cartography 0.98.0rc3__tar.gz → 0.98.0rc5__tar.gz

{cartography-0.98.0rc3 → cartography-0.98.0rc5}/.github/workflows/publish-to-ghcr-and-pypi.yml

@@ -45,6 +45,7 @@ jobs:
         with:
           user: __token__
           password: ${{ secrets.PYPI_API_TOKEN }}
+          skip_existing: true
 
       # 2. Publish to GHCR
       - uses: actions/checkout@v2
@@ -86,4 +87,4 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           # e.g. '==0.98.0'
-          build-args: VERSION_SPECIFIER='==${{ env.VERSION }}'
+          build-args: VERSION_SPECIFIER===${{ env.VERSION }}

{cartography-0.98.0rc3 → cartography-0.98.0rc5}/.gitignore

@@ -18,3 +18,4 @@ build/
 generated
 dist/
 .local
+cartography/_version.py

{cartography-0.98.0rc3 → cartography-0.98.0rc5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: cartography
-Version: 0.98.0rc3
+Version: 0.98.0rc5
 Summary: Explore assets and their relationships across your technical infrastructure.
 Maintainer: Cartography Contributors
 License: apache2
@@ -29,7 +29,7 @@ Requires-Dist: dnspython>=1.15.0
 Requires-Dist: neo4j<5.0.0,>=4.4.4
 Requires-Dist: policyuniverse>=1.1.0.0
 Requires-Dist: google-api-python-client>=1.7.8
-Requires-Dist: oauth2client>=4.1.3
+Requires-Dist: google-auth>=2.37.0
 Requires-Dist: marshmallow>=3.0.0rc7
 Requires-Dist: oci>=2.71.0
 Requires-Dist: okta<1.0.0

{cartography-0.98.0rc3 → cartography-0.98.0rc5}/cartography/_version.py

@@ -12,5 +12,5 @@ __version__: str
 __version_tuple__: VERSION_TUPLE
 version_tuple: VERSION_TUPLE
 
-__version__ = version = '0.98.0rc3'
+__version__ = version = '0.98.0rc5'
 __version_tuple__ = version_tuple = (0, 98, 0)

{cartography-0.98.0rc3 → cartography-0.98.0rc5}/cartography/intel/gcp/__init__.py

@@ -7,9 +7,10 @@ from typing import Set
 
 import googleapiclient.discovery
 import neo4j
+from google.auth import default
+from google.auth.credentials import Credentials as GoogleCredentials
+from google.auth.exceptions import DefaultCredentialsError
 from googleapiclient.discovery import Resource
-from oauth2client.client import ApplicationDefaultCredentialsError
-from oauth2client.client import GoogleCredentials
 
 from cartography.config import Config
 from cartography.intel.gcp import compute
@@ -295,10 +296,9 @@ def get_gcp_credentials() -> GoogleCredentials:
     """
     try:
         # Explicitly use Application Default Credentials.
-        # See https://oauth2client.readthedocs.io/en/latest/source/
-        #             oauth2client.client.html#oauth2client.client.OAuth2Credentials
-        credentials = GoogleCredentials.get_application_default()
-    except ApplicationDefaultCredentialsError as e:
+        # See https://google-auth.readthedocs.io/en/master/user-guide.html#application-default-credentials
+        credentials, project_id = default()
+    except DefaultCredentialsError as e:
         logger.debug("Error occurred calling GoogleCredentials.get_application_default().", exc_info=True)
         logger.error(
             (

{cartography-0.98.0rc3 → cartography-0.98.0rc5}/cartography/intel/gsuite/__init__.py

@@ -5,11 +5,14 @@ import os
 from collections import namedtuple
 
 import googleapiclient.discovery
-import httplib2
 import neo4j
+from google.auth.exceptions import DefaultCredentialsError
+from google.auth.transport.requests import Request
+from google.oauth2 import credentials
+from google.oauth2 import service_account
+from google.oauth2.credentials import Credentials as OAuth2Credentials
+from google.oauth2.service_account import Credentials as ServiceAccountCredentials
 from googleapiclient.discovery import Resource
-from oauth2client.client import ApplicationDefaultCredentialsError
-from oauth2client.client import GoogleCredentials
 
 from cartography.config import Config
 from cartography.intel.gsuite import api
@@ -26,21 +29,21 @@ logger = logging.getLogger(__name__)
 Resources = namedtuple('Resources', 'admin')
 
 
-def _get_admin_resource(credentials: GoogleCredentials) -> Resource:
+def _get_admin_resource(credentials: OAuth2Credentials | ServiceAccountCredentials) -> Resource:
     """
     Instantiates a Google API resource object to call the Google API.
     Used to pull users and groups.  See https://developers.google.com/admin-sdk/directory/v1/guides/manage-users
 
-    :param credentials: The GoogleCredentials object
+    :param credentials: The credentials object
     :return: An admin api resource object
     """
     return googleapiclient.discovery.build('admin', 'directory_v1', credentials=credentials, cache_discovery=False)
 
 
-def _initialize_resources(credentials: GoogleCredentials) -> Resources:
+def _initialize_resources(credentials: OAuth2Credentials | ServiceAccountCredentials) -> Resources:
     """
     Create namedtuple of all resource objects necessary for Google API data gathering.
-    :param credentials: The GoogleCredentials object
+    :param credentials: The credentials object
     :return: namedtuple of all resource objects
     """
     return Resources(
@@ -61,14 +64,17 @@ def start_gsuite_ingestion(neo4j_session: neo4j.Session, config: Config) -> None
         "UPDATE_TAG": config.update_tag,
     }
 
+    creds: OAuth2Credentials | ServiceAccountCredentials
     if config.gsuite_auth_method == 'delegated':  # Legacy delegated method
         logger.info('Attempting to authenticate to GSuite using legacy delegated method')
         try:
-            credentials = GoogleCredentials.from_stream(config.gsuite_config)
-            credentials = credentials.create_scoped(OAUTH_SCOPE)
-            credentials = credentials.create_delegated(os.environ.get('GSUITE_DELEGATED_ADMIN'))
+            creds = service_account.Credentials.from_service_account_file(
+                config.gsuite_config,
+                scopes=OAUTH_SCOPE,
+            )
+            creds = creds.with_subject(os.environ.get('GSUITE_DELEGATED_ADMIN'))
 
-        except ApplicationDefaultCredentialsError as e:
+        except DefaultCredentialsError as e:
             logger.error(
                 (
                     "Unable to initialize GSuite creds. If you don't have GSuite data or don't want to load "
@@ -83,18 +89,18 @@ def start_gsuite_ingestion(neo4j_session: neo4j.Session, config: Config) -> None
         auth_tokens = json.loads(str(base64.b64decode(config.gsuite_config).decode()))
         logger.info('Attempting to authenticate to GSuite using OAuth')
         try:
-            credentials = GoogleCredentials(
-                None,
-                auth_tokens['client_id'],
-                auth_tokens['client_secret'],
-                auth_tokens['refresh_token'],
-                None,
-                auth_tokens['token_uri'],
-                'Cartography',
+            creds = credentials.Credentials(
+                token=None,
+                client_id=auth_tokens['client_id'],
+                client_secret=auth_tokens['client_secret'],
+                refresh_token=auth_tokens['refresh_token'],
+                expiry=None,
+                token_uri=auth_tokens['token_uri'],
+                scopes=OAUTH_SCOPE,
             )
-            credentials.refresh(httplib2.Http())
-            credentials = credentials.create_scoped(OAUTH_SCOPE)
-        except ApplicationDefaultCredentialsError as e:
+            creds.refresh(Request())
+            creds = creds.create_scoped(OAUTH_SCOPE)
+        except DefaultCredentialsError as e:
             logger.error(
                 (
                     "Unable to initialize GSuite creds. If you don't have GSuite data or don't want to load "
@@ -106,6 +112,6 @@ def start_gsuite_ingestion(neo4j_session: neo4j.Session, config: Config) -> None
             )
             return
 
-    resources = _initialize_resources(credentials)
+    resources = _initialize_resources(creds)
     api.sync_gsuite_users(neo4j_session, resources.admin, config.update_tag, common_job_parameters)
     api.sync_gsuite_groups(neo4j_session, resources.admin, config.update_tag, common_job_parameters)

{cartography-0.98.0rc3 → cartography-0.98.0rc5}/cartography.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: cartography
-Version: 0.98.0rc3
+Version: 0.98.0rc5
 Summary: Explore assets and their relationships across your technical infrastructure.
 Maintainer: Cartography Contributors
 License: apache2
@@ -29,7 +29,7 @@ Requires-Dist: dnspython>=1.15.0
 Requires-Dist: neo4j<5.0.0,>=4.4.4
 Requires-Dist: policyuniverse>=1.1.0.0
 Requires-Dist: google-api-python-client>=1.7.8
-Requires-Dist: oauth2client>=4.1.3
+Requires-Dist: google-auth>=2.37.0
 Requires-Dist: marshmallow>=3.0.0rc7
 Requires-Dist: oci>=2.71.0
 Requires-Dist: okta<1.0.0

{cartography-0.98.0rc3 → cartography-0.98.0rc5}/cartography.egg-info/requires.txt

@@ -5,7 +5,7 @@ dnspython>=1.15.0
 neo4j<5.0.0,>=4.4.4
 policyuniverse>=1.1.0.0
 google-api-python-client>=1.7.8
-oauth2client>=4.1.3
+google-auth>=2.37.0
 marshmallow>=3.0.0rc7
 oci>=2.71.0
 okta<1.0.0

{cartography-0.98.0rc3 → cartography-0.98.0rc5}/docs/root/modules/github/config.md

@@ -5,33 +5,45 @@
 Follow these steps to analyze GitHub repos and other objects with Cartography.
 
 1. Prepare your GitHub credentials.
-    1. Prepare a GitHub token; the following scopes are required, at minimum: `repo`, `read:org`, `read:user`, `user:email`
+
+    1. Make a GitHub user. Prepare a token on that user with the following scopes at minimum: `repo`, `read:org`, `read:user`, `user:email`
+
     1. GitHub ingest supports multiple endpoints, such as a public instance and an enterprise instance by taking a base64-encoded config object structured as
-       ```json
-       {
-        "organization": [
+
+        ```python
+        data = {
+          "organization": [
             {
-                "token": "faketoken",
-                "url": "https://api.github.com/graphql",
-                "name": "fakeorg"
+              "token": "faketoken",
+              "url": "https://api.github.com/graphql",
+              "name": "fakeorg",
             },
             {
-                "token": "stillfake",
-                "url": "https://github.example.com/api/graphql",
-                "name": "fakeorg"
-            }]
-       }
-       ```
+              "token": "stillfake",
+              "url": "https://github.example.com/api/graphql",
+              "name": "fakeorg",
+            }
+          ]
+        }
+        ```
+
     1. For each GitHub instance you want to ingest, generate an API token as documented in the [API reference](https://developer.github.com/v3/auth/)
+
     1. Create your auth config as shown above using the token obtained in the previous step. If you are configuring only the public GitHub instance, you can just use the first config block and delete the second. The name field is for the organization name you want to ingest.
+
     1. Base64 encode the auth object. You can encode the above sample in Python using
+
        ```python
        import json
        import base64
-       auth_json = json.dumps({"organization":[{"token":"faketoken","url":"https://api.github.com/graphql","name":"fakeorg"},{"token":"stillfake","url":"https://github.example.com/api/graphql","name":"fakeorg"}]})
+       auth_json = json.dumps(data)
        base64.b64encode(auth_json.encode())
        ```
+
        and the resulting environment variable would be ```eyJvcmdhbml6YXRpb24iOiBbeyJ0b2tlbiI6ICJmYWtldG9rZW4iLCAidXJsIjogImh0dHBzOi8vYXBpLmdpdGh1Yi5jb20vZ3JhcGhxbCIsICJuYW1lIjogImZha2VvcmcifSwgeyJ0b2tlbiI6ICJzdGlsbGZha2UiLCAidXJsIjogImh0dHBzOi8vZ2l0aHViLmV4YW1wbGUuY29tL2FwaS9ncmFwaHFsIiwgIm5hbWUiOiAiZmFrZW9yZyJ9XX0=```
+
 1. Populate an environment variable of your choice with the contents of the base64 output from the previous step.
+
 1. Call the `cartography` CLI with `--github-config-env-var YOUR_ENV_VAR_HERE`.
+
 1. `cartography` will then load your graph with data from all the organizations you specified.

{cartography-0.98.0rc3 → cartography-0.98.0rc5}/pyproject.toml

@@ -39,7 +39,7 @@ dependencies = [
     "neo4j>=4.4.4,<5.0.0",
     "policyuniverse>=1.1.0.0",
     "google-api-python-client>=1.7.8",
-    "oauth2client>=4.1.3",
+    "google-auth>=2.37.0",
     "marshmallow>=3.0.0rc7",
     "oci>=2.71.0",
     "okta<1.0.0",