cartography 0.100.0rc3__tar.gz → 0.101.0rc1__tar.gz

{cartography-0.100.0rc3 → cartography-0.101.0rc1}/.github/workflows/ossf-scorecard.yml

@@ -49,7 +49,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: SARIF file
           path: results.sarif
@@ -57,6 +57,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
+        uses: github/codeql-action/upload-sarif@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13
         with:
           sarif_file: results.sarif

{cartography-0.100.0rc3 → cartography-0.101.0rc1}/.github/workflows/publish-to-ghcr-and-pypi.yml

@@ -61,7 +61,7 @@ jobs:
         uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         with:
           registry: ghcr.io
           # This is the user that triggered the Workflow. In this case, it will

{cartography-0.100.0rc3 → cartography-0.101.0rc1}/.github/workflows/sphinx.yml

@@ -33,7 +33,7 @@ jobs:
       # https://docs.github.com/en/actions/guides/building-and-testing-python#caching-dependencies
       # ^-- How to set up caching for pip on Ubuntu
       - name: Cache pip
-        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: ~/.cache/pip
           key: ${{ runner.os }}-pip-${{ hashFiles('requirements.txt') }}

{cartography-0.100.0rc3 → cartography-0.101.0rc1}/.github/workflows/test_suite.yml

@@ -40,7 +40,7 @@ jobs:
         with:
           python-version: "3.10"
       # Cache our pip dir for efficiency; see https://medium.com/ai2-blog/python-caching-in-github-actions-e9452698e98d.
-      - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: ~/.cache/pip
           key: ${{ hashFiles('setup.py') }}-${{ hashFiles('pyproject.toml') }}
@@ -74,7 +74,7 @@ jobs:
         with:
           python-version: "3.10"
       # Cache our pip dir for efficiency; see https://medium.com/ai2-blog/python-caching-in-github-actions-e9452698e98d.
-      - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
+      - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: ~/.cache/pip
           key: ${{ hashFiles('setup.py') }}-${{ hashFiles('pyproject.toml') }}

{cartography-0.100.0rc3 → cartography-0.101.0rc1}/.gitignore

@@ -22,3 +22,4 @@ cartography/_version.py
 uv.lock
 .cursor-server
 .gitconfig
+.python-version

{cartography-0.100.0rc3 → cartography-0.101.0rc1}/Dockerfile

@@ -1,6 +1,6 @@
 # This is a thin distribution of the cartography software.
 # It is published at ghcr.io.
-FROM python:3.10-slim@sha256:f680fc3f447366d9be2ae53dc7a6447fe9b33311af209225783932704f0cb4e7
+FROM python:3.10-slim@sha256:06f6d69d229bb55fab83dded514e54eede977e33e92d855ba3f97ce0e3234abc
 
 # Default to ''. Overridden with a specific version specifier e.g. '==0.98.0' by build args or from GitHub actions.
 ARG VERSION_SPECIFIER

{cartography-0.100.0rc3 → cartography-0.101.0rc1}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.2
+Metadata-Version: 2.4
 Name: cartography
-Version: 0.100.0rc3
+Version: 0.101.0rc1
 Summary: Explore assets and their relationships across your technical infrastructure.
 Maintainer: Cartography Contributors
 License: apache2
@@ -26,7 +26,7 @@ Requires-Dist: backoff>=2.1.2
 Requires-Dist: boto3>=1.15.1
 Requires-Dist: botocore>=1.18.1
 Requires-Dist: dnspython>=1.15.0
-Requires-Dist: neo4j<5.0.0,>=4.4.4
+Requires-Dist: neo4j>=4.4.4
 Requires-Dist: policyuniverse>=1.1.0.0
 Requires-Dist: google-api-python-client>=1.7.8
 Requires-Dist: google-auth>=2.37.0
@@ -62,7 +62,8 @@ Requires-Dist: pytest-mock; extra == "dev"
 Requires-Dist: pytest-cov==6.0.0; extra == "dev"
 Requires-Dist: pytest-rerunfailures; extra == "dev"
 Requires-Dist: types-PyYAML; extra == "dev"
-Requires-Dist: types-requests<2.32.0.20250302; extra == "dev"
+Requires-Dist: types-requests<2.32.0.20250307; extra == "dev"
+Dynamic: license-file
 
 ![Cartography](docs/root/images/logo-horizontal.png)
 

{cartography-0.100.0rc3 → cartography-0.101.0rc1}/cartography/_version.py

@@ -17,5 +17,5 @@ __version__: str
 __version_tuple__: VERSION_TUPLE
 version_tuple: VERSION_TUPLE
 
-__version__ = version = '0.100.0rc3'
-__version_tuple__ = version_tuple = (0, 100, 0)
+__version__ = version = '0.101.0rc1'
+__version_tuple__ = version_tuple = (0, 101, 0)

{cartography-0.100.0rc3 → cartography-0.101.0rc1}/cartography/graph/statement.py

@@ -73,7 +73,8 @@ class GraphStatement:
         if self.iterative:
             self._run_iterative(session)
         else:
-            session.write_transaction(self._run_noniterative).consume()
+            session.write_transaction(self._run_noniterative)
+
         logger.info(f"Completed {self.parent_job_name} statement #{self.parent_job_sequence_num}")
 
     def as_dict(self) -> Dict[str, Any]:
@@ -87,14 +88,17 @@ class GraphStatement:
             "iterationsize": self.iterationsize,
         }
 
-    def _run_noniterative(self, tx: neo4j.Transaction) -> neo4j.Result:
+    def _run_noniterative(self, tx: neo4j.Transaction) -> neo4j.ResultSummary:
         """
         Non-iterative statement execution.
+        Returns a ResultSummary instead of Result to avoid ResultConsumedError.
         """
         result: neo4j.Result = tx.run(self.query, self.parameters)
 
-        # Handle stats
+        # Ensure we consume the result inside the transaction
         summary: neo4j.ResultSummary = result.consume()
+
+        # Handle stats
         stat_handler.incr('constraints_added', summary.counters.constraints_added)
         stat_handler.incr('constraints_removed', summary.counters.constraints_removed)
         stat_handler.incr('indexes_added', summary.counters.indexes_added)
@@ -107,7 +111,7 @@ class GraphStatement:
         stat_handler.incr('relationships_created', summary.counters.relationships_created)
         stat_handler.incr('relationships_deleted', summary.counters.relationships_deleted)
 
-        return result
+        return summary
 
     def _run_iterative(self, session: neo4j.Session) -> None:
         """
@@ -118,14 +122,10 @@ class GraphStatement:
         self.parameters["LIMIT_SIZE"] = self.iterationsize
 
         while True:
-            result: neo4j.Result = session.write_transaction(self._run_noniterative)
+            summary: neo4j.ResultSummary = session.write_transaction(self._run_noniterative)
 
-            # Exit if we have finished processing all items
-            if not result.consume().counters.contains_updates:
-                # Ensure network buffers are cleared
-                result.consume()
+            if not summary.counters.contains_updates:
                 break
-            result.consume()
 
     @classmethod
     def create_from_json(

{cartography-0.100.0rc3 → cartography-0.101.0rc1}/cartography/intel/aws/ec2/launch_templates.py

@@ -3,7 +3,6 @@ from typing import Any
 
 import boto3
 import neo4j
-from botocore.exceptions import ClientError
 
 from .util import get_botocore_config
 from cartography.client.core.tx import load
@@ -21,27 +20,45 @@ logger = logging.getLogger(__name__)
 def get_launch_templates(
     boto3_session: boto3.session.Session,
     region: str,
-) -> tuple[list[dict[str, Any]], list[dict[str, Any]]]:
+) -> list[dict[str, Any]]:
     client = boto3_session.client('ec2', region_name=region, config=get_botocore_config())
     paginator = client.get_paginator('describe_launch_templates')
     templates: list[dict[str, Any]] = []
-    template_versions: list[dict[str, Any]] = []
     for page in paginator.paginate():
         paginated_templates = page['LaunchTemplates']
-        for template in paginated_templates:
-            template_id = template['LaunchTemplateId']
-            try:
-                versions = get_launch_template_versions_by_template(boto3_session, template_id, region)
-            except ClientError as e:
-                logger.warning(
-                    f"Failed to get launch template versions for {template_id}: {e}",
-                    exc_info=True,
-                )
-                versions = []
-            # Using a key not defined in latest boto3 documentation
-            template_versions.extend(versions)
         templates.extend(paginated_templates)
-    return templates, template_versions
+    return templates
+
+
+@timeit
+@aws_handle_regions
+def get_launch_template_versions(
+    boto3_session: boto3.session.Session,
+    region: str,
+    launch_templates: list[dict[str, Any]],
+) -> list[dict[str, Any]]:
+    template_versions: list[dict[str, Any]] = []
+    for template in launch_templates:
+        launch_template_id = template['LaunchTemplateId']
+        versions = get_launch_template_versions_by_template(boto3_session, launch_template_id, region)
+        template_versions.extend(versions)
+
+    return template_versions
+
+
+@timeit
+@aws_handle_regions
+def get_launch_template_versions_by_template(
+        boto3_session: boto3.session.Session,
+        launch_template_id: str,
+        region: str,
+) -> list[dict[str, Any]]:
+    client = boto3_session.client('ec2', region_name=region, config=get_botocore_config())
+    v_paginator = client.get_paginator('describe_launch_template_versions')
+    template_versions = []
+    for versions in v_paginator.paginate(LaunchTemplateId=launch_template_id):
+        template_versions.extend(versions['LaunchTemplateVersions'])
+    return template_versions
 
 
 def transform_launch_templates(templates: list[dict[str, Any]]) -> list[dict[str, Any]]:
@@ -71,21 +88,6 @@ def load_launch_templates(
     )
 
 
-@timeit
-@aws_handle_regions
-def get_launch_template_versions_by_template(
-        boto3_session: boto3.session.Session,
-        template: str,
-        region: str,
-) -> list[dict[str, Any]]:
-    client = boto3_session.client('ec2', region_name=region, config=get_botocore_config())
-    v_paginator = client.get_paginator('describe_launch_template_versions')
-    template_versions = []
-    for versions in v_paginator.paginate(LaunchTemplateId=template):
-        template_versions.extend(versions['LaunchTemplateVersions'])
-    return template_versions
-
-
 def transform_launch_template_versions(versions: list[dict[str, Any]]) -> list[dict[str, Any]]:
     result: list[dict[str, Any]] = []
     for version in versions:
@@ -153,7 +155,8 @@ def sync_ec2_launch_templates(
 ) -> None:
     for region in regions:
         logger.info(f"Syncing launch templates for region '{region}' in account '{current_aws_account_id}'.")
-        templates, versions = get_launch_templates(boto3_session, region)
+        templates = get_launch_templates(boto3_session, region)
+        versions = get_launch_template_versions(boto3_session, region, templates)
         templates = transform_launch_templates(templates)
         load_launch_templates(neo4j_session, templates, region, current_aws_account_id, update_tag)
         versions = transform_launch_template_versions(versions)

{cartography-0.100.0rc3 → cartography-0.101.0rc1}/cartography/intel/gcp/__init__.py

@@ -254,6 +254,30 @@ def _sync_single_project_dns(
         dns.sync(neo4j_session, dns_cred, project_id, gcp_update_tag, common_job_parameters)
 
 
+def _sync_single_project_iam(
+    neo4j_session: neo4j.Session,
+    resources: Resource,
+    project_id: str,
+    gcp_update_tag: int,
+    common_job_parameters: Dict,
+) -> None:
+    """
+    Handles graph sync for a single GCP project's IAM resources.
+    :param neo4j_session: The Neo4j session
+    :param resources: namedtuple of the GCP resource objects
+    :param project_id: The project ID number to sync.  See  the `projectId` field in
+    https://cloud.google.com/resource-manager/reference/rest/v1/projects
+    :param gcp_update_tag: The timestamp value to set our new Neo4j nodes with
+    :param common_job_parameters: Other parameters sent to Neo4j
+    :return: Nothing
+    """
+    # Determine if IAM service is enabled
+    enabled_services = _services_enabled_on_project(resources.serviceusage, project_id)
+    iam_cred = _get_iam_resource(get_gcp_credentials())
+    if service_names.iam in enabled_services:
+        iam.sync(neo4j_session, iam_cred, project_id, gcp_update_tag, common_job_parameters)
+
+
 def _sync_multiple_projects(
     neo4j_session: neo4j.Session, resources: Resource, projects: List[Dict],
     gcp_update_tag: int, common_job_parameters: Dict,
@@ -300,13 +324,7 @@ def _sync_multiple_projects(
     for project in projects:
         project_id = project['projectId']
         logger.info("Syncing GCP project %s for IAM", project_id)
-        iam.sync(
-            neo4j_session,
-            resources.iam,
-            project_id,
-            gcp_update_tag,
-            common_job_parameters,
-        )
+        _sync_single_project_iam(neo4j_session, resources, project_id, gcp_update_tag, common_job_parameters)
 
 
 @timeit

{cartography-0.100.0rc3 → cartography-0.101.0rc1}/cartography/intel/gsuite/__init__.py

@@ -23,7 +23,6 @@ OAUTH_SCOPES = [
     'https://www.googleapis.com/auth/admin.directory.user.readonly',
     'https://www.googleapis.com/auth/admin.directory.group.readonly',
     'https://www.googleapis.com/auth/admin.directory.group.member',
-    'https://www.googleapis.com/auth/cloud-platform',
 ]
 
 logger = logging.getLogger(__name__)

{cartography-0.100.0rc3 → cartography-0.101.0rc1}/cartography.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.2
+Metadata-Version: 2.4
 Name: cartography
-Version: 0.100.0rc3
+Version: 0.101.0rc1
 Summary: Explore assets and their relationships across your technical infrastructure.
 Maintainer: Cartography Contributors
 License: apache2
@@ -26,7 +26,7 @@ Requires-Dist: backoff>=2.1.2
 Requires-Dist: boto3>=1.15.1
 Requires-Dist: botocore>=1.18.1
 Requires-Dist: dnspython>=1.15.0
-Requires-Dist: neo4j<5.0.0,>=4.4.4
+Requires-Dist: neo4j>=4.4.4
 Requires-Dist: policyuniverse>=1.1.0.0
 Requires-Dist: google-api-python-client>=1.7.8
 Requires-Dist: google-auth>=2.37.0
@@ -62,7 +62,8 @@ Requires-Dist: pytest-mock; extra == "dev"
 Requires-Dist: pytest-cov==6.0.0; extra == "dev"
 Requires-Dist: pytest-rerunfailures; extra == "dev"
 Requires-Dist: types-PyYAML; extra == "dev"
-Requires-Dist: types-requests<2.32.0.20250302; extra == "dev"
+Requires-Dist: types-requests<2.32.0.20250307; extra == "dev"
+Dynamic: license-file
 
 ![Cartography](docs/root/images/logo-horizontal.png)
 

{cartography-0.100.0rc3 → cartography-0.101.0rc1}/cartography.egg-info/requires.txt

@@ -2,7 +2,7 @@ backoff>=2.1.2
 boto3>=1.15.1
 botocore>=1.18.1
 dnspython>=1.15.0
-neo4j<5.0.0,>=4.4.4
+neo4j>=4.4.4
 policyuniverse>=1.1.0.0
 google-api-python-client>=1.7.8
 google-auth>=2.37.0
@@ -39,4 +39,4 @@ pytest-mock
 pytest-cov==6.0.0
 pytest-rerunfailures
 types-PyYAML
-types-requests<2.32.0.20250302
+types-requests<2.32.0.20250307

{cartography-0.100.0rc3 → cartography-0.101.0rc1}/dev.Dockerfile

@@ -4,7 +4,7 @@
 # - This dockerfile will get called with .cache as a volume mount.
 # - The current working directory on the host building this container
 #   is the cartography source tree from github.
-FROM python:3.10-slim@sha256:f680fc3f447366d9be2ae53dc7a6447fe9b33311af209225783932704f0cb4e7
+FROM python:3.10-slim@sha256:06f6d69d229bb55fab83dded514e54eede977e33e92d855ba3f97ce0e3234abc
 
 # The UID and GID to run cartography as.
 # This needs to match the gid and uid on the host.

{cartography-0.100.0rc3 → cartography-0.101.0rc1}/docs/root/modules/gcp/config.md

@@ -8,7 +8,7 @@ Follow these steps to analyze GCP projects with Cartography.
 
     1. Create an identity - either a User Account or a Service Account - for Cartography to run as
     1. Ensure that this identity has the following roles (https://cloud.google.com/iam/docs/understanding-roles) attached to it:
-        - `roles/iam.securityReviewer`
+        - `roles/iam.securityReviewer`: needed to list/get GCP IAM roles and service accounts
         - `roles/resourcemanager.organizationViewer`: needed to list/get GCP Organizations
         - `roles/resourcemanager.folderViewer`: needed to list/get GCP Folders
     1. Ensure that the machine you are running Cartography on can authenticate to this identity.

{cartography-0.100.0rc3 → cartography-0.101.0rc1}/pyproject.toml

@@ -36,7 +36,7 @@ dependencies = [
     "boto3>=1.15.1",
     "botocore>=1.18.1",
     "dnspython>=1.15.0",
-    "neo4j>=4.4.4,<5.0.0",
+    "neo4j>=4.4.4",
     "policyuniverse>=1.1.0.0",
     "google-api-python-client>=1.7.8",
     "google-auth>=2.37.0",
@@ -78,7 +78,7 @@ dev = [
     "pytest-cov==6.0.0",
     "pytest-rerunfailures",
     "types-PyYAML",
-    "types-requests<2.32.0.20250302",
+    "types-requests<2.32.0.20250307",
 ]
 
 # Makes sure to look inside cartography/cartography/ for cli command

{cartography-0.100.0rc3 → cartography-0.101.0rc1}/tests/integration/cartography/intel/aws/ec2/test_launch_templates.py

@@ -1,11 +1,3 @@
-from unittest.mock import patch
-
-import boto3
-from botocore.exceptions import ClientError
-from moto import mock_aws
-
-import cartography.intel.aws.ec2.launch_templates
-from cartography.intel.aws.ec2.launch_templates import get_launch_templates
 from cartography.intel.aws.ec2.launch_templates import load_launch_template_versions
 from cartography.intel.aws.ec2.launch_templates import load_launch_templates
 from cartography.intel.aws.ec2.launch_templates import transform_launch_template_versions
@@ -19,48 +11,6 @@ TEST_REGION = 'us-east-1'
 TEST_UPDATE_TAG = 123456789
 
 
-@mock_aws(config={'core': {'reset_boto3_session': True, 'mock_credentials': True}})
-@patch.object(
-    cartography.intel.aws.ec2.launch_templates,
-    'get_launch_template_versions_by_template',
-)
-def test_get_launch_template_throws_exception(mock_get_template_versions, *args):
-    # Arrange
-    template_data = {
-        "ImageId": "ami-abc123",
-        "TagSpecifications": [
-            {
-                "ResourceType": "instance", "Tags": [
-                    {"Key": "eks:cluster-name", "Value": "eks-cluster-example"},
-                    {"Key": "eks:nodegroup-name", "Value": "private-node-group-example"},
-                ],
-            },
-        ],
-        "SecurityGroupIds": ["sg-1234"],
-    }
-    client = boto3.client('ec2', region_name=TEST_REGION)
-    mock_template = client.create_launch_template(
-        LaunchTemplateName='eks-00000000-0000-0000-0000-000000000000',
-        LaunchTemplateData=template_data,
-    )
-    template_id = mock_template['LaunchTemplate']['LaunchTemplateId']
-    error_response = {
-        "Error": {
-            "Code": "InvalidLaunchTemplateId.NotFound",
-            "Message": f"The specified launch template, with template ID {template_id}, does not exist.",
-        },
-    }
-    mock_get_template_versions.side_effect = ClientError(error_response, "DescribeLaunchTemplateVersions")
-    session = boto3.Session(region_name=TEST_REGION)
-    # Act: get the launch template versions
-
-    templates, versions = get_launch_templates(session, TEST_REGION)
-
-    # Assert: the launch template versions are as expected
-    assert len(templates) == 1
-    assert len(versions) == 0
-
-
 def test_load_launch_templates(neo4j_session, *args):
     # Arrange: an AWSAccount must exist
     neo4j_session.run(