boman-cli 2.5.8__tar.gz → 2.5.10__tar.gz

{boman_cli-2.5.8 → boman_cli-2.5.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boman-cli
-Version: 2.5.8
+Version: 2.5.10
 Summary: CLI tool of boman.ai
 Home-page: https://boman.ai
 Author: Sumeru Software Solutions Pvt. Ltd.
@@ -112,11 +112,16 @@ Example: boman-cli -a run -zap_session_script ./session.js
 
 ### Release Note:
 
-### 2.5.8
-- **SBOM API BUg** - Bug Fix. Added exception handling in the SBOM API.
+### 2.5.9
+- **SBOM API BUg** - New Feature. Additional sbom columns were added
+
+###  2.5.8
+
+- SBOM API BUg - Bug Fix. Added exception handling in the SBOM API.
 
 ### 2.5.6
-- **Bitbucket Bug fix** - Bug Fix. Reachability scan bug fix in bitbucket env.
+
+- Bitbucket Bug fix - Bug Fix. Reachability scan bug fix in bitbucket env.
 
 ### 2.5.5
 - **CLOC** - New feature. CLI will now generate lines of code of the repo and push it to SaaS.

{boman_cli-2.5.8 → boman_cli-2.5.10}/README.md

@@ -81,11 +81,16 @@ Example: boman-cli -a run -zap_session_script ./session.js
 
 ### Release Note:
 
-### 2.5.8
-- **SBOM API BUg** - Bug Fix. Added exception handling in the SBOM API.
+### 2.5.9
+- **SBOM API BUg** - New Feature. Additional sbom columns were added
+
+###  2.5.8
+
+- SBOM API BUg - Bug Fix. Added exception handling in the SBOM API.
 
 ### 2.5.6
-- **Bitbucket Bug fix** - Bug Fix. Reachability scan bug fix in bitbucket env.
+
+- Bitbucket Bug fix - Bug Fix. Reachability scan bug fix in bitbucket env.
 
 ### 2.5.5
 - **CLOC** - New feature. CLI will now generate lines of code of the repo and push it to SaaS.

{boman_cli-2.5.8 → boman_cli-2.5.10}/boman_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boman-cli
-Version: 2.5.8
+Version: 2.5.10
 Summary: CLI tool of boman.ai
 Home-page: https://boman.ai
 Author: Sumeru Software Solutions Pvt. Ltd.
@@ -112,11 +112,16 @@ Example: boman-cli -a run -zap_session_script ./session.js
 
 ### Release Note:
 
-### 2.5.8
-- **SBOM API BUg** - Bug Fix. Added exception handling in the SBOM API.
+### 2.5.9
+- **SBOM API BUg** - New Feature. Additional sbom columns were added
+
+###  2.5.8
+
+- SBOM API BUg - Bug Fix. Added exception handling in the SBOM API.
 
 ### 2.5.6
-- **Bitbucket Bug fix** - Bug Fix. Reachability scan bug fix in bitbucket env.
+
+- Bitbucket Bug fix - Bug Fix. Reachability scan bug fix in bitbucket env.
 
 ### 2.5.5
 - **CLOC** - New feature. CLI will now generate lines of code of the repo and push it to SaaS.

{boman_cli-2.5.8 → boman_cli-2.5.10}/bomancli/Config.py

@@ -121,7 +121,7 @@ class Config:
 
     log_level = "INFO"
 
-    version = 'v2.5.8'
+    version = 'v2.5.10'
 
     boman_config_file = 'boman.yaml'
     
@@ -167,7 +167,8 @@ class Config:
     sbom_scan_status=None
     sbom_target=None
     sbom_output_file=None
-    
+    set_cache_dir = False
+    cache_dir = " --cache-dir /tmp/.trivycache"
     #IAC scanning
     iac_scan_present=None
     iac_scan_build_dir=None

{boman_cli-2.5.8 → boman_cli-2.5.10}/bomancli/main.py

@@ -554,7 +554,13 @@ def runImage(data=None,type=None):
         
         try:
             Config.build_dir = Config.sbom_build_dir = os.getcwd()+'/'
+            command_line = "--format cyclonedx --output /src/boman_trivy_sbom_scan.json --scanners vuln fs /{target}"
             command_line = "% s" % command_line.format(target = 'src/')
+            #added upon jenkins sbom issue - GM
+            if Config.set_cache_dir:
+                command_line = command_line + Config.cache_dir
+                logging.info('SBOM Docker: Cache directory is set for the scan, updated command is %s',command_line[-20:])
+            logging.info(f"SBOM Docker: command ==> {command_line[-20:]}")
             container_output = docker.containers.run(docker_image, command_line, volumes={Config.sbom_build_dir: {
                         'bind': data['bind']}}, user=uid, remove=True)
             logging.info('SBOM Docker: SUCCESS!!! Message: %s Scan Completed',tool_name)
@@ -564,44 +570,53 @@ def runImage(data=None,type=None):
             ##running reachability before sbom upload
 
 
-               #this part i removed since, reachabitlity bug has to solved later 
+               #this part i removed since, reachabitlity bug has tobe solved later 
 
              #### sbom entrich part starts here
 
 
             # Load SBOM (generated by Trivy or Syft)
+                  # Load SBOM (generated by Trivy or Syft)
             enricher = SBOMEnricher(Config.sbom_output_file)
 
             # Enrich with additional fields
             enriched_data = enricher.enrich_components()
 
             # Save final SBOM
-            enricher.save_sbom("sbom_enriched.json")
-
+            enricher.save_sbom('sbom_enriched.json')
 
+            #print(Config.sbom_output_file)
             
+
             output_file = 'sbom_enriched.json'
+
+            logging.info('Enrichment done %s',output_file)
+
+
+            
+            sbom_output_file = output_file
             csv_file = Config.hssc_output_file
             #generating sbom more data
 
 
             #i should run the heisenger
             
-            logging.info('Running HSC on the repo')
+            logging.info('Running SSC check on the repo')
 
 
             
             try:
-                Utils.runheisenberg(output_file) #docker of hsc
+                Utils.runheisenberg(sbom_output_file) #docker of hsc
             except e:
                 logging.info('Some error occured while Running HSC on the repo')
                 exit(6)    
             
             logging.info('Enrichment with more data is going to happen %s',Config.sbom_output_file)  
 
-            enricher.run_heisenberg(Config.sbom_output_file, csv_file)
+            enricher.run_heisenberg(sbom_output_file, csv_file)
 
             logging.info('Enrichment done %s',Config.sbom_output_file)
+            ##exit(-1)
             
         except errors.ContainerError as exc:
            logging.error('SBOM Docker: Failed!!! Message: Some Error recorded while scanning %s',str(exc))
@@ -683,7 +698,6 @@ def runImage(data=None,type=None):
         logging.info('Running %s',tool_name)
         
         try:
-
             workspace = os.getcwd()
 
             tmp_dir = os.path.join(workspace, ".ci_tmp")
@@ -693,6 +707,7 @@ def runImage(data=None,type=None):
             os.makedirs(home_dir, exist_ok=True)
 
             command_line = "% s" % command_line.format(lang = Config.reachability_language)   
+            #command_line ="atom reachables -l python -o /app/app.atom -s /app/reachables.slices.json /app"
             Config.build_dir = Config.reachability_build_dir = Config.sca_build_dir
             container_output = docker.containers.run(docker_image, command_line, volumes={
             tmp_dir: {'bind': '/tmp', 'mode': 'rw'},
@@ -821,8 +836,9 @@ def uploadReport(filename,toolname,tool_id,scan_details_id,type):
             logging.info('Removing the result file')
             if type != "sbom" and type != "reachability":
                 logging.info("remvoing file here")
-                #os.remove(path)
+                os.remove(path)
             elif Config.reachability_present is not True and type == 'sbom':
+                #print('dmdmd')
                 os.remove(path)    
             elif type == "reachability":
                 os.remove(path)
@@ -1243,6 +1259,7 @@ def default():
     parser.add_argument('-semgrep_token','--semgrepToken',default='No',help="Pass the semgrep community token here")
     parser.add_argument('-pot','--pollTime',default=60,help="Polling Time. Min : 30s, Max: 5min, Default : 1min. Format: input the time in seconds eg: 1min => 60 ")
     parser.add_argument('-pof','--pollFrequency',default=10,help="Polling Frequency. Min : 5s, Max: 1min, Default : 10s. Format: input the time in seconds eg: 1min => 60 ")
+    parser.add_argument('-std','--setCacheDir',default=False,help="Set the cache directory for the scan. Set true if you use jenkins cicd")
     args = parser.parse_args()
 
     # if len(sys.args) == 1:
@@ -1264,6 +1281,11 @@ def default():
     else:
         ###logging.info('jenkins is not choosen')
         Config.jenkins = 'no'  
+        
+    if args.setCacheDir:
+        Config.set_cache_dir = True
+    else:
+        Config.set_cache_dir = False
 
     # lingu user id set
     if args.semgrepToken == 'No':

{boman_cli-2.5.8 → boman_cli-2.5.10}/bomancli/sbom_enricher.py

@@ -830,6 +830,7 @@ class SBOMEnricher:
         links = ver_data.get("links", [])
         repo_url = next((l.get("url") for l in links if l.get("label") in ["SOURCE_REPO", "HOMEPAGE"]), "")
 
+        #print(f'advisores are: {advisories}')
         return {
             "current_version": version,
             "latest_version": latest,
@@ -838,7 +839,7 @@ class SBOMEnricher:
             "license": licenses[0] if licenses else "Unknown",
             "update_available": update_av,
             "versions_behind": behind,
-            "security_advisories": len(advisories),
+            "security_advisories": ", ".join(item['id'] for item in advisories),
             "security_score": "HIGH" if len(advisories) > 5 else "MEDIUM" if len(advisories) > 0 else "LOW",
             "other_references": self.extract_links(ver_data)
         }
@@ -859,7 +860,7 @@ class SBOMEnricher:
         component["benign"] = True
         component["usage"] = {
             "used": self.safe_int(row.get("dependents", 0)) > 0,
-            "reachable": True
+            "reachable": False #default is false
         }
         component["heisenberg"] = {
             "update_available": row.get("deprecated", "false").lower() == "true",
@@ -874,21 +875,21 @@ class SBOMEnricher:
         """Maps API data fields to component structure."""
         component["source_repo"] = api_data["repo_url"]
         component["repo_metadata"] = {
-            "stars": 0, 
-            "forks": 0,
-            "open_issues": 0,
+            "stars":None, 
+            "forks":None ,
+            "open_issues": None,
             "license": api_data["license"]
         }
-        component["malicious"] = False
-        component["benign"] = True
+        component["malicious"] = '-'
+        component["benign"] = '-'
         component["usage"] = {"used": True, "reachable": True}
         component["heisenberg"] = {
             "current_version": api_data["current_version"],
             "latest_version": api_data["latest_version"],
             "latest_version_by_date": api_data["latest_version_by_date"],
             "update_available": api_data["update_available"],
-            "maintained_score": 0.0, 
-            "popular_score": 0.0,
+            "maintained_score": None, 
+            "popular_score": None,
             "versions_behind": api_data["versions_behind"],
             "security_score": api_data["security_score"],
             "security_advisories": api_data["security_advisories"],

{boman_cli-2.5.8 → boman_cli-2.5.10}/bomancli/utils.py

@@ -1244,11 +1244,11 @@ def runheisenberg(sbom_file_path):
     sbom_path = Config.sbom_build_dir+'/'+sbom_file_path
     hsc_path = Config.sbom_build_dir+'/'+Config.hssc_output_file
 
-    logging.info('running the hsc for %s and %s',sbom_path,hsc_path)
+    logging.info('running the SSC for %s and %s',sbom_path,hsc_path)
 
     command_line = f"vendor --sbom-file {sbom_path}  -o {hsc_path}"
     tool_name ='HSC'
-    logging.info('Preparing the Heisenberg tool')
+    logging.info('Preparing the SSC tool')
     try:
 
         logging.info('HSC Docker: Preparing %s scan for jenkins env with %s user ', tool_name , userid)    

{boman_cli-2.5.8 → boman_cli-2.5.10}/setup.cfg

@@ -1,6 +1,6 @@
 [metadata]
 environment = prod
-version = 2.5.8
+version = 2.5.10
 name = boman-cli
 saas_base_url = https://dashboard.boman.ai/