cloudsmith-cli 1.20.0__py3-none-any.whl

cloudsmith_cli/core/api/version.py

@@ -0,0 +1,15 @@
+"""API version utilities."""
+
+import importlib.metadata
+
+import semver
+
+
+def get_version():
+    """Get the raw/unparsed version of the API as a string."""
+    return importlib.metadata.version("cloudsmith_api")
+
+
+def get_version_info():
+    """Get the API version as VersionInfo object."""
+    return semver.parse_version_info(get_version())

cloudsmith_cli/core/api/vulnerabilities.py

@@ -0,0 +1,230 @@
+"""API - Vulnerabilities endpoints."""
+
+import click
+import cloudsmith_api
+
+from ...cli import utils
+from .. import ratelimits
+from .exceptions import catch_raise_api_exception
+from .init import get_api_client
+
+
+def get_vulnerabilities_api():
+    """Get the vulnerabilities API client."""
+    return get_api_client(cloudsmith_api.VulnerabilitiesApi)
+
+
+def _print_vulnerabilities_summary_table(data, severity_filter, total_filtered_vulns):
+    """Print vulnerabilities as a table."""
+
+    severity_keys = {
+        "Critical": "critical",
+        "High": "high",
+        "Medium": "medium",
+        "Low": "low",
+        "Unknown": "unknown",
+    }
+
+    if severity_filter:
+        allowed = [s.strip().lower() for s in severity_filter.split(",")]
+        severity_keys = {k: v for k, v in severity_keys.items() if v in allowed}
+
+    headers = [{"header": "Package", "justify": "left", "style": "cyan"}]
+    for key in severity_keys.keys():
+        headers.append({"header": key, "justify": "center", "style": "white"})
+
+    # Get package name and version for the target label
+    pkg_data = getattr(data, "package", None)
+    pkg_name = getattr(pkg_data, "name", "Unknown")
+    pkg_version = getattr(pkg_data, "version", "Unknown")
+    target_label = f"{pkg_name}:{pkg_version}"
+
+    # Initialize aggregate counts
+    counts = {v: 0 for v in severity_keys.values()}
+
+    # Parse the scans and aggregate results
+    scans = getattr(data, "scans", [])
+    for scan in scans:
+        results = getattr(scan, "results", [])
+        for result in results:
+            severity = getattr(result, "severity", "unknown").lower()
+            if severity in counts:
+                counts[severity] += 1
+            elif "unknown" in counts:
+                counts["unknown"] += 1
+
+    # Create the single summary row
+    row = [target_label]
+    for _header, key in severity_keys.items():
+        row.append(str(counts[key]))
+
+    rows = [row]
+
+    click.echo()
+    click.echo()
+
+    utils.rich_print_table(headers=headers, rows=rows, title="Vulnerabilities Summary")
+
+    if severity_filter:
+        filters = severity_filter.upper()
+        click.echo(
+            f"\nTotal Vulnerabilities: {getattr(data, 'num_vulnerabilities', 0)}"
+        )
+        click.echo(f"\nTotal {filters} Vulnerabilities: {total_filtered_vulns}")
+    else:
+        click.echo(
+            f"\nTotal Vulnerabilities: {getattr(data, 'num_vulnerabilities', 0)}"
+        )
+    click.echo()
+
+
+def _print_vulnerabilities_assessment_table(data, severity_filter=None):
+    """Print vulnerabilities assessment as a table."""
+
+    # Group vulnerabilities by package
+    grouped_vulns = {}
+
+    allowed_severities = None
+    if severity_filter:
+        allowed_severities = [s.strip().lower() for s in severity_filter.split(",")]
+
+    # Get top level package info as fallback
+    pkg_data = getattr(data, "package", None)
+    top_pkg_name = getattr(pkg_data, "name", "Unknown")
+
+    # Get scan data
+    scans = getattr(data, "scans", [])
+    for scan in scans:
+        results = getattr(scan, "results", [])
+        for result in results:
+            # Filter by severity if requested
+            if allowed_severities:
+                severity = getattr(result, "severity", "unknown").lower()
+                if severity not in allowed_severities:
+                    continue
+
+            pkg_name = getattr(result, "package_name", top_pkg_name)
+            if pkg_name not in grouped_vulns:
+                grouped_vulns[pkg_name] = []
+            grouped_vulns[pkg_name].append(result)
+
+    if not grouped_vulns:
+        click.echo("\nNo vulnerabilities found matching criteria.")
+        return
+
+    # Severity mapping for sorting
+    sev_map = {"critical": 0, "high": 1, "medium": 2, "low": 3, "unknown": 4}
+
+    # Iterate through sorted packages
+    for pkg_name in sorted(grouped_vulns.keys()):
+        vulns = grouped_vulns[pkg_name]
+
+        # Sort vulns by severity (Critical first)
+        vulns.sort(
+            key=lambda r: sev_map.get(getattr(r, "severity", "unknown").lower(), 99)
+        )
+
+        rows = []
+        for result in vulns:
+            # Severity
+            severity = getattr(result, "severity", "Unknown").title()
+            severity_style = "white"
+            s = severity.lower()
+            if s == "critical":
+                severity_style = "red bold"
+            elif s == "high":
+                severity_style = "red"
+            elif s == "medium":
+                severity_style = "yellow"
+            elif s == "low":
+                severity_style = "blue"
+
+            # ID
+            vuln_id = getattr(
+                result, "vulnerability_id", getattr(result, "identifier", "Unknown")
+            )
+
+            # Affected Version
+            affected_raw = getattr(
+                result, "affected_version", getattr(result, "affected_version", None)
+            )
+            if hasattr(affected_raw, "version"):
+                aff_version = affected_raw.version
+                affected_operator = affected_raw.operator
+                affected_version = f"{affected_operator} {aff_version}"
+            else:
+                affected_version = str(affected_raw) if affected_raw else "-"
+
+            # Fixed Version
+            fixed_raw = getattr(
+                result, "fix_version", getattr(result, "fixed_version", None)
+            )
+            if hasattr(fixed_raw, "version"):
+                fix_version = fixed_raw.version
+                fixed_operator = fixed_raw.operator
+                fixed_version = f"{fixed_operator} {fix_version}"
+            else:
+                fixed_version = str(fixed_raw) if fixed_raw else "-"
+
+            # Title / Description
+            title = getattr(result, "title", "")
+
+            rows.append(
+                [
+                    f"[{severity_style}]{severity}[/{severity_style}]",
+                    vuln_id,
+                    affected_version,
+                    fixed_version,
+                    title,
+                ]
+            )
+
+        click.echo()
+        utils.rich_print_table(
+            headers=[
+                "Severity",
+                "Vulnerability",
+                "Affected Version",
+                "Fixed Version",
+                "Title",
+            ],
+            rows=rows,
+            title=f"Package: {pkg_name}",
+            show_lines=True,
+        )
+    click.echo()
+
+
+def get_package_scan_identifier(owner, repo, package):
+    """Get the scan identifier using the package identifier"""
+    client = get_vulnerabilities_api()
+
+    with catch_raise_api_exception():
+        data, _, headers = client.vulnerabilities_package_list_with_http_info(
+            owner=owner, repo=repo, package=package
+        )
+
+    ratelimits.maybe_rate_limit(client, headers)
+
+    return data[0].identifier
+
+
+def get_package_scan_result(
+    opts, owner, repo, package, show_assessment, fixable, severity_filter
+):
+    """Get the package vulnerability scan result."""
+    client = get_vulnerabilities_api()
+
+    with catch_raise_api_exception():
+        scan_identifier = get_package_scan_identifier(
+            owner=owner, repo=repo, package=package
+        )
+
+    with catch_raise_api_exception():
+        data, _, headers = client.vulnerabilities_read_with_http_info(
+            owner=owner, repo=repo, package=package, identifier=scan_identifier
+        )
+
+    ratelimits.maybe_rate_limit(client, headers)
+
+    return data

cloudsmith_cli/core/cache_utils.py

@@ -0,0 +1,160 @@
+# Copyright 2026 Cloudsmith Ltd
+"""Shared utilities for on-disk credential and cache storage."""
+
+from __future__ import annotations
+
+import json
+import os
+import tempfile
+from collections.abc import Callable
+from typing import Any
+
+
+def _atomic_write_text(dest: str, text: str, *, mode: int = 0o600) -> None:
+    """Atomically write *text* to *dest* using a sibling temp file.
+
+    Caller is responsible for ensuring the parent directory exists.
+    """
+    parent = os.path.dirname(dest) or "."
+    tmp_fd, tmp_path = tempfile.mkstemp(dir=parent, prefix=".tmp_", suffix=".json")
+    try:
+        with os.fdopen(tmp_fd, "w", encoding="utf-8") as f:
+            f.write(text)
+            f.flush()
+            os.fsync(f.fileno())
+        os.chmod(tmp_path, mode)
+        os.replace(tmp_path, dest)
+    except (OSError, TypeError, ValueError):
+        try:
+            os.unlink(tmp_path)
+        except OSError:
+            pass
+        raise
+
+
+def atomic_write_json(path: str | os.PathLike, data: Any, *, mode: int = 0o600) -> None:
+    """Atomically write JSON to a file with restrictive permissions.
+
+    Writes to a sibling temp file, fsyncs, sets mode, then renames over the
+    destination. Concurrent readers never see a partial file. Temp file is
+    removed on error. Caller is responsible for ensuring the parent directory
+    exists.
+    """
+    dest = os.fspath(path)
+    _atomic_write_text(dest, json.dumps(data), mode=mode)
+
+
+def merge_json_file(
+    path: str | os.PathLike,
+    mutate: Callable[[dict], None],
+    *,
+    backup: bool = True,
+    dry_run: bool = False,
+    mode: int = 0o600,
+) -> bool:
+    """Read a JSON object file, apply *mutate* in place, and atomically write it back.
+
+    Parameters
+    ----------
+    path:
+        Path to the JSON file (e.g. ``~/.docker/config.json``).
+    mutate:
+        Callable that receives the loaded ``dict`` and modifies it in place.
+        It must not return a value; changes are applied to the dict directly.
+    backup:
+        When ``True`` (default) and the file already existed and content will
+        change, copy the prior file to ``{path}.bak`` before writing.
+    dry_run:
+        When ``True``, perform the read + mutate + change-detection but make
+        **no** writes (no temp file, no ``.bak``, no replace).
+    mode:
+        File-permission bits for the written file (default ``0o600``).
+
+    Returns
+    -------
+    bool
+        ``True`` if the file content changed (or would change under
+        ``dry_run``), ``False`` otherwise.
+
+    Notes
+    -----
+    * If the file is missing, empty, or does not parse as a JSON object
+      (``dict``), the starting value is ``{}``.
+    * Key order is preserved — ``sort_keys`` is **not** used.
+    * The on-disk form is ``json.dumps(data, indent=2, ensure_ascii=False) + "\\n"``.
+    * Parent directory is created (mode ``0o700``) if absent.
+
+    Concurrency
+    -----------
+    This is a single-writer, install-time helper (used by
+    ``credential-helper install/uninstall``).  The read-modify-write is
+    last-writer-wins and is **NOT** safe against concurrent writers mutating
+    the same file; do not use it on a hot path.  The atomic replace guarantees
+    the file is never left partially written, but concurrent merges can drop
+    each other's changes.
+    """
+    dest = os.fspath(path)
+
+    # ------------------------------------------------------------------
+    # 1. Read existing content
+    # ------------------------------------------------------------------
+    existing_text: str | None = None
+    try:
+        with open(dest, encoding="utf-8") as f:
+            existing_text = f.read()
+    except FileNotFoundError:
+        existing_text = None
+
+    # ------------------------------------------------------------------
+    # 2. Parse → dict (treat missing/empty/non-dict/malformed as {})
+    # ------------------------------------------------------------------
+    data: dict = {}
+    if existing_text:
+        try:
+            parsed = json.loads(existing_text)
+            if isinstance(parsed, dict):
+                data = parsed
+        except (json.JSONDecodeError, ValueError):
+            pass
+
+    # ------------------------------------------------------------------
+    # 3. Mutate in place
+    # ------------------------------------------------------------------
+    mutate(data)
+
+    # ------------------------------------------------------------------
+    # 4. Stable serialisation + change detection
+    # ------------------------------------------------------------------
+    new_text = json.dumps(data, indent=2, ensure_ascii=False) + "\n"
+
+    if existing_text is not None:
+        # Normalise existing content for comparison: if the file already has
+        # the exact canonical form we produce, treat as no-change.
+        no_change = new_text == existing_text
+    else:
+        no_change = False  # file didn't exist → always a change
+
+    if no_change:
+        return False
+
+    if dry_run:
+        return True
+
+    # ------------------------------------------------------------------
+    # 5. Ensure parent directory exists
+    # ------------------------------------------------------------------
+    parent = os.path.dirname(dest) or "."
+    os.makedirs(parent, mode=0o700, exist_ok=True)
+
+    # ------------------------------------------------------------------
+    # 6. Backup (only when file existed and content changes)
+    # ------------------------------------------------------------------
+    if backup and existing_text is not None:
+        _atomic_write_text(dest + ".bak", existing_text, mode=0o600)
+
+    # ------------------------------------------------------------------
+    # 7. Atomic write
+    # ------------------------------------------------------------------
+    _atomic_write_text(dest, new_text, mode=mode)
+
+    return True

cloudsmith_cli/core/config.py

@@ -0,0 +1,140 @@
+import collections
+import stat
+
+import click
+
+from .utils import get_help_website
+
+ConfigValues = collections.namedtuple(
+    "ConfigValues", ["reader", "present", "mode", "data"]
+)
+
+
+def create_config_files(ctx, opts, api_key, force=False):
+    """Create default config files."""
+    # pylint: disable=unused-argument
+    config_reader = opts.get_config_reader()
+    creds_reader = opts.get_creds_reader()
+    has_config = config_reader.has_default_file()
+    has_creds = creds_reader.has_default_file()
+
+    if has_config and has_creds:
+        create = False
+    else:
+        click.echo()
+        if not force:
+            create = click.confirm(
+                "No default config file(s) found, do you want to create them?"
+            )
+        else:
+            create = "y"
+
+    click.echo()
+    if not create:
+        click.secho(
+            "For reference here are your default config file locations:", fg="yellow"
+        )
+    else:
+        click.secho(
+            "Great! Let me just create your default configs for you now ...", fg="green"
+        )
+
+    configs = (
+        ConfigValues(reader=config_reader, present=has_config, mode=None, data={}),
+        ConfigValues(
+            reader=creds_reader,
+            present=has_creds,
+            mode=stat.S_IRUSR | stat.S_IWUSR | stat.S_IRGRP | stat.S_IWGRP,
+            data={"api_key": api_key},
+        ),
+    )
+
+    has_errors = False
+    for config in configs:
+        click.echo(
+            "%(name)s config file: %(filepath)s ... "
+            % {
+                "name": click.style(config.reader.config_name.capitalize(), bold=True),
+                "filepath": click.style(
+                    config.reader.get_default_filepath(), fg="magenta"
+                ),
+            },
+            nl=False,
+        )
+
+        if not config.present and create:
+            try:
+                ok = config.reader.create_default_file(
+                    data=config.data, mode=config.mode
+                )
+            except OSError as exc:
+                ok = False
+                error_message = exc.strerror
+                has_errors = True
+
+            if ok:
+                click.secho("CREATED", fg="green")
+            else:
+                click.secho("ERROR", fg="red")
+                click.secho(
+                    "The following error occurred while trying to "
+                    "create the file: %(message)s"
+                    % {"message": click.style(error_message, fg="red")}
+                )
+            continue
+
+        # Update existing credentials file with new API key if provided
+        if (
+            config.present
+            and config.data.get("api_key")
+            and hasattr(config.reader, "update_api_key")
+        ):
+            try:
+                config.reader.update_api_key(
+                    config.reader.get_default_filepath(),
+                    config.data["api_key"],
+                )
+                click.secho("UPDATED", fg="green")
+            except OSError as exc:
+                has_errors = True
+                click.secho("ERROR", fg="red")
+                click.secho(
+                    "The following error occurred while trying to "
+                    "update the file: %(message)s"
+                    % {"message": click.style(exc.strerror, fg="red")}
+                )
+            continue
+
+        click.secho("EXISTS" if config.present else "NOT CREATED", fg="yellow")
+
+    return create, has_errors
+
+
+def new_config_messaging(has_errors, opts, create, api_key):
+    """Provide messaging to user after generating new configs"""
+    if has_errors:
+        click.echo()
+        click.secho("Oops, please fix the errors and try again!", fg="red")
+        return
+
+    if opts.api_key != api_key:
+        click.echo()
+        if opts.api_key:
+            click.secho(
+                "Note: The above API key doesn't match what you have in "
+                "your default credentials config file.",
+                fg="yellow",
+            )
+        elif not create:
+            click.secho(
+                "Note: Don't forget to put your API key in a config file, "
+                "export it on the environment, or set it via -k.",
+                fg="yellow",
+            )
+            click.secho(
+                "If you need more help please see the documentation: "
+                "%(website)s" % {"website": click.style(get_help_website(), bold=True)}
+            )
+        click.echo()
+
+    click.secho("You're ready to rock, let's start automating!", fg="green")

cloudsmith_cli/core/credentials/chain.py

@@ -0,0 +1,69 @@
+"""Credential provider chain for the Cloudsmith CLI.
+
+Implements an AWS SDK-style credential resolution chain that evaluates
+credential sources sequentially and returns the first valid result.
+"""
+
+from __future__ import annotations
+
+import logging
+
+from .models import CredentialContext, CredentialResult
+from .provider import CredentialProvider
+from .providers import (
+    CLIFlagProvider,
+    CredentialsFileProvider,
+    EnvVarProvider,
+    KeyringProvider,
+    OidcProvider,
+)
+
+logger = logging.getLogger(__name__)
+
+
+class CredentialProviderChain:
+    """Evaluates credential providers in order, returning the first valid result.
+
+    If no providers are given, uses the default chain:
+    CLIFlag → EnvVar → CredentialsFile → Keyring → OIDC.
+    """
+
+    def __init__(self, providers: list[CredentialProvider] | None = None):
+        if providers is not None:
+            self.providers = providers
+        else:
+            self.providers = [
+                CLIFlagProvider(),
+                EnvVarProvider(),
+                CredentialsFileProvider(),
+                KeyringProvider(),
+                OidcProvider(),
+            ]
+
+    def resolve(self, context: CredentialContext) -> CredentialResult | None:
+        """Evaluate each provider in order. Return the first successful result."""
+        for provider in self.providers:
+            try:
+                result = provider.resolve(context)
+                if result is not None:
+                    if context.debug:
+                        logger.debug(
+                            "Credentials resolved by %s: %s",
+                            provider.name,
+                            result.source_detail or result.source_name,
+                        )
+                    return result
+                if context.debug:
+                    logger.debug(
+                        "Provider %s did not resolve credentials, trying next",
+                        provider.name,
+                    )
+            except Exception:  # pylint: disable=broad-exception-caught
+                # Intentionally broad - one provider failing shouldn't stop others
+                logger.debug(
+                    "Provider %s raised an exception, skipping",
+                    provider.name,
+                    exc_info=True,
+                )
+                continue
+        return None

cloudsmith_cli/core/credentials/models.py

@@ -0,0 +1,44 @@
+"""Credential data models for the Cloudsmith CLI."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Literal
+
+import requests
+
+
+@dataclass
+class CredentialContext:
+    """Context passed to credential providers during resolution.
+
+    Separate per-source fields allow the chain to evaluate sources in priority
+    order without conflating them. Populated from Click options in
+    ``resolve_credentials``.
+    """
+
+    session: requests.Session | None = None
+    api_key_from_flag: str | None = None
+    api_key_from_env: str | None = None
+    api_key_from_file: str | None = None
+    api_host: str = "https://api.cloudsmith.io"
+    creds_file_path: str | None = None
+    profile: str | None = None
+    debug: bool = False
+    keyring_refresh_failed: bool = False
+    oidc_audience: str | None = None
+    oidc_org: str | None = None
+    oidc_service_slug: str | None = None
+    oidc_discovery_disabled: bool = False
+    oidc_detector_order: str | None = None
+    oidc_disabled_detectors: frozenset[str] = frozenset()
+
+
+@dataclass
+class CredentialResult:
+    """Result from a successful credential resolution."""
+
+    api_key: str
+    source_name: str
+    source_detail: str | None = None
+    auth_type: Literal["api_key", "bearer"] = "api_key"

cloudsmith_cli/core/credentials/oidc/__init__.py

@@ -0,0 +1,6 @@
+"""OIDC support for the Cloudsmith CLI credential chain.
+
+References:
+    https://help.cloudsmith.io/docs/openid-connect
+    https://cloudsmith.com/blog/securely-connect-cloudsmith-to-your-cicd-using-oidc-authentication
+"""