coretrace-python-analyzer 0.1.0__py3-none-any.whl

coretrace_python/dependency/policy.py

@@ -0,0 +1,65 @@
+"""Dependency policies (architecture §26).
+
+A ``coretrace-policy.toml`` at the project root, or the file passed with ``--policy``,
+denies packages, requires pinned versions and lists the advisories a project accepts,
+whose findings are dropped whatever produced them.
+"""
+
+from __future__ import annotations
+
+import tomllib
+from collections.abc import Iterable
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+from coretrace_python.dependency.advisories import AdvisoryFileError
+from coretrace_python.dependency.graph import normalize
+from coretrace_python.findings import Finding
+
+POLICY_FILE = "coretrace-policy.toml"
+
+
+@dataclass(frozen=True)
+class Policy:
+    deny: tuple[str, ...] = ()
+    require_pinned: bool = False
+    ignore: tuple[str, ...] = ()
+
+    def denies(self, package: str) -> bool:
+        return normalize(package) in {normalize(name) for name in self.deny}
+
+
+def load_policy(path: Path) -> Policy:
+    try:
+        data = tomllib.loads(path.read_text(encoding="utf-8"))
+        dependencies = data.get("dependencies", {})
+        advisories = data.get("advisories", {})
+        return Policy(
+            _strings(dependencies.get("deny", []), "dependencies.deny"),
+            _boolean(dependencies.get("require_pinned", False), "dependencies.require_pinned"),
+            _strings(advisories.get("ignore", []), "advisories.ignore"),
+        )
+    except AdvisoryFileError as error:
+        raise AdvisoryFileError(f"{path}: {error}") from error
+    except (OSError, tomllib.TOMLDecodeError, AttributeError) as error:
+        raise AdvisoryFileError(f"{path}: {error}") from error
+
+
+def _strings(value: Any, key: str) -> tuple[str, ...]:
+    if not isinstance(value, list) or not all(isinstance(item, str) for item in value):
+        raise AdvisoryFileError(f"{key} must be a list of strings")
+    return tuple(value)
+
+
+def _boolean(value: Any, key: str) -> bool:
+    if not isinstance(value, bool):
+        raise AdvisoryFileError(f"{key} must be true or false")
+    return value
+
+
+def apply_policy(policy: Policy, findings: Iterable[Finding]) -> tuple[Finding, ...]:
+    """The findings minus those about an advisory the policy accepts."""
+
+    ignored = set(policy.ignore)
+    return tuple(f for f in findings if f.metadata.get("advisory") not in ignored)

coretrace_python/dependency/sbom.py

@@ -0,0 +1,65 @@
+"""CycloneDX software bill of materials from the dependency graph (architecture §26)."""
+
+from __future__ import annotations
+
+import json
+from collections.abc import Iterable
+
+from coretrace_python.dependency.graph import Advisory, DependencyGraph, Requirement
+
+SPEC_VERSION = "1.5"
+
+
+def purl(requirement: Requirement) -> str:
+    base = f"pkg:pypi/{requirement.name}"
+    if requirement.pinned is None:
+        return base
+    return f"{base}@{'.'.join(str(part) for part in requirement.pinned.parts)}"
+
+
+def _component(requirement: Requirement) -> dict[str, object]:
+    reference = purl(requirement)
+    component: dict[str, object] = {"type": "library", "bom-ref": reference, "name": requirement.name}
+    if requirement.pinned is not None:
+        component["version"] = ".".join(str(part) for part in requirement.pinned.parts)
+    component["purl"] = reference
+    properties: list[dict[str, str]] = []
+    if requirement.specifier:
+        properties.append({"name": "coretrace:specifier", "value": requirement.specifier})
+    if requirement.optional:
+        properties.append({"name": "coretrace:optional", "value": "true"})
+    if properties:
+        component["properties"] = properties
+    return component
+
+
+def render_sbom(
+    dependencies: DependencyGraph, advisories: Iterable[Advisory], tool_name: str, tool_version: str
+) -> str:
+    """A CycloneDX JSON document: one component per requirement, and the advisories
+    affecting them as vulnerabilities. Deterministic for a given graph."""
+
+    requirements = dependencies.requirements
+    vulnerabilities: list[dict[str, object]] = []
+    for advisory in sorted(advisories, key=lambda a: a.id):
+        affected = [purl(r) for r in requirements if advisory.affects(r)]
+        if affected:
+            vulnerabilities.append(
+                {
+                    "id": advisory.id,
+                    "description": advisory.summary,
+                    "ratings": [{"severity": advisory.severity.value}],
+                    "affects": [{"ref": reference} for reference in affected],
+                }
+            )
+    document = {
+        "bomFormat": "CycloneDX",
+        "specVersion": SPEC_VERSION,
+        "version": 1,
+        "metadata": {
+            "tools": {"components": [{"type": "application", "name": tool_name, "version": tool_version}]}
+        },
+        "components": [_component(requirement) for requirement in requirements],
+        "vulnerabilities": vulnerabilities,
+    }
+    return json.dumps(document, indent=2) + "\n"