cartography 0.100.0rc2__tar.gz → 0.100.0rc3__tar.gz

{cartography-0.100.0rc2 → cartography-0.100.0rc3}/.github/workflows/ossf-scorecard.yml

@@ -30,7 +30,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
+        uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
         with:
           results_file: results.sarif
           results_format: sarif
@@ -49,7 +49,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
         with:
           name: SARIF file
           path: results.sarif
@@ -57,6 +57,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
+        uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
         with:
           sarif_file: results.sarif

{cartography-0.100.0rc2 → cartography-0.100.0rc3}/.github/workflows/publish-to-ghcr-and-pypi.yml

@@ -53,12 +53,12 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
         with:
           images: ghcr.io/${{ github.repository }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
 
       - name: Login to GitHub Container Registry
         uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
@@ -83,7 +83,7 @@ jobs:
           sleep 10
 
       - name: Build and push
-        uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6.13.0
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
         with:
           file: Dockerfile
           context: .

{cartography-0.100.0rc2 → cartography-0.100.0rc3}/.github/workflows/sphinx.yml

@@ -33,7 +33,7 @@ jobs:
       # https://docs.github.com/en/actions/guides/building-and-testing-python#caching-dependencies
       # ^-- How to set up caching for pip on Ubuntu
       - name: Cache pip
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
         with:
           path: ~/.cache/pip
           key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}

{cartography-0.100.0rc2 → cartography-0.100.0rc3}/.github/workflows/test_suite.yml

@@ -40,7 +40,7 @@ jobs:
         with:
           python-version: "3.10"
       # Cache our pip dir for efficiency; see https://medium.com/ai2-blog/python-caching-in-github-actions-e9452698e98d.
-      - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+      - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
         with:
           path: ~/.cache/pip
           key: ${{ hashFiles('setup.py') }}-${{ hashFiles('pyproject.toml') }}
@@ -74,7 +74,7 @@ jobs:
         with:
           python-version: "3.10"
       # Cache our pip dir for efficiency; see https://medium.com/ai2-blog/python-caching-in-github-actions-e9452698e98d.
-      - uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+      - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
         with:
           path: ~/.cache/pip
           key: ${{ hashFiles('setup.py') }}-${{ hashFiles('pyproject.toml') }}
@@ -97,15 +97,15 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
+        uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
         with:
           images: ghcr.io/${{ github.repository }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
 
       - name: Build
-        uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6.13.0
+        uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
         with:
           file: Dockerfile
           push: false # only build the image, don't push it anywhere

{cartography-0.100.0rc2 → cartography-0.100.0rc3}/Dockerfile

@@ -1,6 +1,6 @@
 # This is a thin distribution of the cartography software.
 # It is published at ghcr.io.
-FROM python:3.10-slim@sha256:66aad90b231f011cb80e1966e03526a7175f0586724981969b23903abac19081
+FROM python:3.10-slim@sha256:f680fc3f447366d9be2ae53dc7a6447fe9b33311af209225783932704f0cb4e7
 
 # Default to ''. Overridden with a specific version specifier e.g. '==0.98.0' by build args or from GitHub actions.
 ARG VERSION_SPECIFIER

{cartography-0.100.0rc2 → cartography-0.100.0rc3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: cartography
-Version: 0.100.0rc2
+Version: 0.100.0rc3
 Summary: Explore assets and their relationships across your technical infrastructure.
 Maintainer: Cartography Contributors
 License: apache2
@@ -59,10 +59,10 @@ Requires-Dist: moto; extra == "dev"
 Requires-Dist: pre-commit; extra == "dev"
 Requires-Dist: pytest>=6.2.4; extra == "dev"
 Requires-Dist: pytest-mock; extra == "dev"
-Requires-Dist: pytest-cov==2.10.0; extra == "dev"
+Requires-Dist: pytest-cov==6.0.0; extra == "dev"
 Requires-Dist: pytest-rerunfailures; extra == "dev"
 Requires-Dist: types-PyYAML; extra == "dev"
-Requires-Dist: types-requests<2.32.0.20241017; extra == "dev"
+Requires-Dist: types-requests<2.32.0.20250302; extra == "dev"
 
 ![Cartography](docs/root/images/logo-horizontal.png)
 

{cartography-0.100.0rc2 → cartography-0.100.0rc3}/cartography/_version.py

@@ -17,5 +17,5 @@ __version__: str
 __version_tuple__: VERSION_TUPLE
 version_tuple: VERSION_TUPLE
 
-__version__ = version = '0.100.0rc2'
+__version__ = version = '0.100.0rc3'
 __version_tuple__ = version_tuple = (0, 100, 0)

{cartography-0.100.0rc2 → cartography-0.100.0rc3}/cartography/intel/aws/ecr.py

@@ -33,13 +33,21 @@ def get_ecr_repositories(boto3_session: boto3.session.Session, region: str) -> L
 def get_ecr_repository_images(boto3_session: boto3.session.Session, region: str, repository_name: str) -> List[Dict]:
     logger.debug("Getting ECR images in repository '%s' for region '%s'.", repository_name, region)
     client = boto3_session.client('ecr', region_name=region)
-    paginator = client.get_paginator('list_images')
+    list_paginator = client.get_paginator('list_images')
     ecr_repository_images: List[Dict] = []
-    for page in paginator.paginate(repositoryName=repository_name):
+    for page in list_paginator.paginate(repositoryName=repository_name):
         image_ids = page['imageIds']
-        if image_ids:
-            response = client.describe_images(repositoryName=repository_name, imageIds=image_ids)
-            ecr_repository_images.extend(response['imageDetails'])
+        if not image_ids:
+            continue
+        describe_paginator = client.get_paginator('describe_images')
+        describe_response = describe_paginator.paginate(repositoryName=repository_name, imageIds=image_ids)
+        for response in describe_response:
+            image_details = response['imageDetails']
+            image_details = [
+                {**detail, 'imageTag': detail['imageTags'][0]} if detail.get('imageTags') else detail
+                for detail in image_details
+            ]
+            ecr_repository_images.extend(image_details)
     return ecr_repository_images
 
 

{cartography-0.100.0rc2 → cartography-0.100.0rc3}/cartography/intel/cve/feed.py

@@ -212,19 +212,19 @@ def transform_cves(cve_json: Dict[Any, Any]) -> List[Dict[Any, Any]]:
             if cvss31:
                 cvss31.update(cvss31["cvssData"])
                 cvss31.pop("cvssData")
-                cve["vectorString"] = cvss31["vectorString"]
-                cve["attackVector"] = cvss31["attackVector"]
-                cve["attackComplexity"] = cvss31["attackComplexity"]
-                cve["privilegesRequired"] = cvss31["privilegesRequired"]
-                cve["userInteraction"] = cvss31["userInteraction"]
-                cve["scope"] = cvss31["scope"]
-                cve["confidentialityImpact"] = cvss31["confidentialityImpact"]
-                cve["integrityImpact"] = cvss31["integrityImpact"]
-                cve["availabilityImpact"] = cvss31["availabilityImpact"]
-                cve["baseScore"] = cvss31["baseScore"]
-                cve["baseSeverity"] = cvss31["baseSeverity"]
-                cve["exploitabilityScore"] = cvss31["exploitabilityScore"]
-                cve["impactScore"] = cvss31["impactScore"]
+                cve["vectorString"] = cvss31.get("vectorString")
+                cve["attackVector"] = cvss31.get("attackVector")
+                cve["attackComplexity"] = cvss31.get("attackComplexity")
+                cve["privilegesRequired"] = cvss31.get("privilegesRequired")
+                cve["userInteraction"] = cvss31.get("userInteraction")
+                cve["scope"] = cvss31.get("scope")
+                cve["confidentialityImpact"] = cvss31.get("confidentialityImpact")
+                cve["integrityImpact"] = cvss31.get("integrityImpact")
+                cve["availabilityImpact"] = cvss31.get("availabilityImpact")
+                cve["baseScore"] = cvss31.get("baseScore")
+                cve["baseSeverity"] = cvss31.get("baseSeverity")
+                cve["exploitabilityScore"] = cvss31.get("exploitabilityScore")
+                cve["impactScore"] = cvss31.get("impactScore")
         except Exception:
             logger.error("Failed to transform CVE data {data}")
             raise

{cartography-0.100.0rc2 → cartography-0.100.0rc3}/cartography.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: cartography
-Version: 0.100.0rc2
+Version: 0.100.0rc3
 Summary: Explore assets and their relationships across your technical infrastructure.
 Maintainer: Cartography Contributors
 License: apache2
@@ -59,10 +59,10 @@ Requires-Dist: moto; extra == "dev"
 Requires-Dist: pre-commit; extra == "dev"
 Requires-Dist: pytest>=6.2.4; extra == "dev"
 Requires-Dist: pytest-mock; extra == "dev"
-Requires-Dist: pytest-cov==2.10.0; extra == "dev"
+Requires-Dist: pytest-cov==6.0.0; extra == "dev"
 Requires-Dist: pytest-rerunfailures; extra == "dev"
 Requires-Dist: types-PyYAML; extra == "dev"
-Requires-Dist: types-requests<2.32.0.20241017; extra == "dev"
+Requires-Dist: types-requests<2.32.0.20250302; extra == "dev"
 
 ![Cartography](docs/root/images/logo-horizontal.png)
 

{cartography-0.100.0rc2 → cartography-0.100.0rc3}/cartography.egg-info/requires.txt

@@ -36,7 +36,7 @@ moto
 pre-commit
 pytest>=6.2.4
 pytest-mock
-pytest-cov==2.10.0
+pytest-cov==6.0.0
 pytest-rerunfailures
 types-PyYAML
-types-requests<2.32.0.20241017
+types-requests<2.32.0.20250302

{cartography-0.100.0rc2 → cartography-0.100.0rc3}/dev.Dockerfile

@@ -4,7 +4,7 @@
 # - This dockerfile will get called with .cache as a volume mount.
 # - The current working directory on the host building this container
 #   is the cartography source tree from github.
-FROM python:3.10-slim@sha256:66aad90b231f011cb80e1966e03526a7175f0586724981969b23903abac19081
+FROM python:3.10-slim@sha256:f680fc3f447366d9be2ae53dc7a6447fe9b33311af209225783932704f0cb4e7
 
 # The UID and GID to run cartography as.
 # This needs to match the gid and uid on the host.

{cartography-0.100.0rc2 → cartography-0.100.0rc3}/pyproject.toml

@@ -75,10 +75,10 @@ dev = [
     "pre-commit",
     "pytest>=6.2.4",
     "pytest-mock",
-    "pytest-cov==2.10.0",
+    "pytest-cov==6.0.0",
     "pytest-rerunfailures",
     "types-PyYAML",
-    "types-requests<2.32.0.20241017",
+    "types-requests<2.32.0.20250302",
 ]
 
 # Makes sure to look inside cartography/cartography/ for cli command

{cartography-0.100.0rc2 → cartography-0.100.0rc3}/tests/data/aws/ecr.py

@@ -26,17 +26,46 @@ DESCRIBE_REPOSITORIES = {
         },
     ],
 }
-
+DESCRIBE_IMAGES = {
+    'imageDetails':
+    {
+        "registryId": "000000000000",
+        "imageSizeInBytes": 1024,
+        "imagePushedAt": "2025-01-01T00:00:00.000000-00:00",
+        "imageScanStatus": {
+            "status": "COMPLETE",
+            "description": "The scan was completed successfully.",
+        },
+        "imageScanFindingsSummary": {
+            "imageScanCompletedAt": "2025-01-01T00:00:00-00:00",
+            "vulnerabilitySourceUpdatedAt": "2025-01-01T00:00:00-00:00",
+            "findingSeverityCounts": {
+                "CRITICAL": 1,
+                "HIGH": 1,
+                "MEDIUM": 1,
+                "INFORMATIONAL": 1,
+                "LOW": 1,
+            },
+        },
+        "imageManifestMediaType": "application/vnd.docker.distribution.manifest.v2+json",
+        "artifactMediaType": "application/vnd.docker.container.image.v1+json",
+        "lastRecordedPullTime": "2025-01-01T01:01:01.000000-00:00",
+    },
+}
 
 LIST_REPOSITORY_IMAGES = {
     '000000000000.dkr.ecr.us-east-1/example-repository': [
         {
             'imageDigest': 'sha256:0000000000000000000000000000000000000000000000000000000000000000',
             'imageTag': '1',
+            'repositoryName': 'example-repository',
+            **DESCRIBE_IMAGES['imageDetails'],
         },
         {
             'imageDigest': 'sha256:0000000000000000000000000000000000000000000000000000000000000001',
             'imageTag': '2',
+            'repositoryName': 'example-repository',
+            **DESCRIBE_IMAGES['imageDetails'],
         },
     ],
     '000000000000.dkr.ecr.us-east-1/sample-repository': [
@@ -44,10 +73,14 @@ LIST_REPOSITORY_IMAGES = {
             # NOTE same digest and tag as image in example-repository
             'imageDigest': 'sha256:0000000000000000000000000000000000000000000000000000000000000000',
             'imageTag': '1',
+            'repositoryName': 'sample-repository',
+            **DESCRIBE_IMAGES['imageDetails'],
         },
         {
             'imageDigest': 'sha256:0000000000000000000000000000000000000000000000000000000000000011',
             'imageTag': '2',
+            'repositoryName': 'sample-repository',
+            **DESCRIBE_IMAGES['imageDetails'],
         },
     ],
     '000000000000.dkr.ecr.us-east-1/test-repository': [
@@ -55,18 +88,26 @@ LIST_REPOSITORY_IMAGES = {
             # NOTE same digest but different tag from image in example-repository
             'imageDigest': 'sha256:0000000000000000000000000000000000000000000000000000000000000000',
             'imageTag': '1234567890',
+            'repositoryName': 'test-repository',
+            **DESCRIBE_IMAGES['imageDetails'],
         },
         {
             'imageDigest': 'sha256:0000000000000000000000000000000000000000000000000000000000000021',
             'imageTag': '1',
+            'repositoryName': 'test-repository',
+            **DESCRIBE_IMAGES['imageDetails'],
         },
         # Item without an imageDigest: will get filtered out and not ingested.
         {
             'imageTag': '1',
+            'repositoryName': 'test-repository',
+            **DESCRIBE_IMAGES['imageDetails'],
         },
         # Item without an imageTag
         {
             'imageDigest': 'sha256:0000000000000000000000000000000000000000000000000000000000000031',
+            'repositoryName': 'test-repository',
+            **DESCRIBE_IMAGES['imageDetails'],
         },
     ],
 }

{cartography-0.100.0rc2 → cartography-0.100.0rc3}/tests/integration/cartography/intel/aws/test_ecr.py

@@ -89,14 +89,17 @@ def test_sync_ecr(mock_get_images, mock_get_repos, neo4j_session):
     }
 
     # Assert ECR repository images exist
-    assert check_nodes(neo4j_session, 'ECRRepositoryImage', ['id', 'tag']) == {
-        ('000000000000.dkr.ecr.us-east-1/example-repository:1', '1'),
-        ('000000000000.dkr.ecr.us-east-1/example-repository:2', '2'),
-        ('000000000000.dkr.ecr.us-east-1/sample-repository:1', '1'),
-        ('000000000000.dkr.ecr.us-east-1/sample-repository:2', '2'),
-        ('000000000000.dkr.ecr.us-east-1/test-repository:1234567890', '1234567890'),
-        ('000000000000.dkr.ecr.us-east-1/test-repository:1', '1'),
-        ('000000000000.dkr.ecr.us-east-1/test-repository', None),
+    assert check_nodes(neo4j_session, 'ECRRepositoryImage', ['id', 'tag', 'image_size_bytes', 'image_pushed_at']) == {
+        ('000000000000.dkr.ecr.us-east-1/example-repository:1', '1', 1024, '2025-01-01T00:00:00.000000-00:00'),
+        ('000000000000.dkr.ecr.us-east-1/example-repository:2', '2', 1024, '2025-01-01T00:00:00.000000-00:00'),
+        ('000000000000.dkr.ecr.us-east-1/sample-repository:1', '1', 1024, '2025-01-01T00:00:00.000000-00:00'),
+        ('000000000000.dkr.ecr.us-east-1/sample-repository:2', '2', 1024, '2025-01-01T00:00:00.000000-00:00'),
+        (
+            '000000000000.dkr.ecr.us-east-1/test-repository:1234567890', '1234567890', 1024,
+            '2025-01-01T00:00:00.000000-00:00',
+        ),
+        ('000000000000.dkr.ecr.us-east-1/test-repository:1', '1', 1024, '2025-01-01T00:00:00.000000-00:00'),
+        ('000000000000.dkr.ecr.us-east-1/test-repository', None, 1024, '2025-01-01T00:00:00.000000-00:00'),
     }
 
     # Assert repository to AWS account relationship