.dump(formatted_op, f, ensure_ascii=False, indent=4)
 
         if uploadReport(file_name,tool_name,tool_id,scan_details_id,'SS'):
             logging.info('[COMPLETED]: Secret Scan report Uploaded')
@@ -1261,7 +1297,7 @@ def default():
     # parser.add_argument('-uid','--user_id',default='1000:1000',help="[internal] Pass the custom userid:groupid incase the lingu detec function is failed")
     parser.add_argument('-zap_arg','--zap_custom_arg',default=None,help="Pass the custom arguments for zap scanner")
     parser.add_argument('-semgrep_token','--semgrepToken',default='No',help="Pass the semgrep community token here")
-    parser.add_argument('-pot','--pollTime',default=60,help="Polling Time. Min : 30s, Max: 5min, Default : 1min. Format: input the time in seconds eg: 1min => 60 ")
+    parser.add_argument('-pot','--pollTime',default=100,help="Polling Time. Min : 30s, Max: 5min, Default : 1min. Format: input the time in seconds eg: 1min => 60 ")
     parser.add_argument('-pof','--pollFrequency',default=10,help="Polling Frequency. Min : 5s, Max: 1min, Default : 10s. Format: input the time in seconds eg: 1min => 60 ")
     parser.add_argument('-std','--setCacheDir',default=False,help="Set the cache directory for the scan. Set true if you use jenkins cicd")
     args = parser.parse_args()

boman_cli-2.6.2/bomancli/malware_rules/boman/js/boman-malware-detection.yml

@@ -0,0 +1,35 @@
+rules:
+  - id: global-require-capability-capture-obfuscation-potential-malware
+    languages: [regex]
+    severity: HIGH
+    metadata:
+      category: security
+      technique: capability-smuggling
+      confidence: HIGH
+      impact: HIGH
+    message: >
+      Obfuscated malicious code was identified within the source code repository. 
+      The code appears to have been introduced through a third-party dependency or 
+      inadvertently committed by a developer. Its presence poses a supply chain security risk 
+      and may enable unauthorized actions, data exfiltration, or compromise the integrity of 
+      the application and development environment.
+    pattern-regex: '(global(This)?)\s*(\[(?:[^\[\]]|\[[^\[\]]*\]){1,80}\]|\.[A-Za-z0-9_$]+)\s*=\s*require\b'
+
+  - id: json-file-contains-obfuscated-js-code-potential-malware
+    languages: [regex]
+    severity: HIGH
+    paths:
+      include:
+        - "*.json"
+    metadata:
+      category: security
+      technique: format-integrity
+      confidence: MEDIUM
+      impact: HIGH
+    message: >
+      Obfuscated malicious code was identified within the source code repository. 
+      The code appears to have been introduced through a third-party dependency or 
+      inadvertently committed by a developer. Its presence poses a supply chain security risk 
+      and may enable unauthorized actions, data exfiltration, or compromise the integrity of 
+      the application and development environment.
+    pattern-regex: '(?s)\A(?=.*(?:\brequire\s*\(|\bfunction\s*\(|\beval\s*\(|=>|\b(?:var|let|const)\s+\w+\s*=|;\s*$))'

{boman_cli-2.5.15 → boman_cli-2.6.2}/bomancli/utils.py

@@ -4,7 +4,7 @@
 # import loc_finder as loc
 #from datetime import datetime
 
-
+from __future__ import annotations
 from bomancli.base_logger import logging
 from bomancli.Config import Config
 from bomancli import loc_finder as loc
@@ -21,7 +21,8 @@ import yaml
 import time
 from json import JSONDecodeError
 from pathlib import Path
-
+import sys
+import shutil
 
 
 logging.basicConfig(format='%(asctime)s — %(name)s — %(levelname)s — %(funcName)s:%(lineno)d — %(message)s') 
@@ -45,6 +46,8 @@ def checkImageAlreadyExsist(imagename):
        #print(image.tags)
         if imagename in image.tags:
             logging.info('Image is already in the local machine')
+            logging.info('Checking if the image is up to date')
+            ensure_latest(imagename)
             return True
     
     logging.info('Image is not present in the local machine')
@@ -60,7 +63,27 @@ def checkImageAlreadyExsist(imagename):
         exit(3) ## docker/system error
 
             
+### ensure docker image is up to date
+def ensure_latest(image_name):
 
+    # Get local image digest
+    try:
+        local = docker.images.get(image_name)
+        local_digest = local.attrs['RepoDigests'][0].split('@')[1] if local.attrs['RepoDigests'] else None
+    except docker.errors.ImageNotFound:
+        local_digest = None
+
+    # Get remote digest from registry
+    reg_data = docker.images.get_registry_data(image_name)
+    remote_digest = reg_data.attrs['Descriptor']['digest']
+
+    if local_digest != remote_digest:
+        logging.info(f"Pulling newer image: {image_name}")
+        docker.images.pull(image_name)
+        return False
+    else:
+        logging.info(f"Already up to date: {image_name}")
+        return True
 
 ### fucntion to check the git is present or not
 def isGitDirectory(path):
@@ -363,6 +386,19 @@ def showSummary():
     # logging.info(Config.sca_message)
     # logging.info(Config.secret_scan_message)
 
+# opengrep rules file to base docker
+def copy_rules_to_base_docker(opengrep_rules_path, base_docker_path):
+    logging.info('Copying the opengrep rules to base docker image')
+    try:
+        rules_path = pkg_resources.resource_filename(__name__,opengrep_rules_path)
+        # os.makedirs(os.path.join(base_docker_path, opengrep_rules_path), exist_ok=True)
+        # logging.info(rules_path, os.path.join(base_docker_path, opengrep_rules_path))
+        shutil.copytree(rules_path, os.path.join(base_docker_path, opengrep_rules_path))
+        logging.info('Copied the opengrep rules to base docker image successfully')
+    except Exception as e:
+        logging.error('Error while copying the opengrep rules to base docker image: %s', e)
+        exit(3)  # docker/system error
+
 ## zap config part
 
 ##zap plan creation fucntion
@@ -972,6 +1008,7 @@ def load_cloc_json_safe(path="cloc.json"):
             return empty_data
 
         Config.cloc_total_data = data['SUM']['code']
+        os.remove(path)  # Remove the file after reading
         return data
 
     except (JSONDecodeError, OSError, ValueError):
@@ -1341,4 +1378,165 @@ def runReachability(data,userid):
 
 
 
-    return 1    
+    return 1    
+
+
+def _extract_git(new_finding: dict) -> dict:
+    """Safely drill into SourceMetadata.Data.Git."""
+    return (
+        new_finding
+        .get("SourceMetadata", {})
+        .get("Data", {})
+        .get("Git", {})
+    )
+ 
+ 
+def map_new_to_old(new_finding: dict) -> dict:
+    """
+    Convert a single new TruffleHog v3 finding dict to the old format dict.
+ 
+    Mapping table:
+      commitHash   <- SourceMetadata.Data.Git.commit
+      date         <- SourceMetadata.Data.Git.timestamp
+      path         <- SourceMetadata.Data.Git.file
+      reason       <- DetectorDescription
+      stringsFound <- [Raw]
+      branch       <- ""   (no equivalent in v3)
+      commit       <- ""   (commit message not present in v3)
+      diff         <- ""   (not present in v3)
+      printDiff    <- ""   (not present in v3)
+    """
+    git = _extract_git(new_finding)
+ 
+    return {
+        "branch": "",
+        "commit": "",
+        "commitHash": git.get("commit", ""),
+        "date": git.get("timestamp", ""),
+        "diff": "",
+        "path": f'{git.get("file", "")}:{git.get("line", "")}',
+        "printDiff": "",
+        "reason": new_finding.get("DetectorDescription", "") if len(new_finding.get("DetectorDescription", "")) else new_finding.get("DetectorDescription", ""),
+        "stringsFound": masker(new_finding["Raw"] if new_finding.get("Raw") else ""),
+    }
+ 
+ 
+def is_log_entry(entry: dict) -> bool:
+    """Log entries (info/warn/error) have a 'level' key; findings do not."""
+    return "level" in entry
+ 
+ 
+def parse_new_output(new_output: list[dict]) -> list[dict]:
+    """
+    Parse a full new TruffleHog v3 output list (mix of log entries + findings)
+    and return a list of dicts in the old format.
+    """
+    return [
+        map_new_to_old(entry)
+        for entry in new_output
+        if not is_log_entry(entry) and "SourceMetadata" in entry
+    ]
+ 
+ 
+ # detect sbom format
+def detect_by_filename(filepath: str) -> str | None:
+    """Quick check based on OSV-Scanner's recognized filename patterns."""
+    name = Path(filepath).name.lower()
+
+    spdx_patterns = (".spdx.json", ".spdx", ".spdx.yml", ".spdx.rdf", ".spdx.rdf.xml")
+    cyclonedx_patterns = ("bom.json", ".cdx.json", "bom.xml", ".cdx.xml")
+
+    if any(name.endswith(p) for p in spdx_patterns):
+        return "SPDX"
+    if name == "bom.json" or name == "bom.xml" or any(name.endswith(p) for p in cyclonedx_patterns):
+        return "CycloneDX"
+    return None
+
+
+def detect_by_content(filepath: str) -> str | None:
+    """Fallback: inspect file content for identifying fields."""
+    path = Path(filepath)
+
+    try:
+        text = path.read_text(encoding="utf-8", errors="ignore")
+    except Exception as e:
+        logging.error(f"Error reading file: {e}", file=sys.stderr)
+        return None
+
+    # JSON-based check
+    if path.suffix.lower() == ".json" or text.strip().startswith("{"):
+        try:
+            data = json.loads(text)
+            if data.get("bomFormat") == "CycloneDX":
+                return "CycloneDX"
+            if "spdxVersion" in data:
+                return "SPDX"
+        except json.JSONDecodeError:
+            pass
+
+    # XML-based check
+    if "<bom" in text and "cyclonedx" in text.lower():
+        return "CycloneDX"
+    if "SPDXVersion" in text or "spdx.org" in text.lower():
+        return "SPDX"
+
+    # Tag-value SPDX format (plain .spdx files, not JSON/XML)
+    if "SPDXVersion:" in text:
+        return "SPDX"
+
+    return None
+
+
+def detect_sbom_format(filepath: str) -> str | None:
+    """Combine filename + content checks, filename takes priority."""
+    result = detect_by_filename(filepath)
+    if result:
+        return result
+    return detect_by_content(filepath)
+
+
+def normalize_sbom_filename(filepath: str) -> str:
+    """
+    Detect SBOM format and copy it to an OSV-Scanner-recognized filename
+    in the same directory as the source file.
+
+    Returns:
+        The resulting filename (not full path) as `out`, or "unknown"
+        if the format could not be determined.
+    """
+    path = Path(filepath)
+    if not path.exists():
+        logging.error(f"Error: file not found: {filepath}")
+        return "unknown"
+
+    fmt = detect_sbom_format(filepath)
+
+    if fmt == "SPDX":
+        out = "boman-bom.spdx.json"
+    elif fmt == "CycloneDX":
+        out = "boman-bom.cdx.json"
+    else:
+        return "unknown"
+
+    dest_path = path.parent / out
+
+    # Avoid pointless copy if source is already correctly named
+    if path.resolve() != dest_path.resolve():
+        shutil.copy2(path, dest_path)
+
+    return out
+
+def delete_file_on_error(filepath: str) -> bool:
+    """
+    Delete a file, typically used for cleanup when an error occurs.
+    Returns True if deleted (or already gone), False if deletion failed.
+    """
+    try:
+        path = Path(filepath)
+        if path.exists():
+            path.unlink()
+            logging.info(f"Deleted: {filepath}")
+        return True
+    except Exception as e:
+        logging.error(f"Failed to delete {filepath}: {e}")
+        return False

{boman_cli-2.5.15 → boman_cli-2.6.2}/bomancli/validation.py

@@ -384,6 +384,9 @@ def tool_configuration_validation():
                 #     Config.dast_adv_auth_enabled = True  
                 # else:
                 #     Config.dast_adv_auth_enabled = False
+                
+                # As to keep reachability logic. Due to reachbility not yielding any result and time consuming in runtime making it false without removeing the logic. 
+                Config.reachability_present = False
 
             except:
                 logging.info("Tool Config: Failed!!!  exit code: 1 (Server ERROR) Message: Problem occured while authorizing the scan, Please contact boman.ai team")

{boman_cli-2.5.15 → boman_cli-2.6.2}/setup.cfg

@@ -1,8 +1,9 @@
 [metadata]
 environment = prod
-version = 2.5.15
+version = 2.6.2
 name = boman-cli
-saas_base_url = https://dashboard.boman.ai/
+saas_base_url = 
+https = //dashboard.boman.ai/
 
 [egg_info]
 tag_build = 

{boman_cli-2.5.15 → boman_cli-2.6.2}/setup.py

@@ -46,7 +46,7 @@ setup(
     license='BSD 2-clause',
     entry_points = entry_points,
     packages=['bomancli'],
-    package_data={'bomancli': ['templates/template_plan.yaml']},
+    package_data={'bomancli': ['templates/template_plan.yaml', 'malware_rules/**/*', 'malware_rules/**/**/*']},
     install_requires=['docker<=7.0.0',
                       'requests<=2.31.0',
                       'pyyaml',