devsecops-engine-tools 1.161.0__tar.gz → 1.162.0__tar.gz

{devsecops_engine_tools-1.161.0 → devsecops_engine_tools-1.162.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devsecops-engine-tools
-Version: 1.161.0
+Version: 1.162.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.161.0 → devsecops_engine_tools-1.162.0}/devsecops_engine_tools/engine_core/src/applications/runner_engine_core.py

@@ -117,6 +117,7 @@ def get_inputs_from_cli(args):
             "xray",
             "dependency_check",
             "kiuwan",
+            "cdxgen",
             "all_tools",
         ],
         type=str,
@@ -133,6 +134,7 @@ def get_inputs_from_cli(args):
             "engine_secret",
             "engine_dependencies",
             "engine_container",
+            "engine_license",
             "engine_risk",
             "engine_function",
         ],
@@ -266,6 +268,7 @@ def get_inputs_from_cli(args):
         "engine_secret": ["trufflehog", "gitleaks", "all_tools"],
         "engine_container": ["prisma", "trivy"],
         "engine_dependencies": ["xray", "dependency_check", "trivy"],
+        "engine_license": ["cdxgen"],
         "engine_code": ["bearer", "kiuwan"],
         "engine_dast": ["nuclei"],
         "engine_risk": None,

{devsecops_engine_tools-1.161.0 → devsecops_engine_tools-1.162.0}/devsecops_engine_tools/engine_core/src/domain/usecases/handle_scan.py

@@ -46,6 +46,12 @@ from devsecops_engine_tools.engine_sca.engine_container.src.applications.runner_
 from devsecops_engine_tools.engine_sca.engine_dependencies.src.applications.runner_dependencies_scan import (
     runner_engine_dependencies,
 )
+from devsecops_engine_tools.engine_sca.engine_license.src.applications.runner_license_scan import (
+    runner_engine_license,
+)
+from devsecops_engine_tools.engine_sca.engine_license.src.infrastructure.driven_adapters.license_scan.license_scan_manager import (
+    LicenseScanManager,
+)
 from devsecops_engine_tools.engine_sca.engine_function.src.applications.runner_function_scan import (
     runner_engine_function,
 )
@@ -220,6 +226,27 @@ class HandleScan:
                 config_tool, input_core, dict_args, secret_tool, env, sbom_components
             )
 
+            self.risk_score_gateway.get_risk_score(findings_list, config_tool, dict_args["module"])
+            return findings_list, input_core
+        elif "engine_license" in dict_args["module"]:
+            findings_list, input_core, _sbom_components = runner_engine_license(
+                dict_args,
+                config_tool,
+                secret_tool,
+                self.devops_platform_gateway,
+                self.remote_config_source_gateway,
+                self.sbom_tool_gateway,
+            )
+
+            self._handle_context_extraction(
+                dict_args,
+                "engine_license",
+                input_core.path_file_results,
+                config_tool["ENGINE_LICENSE"],
+                LicenseScanManager(),
+                config_tool
+            )
+
             self.risk_score_gateway.get_risk_score(findings_list, config_tool, dict_args["module"])
             return findings_list, input_core
 

{devsecops_engine_tools-1.161.0 → devsecops_engine_tools-1.162.0}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/context_extraction/context_extraction_manager.py

@@ -25,6 +25,7 @@ class ContextExtractionManager(ContextExtractionGateway):
             "engine_iac": "get_iac_context_from_results",
             "engine_container": "get_container_context_from_results",
             "engine_dependencies": "get_dependencies_context_from_results",
+            "engine_license": "get_license_context_from_results",
         }
         
         # Mapping of module names to their context output keys
@@ -32,6 +33,7 @@ class ContextExtractionManager(ContextExtractionGateway):
             "engine_iac": "iac_context",
             "engine_container": "container_context",
             "engine_dependencies": "dependencies_context",
+            "engine_license": "license_context",
         }
         
     def register_tool_gateway(self, module_name: str, tool_gateway: any):
@@ -75,7 +77,7 @@ class ContextExtractionManager(ContextExtractionGateway):
                 # Dependencies requires remote_config
                 context_list = method(path_file_results, remote_config=remote_config, **kwargs)
             else:
-                # IaC and Container only need path_file_results
+                # IaC, Container, and License only need path_file_results
                 context_list = method(path_file_results)
             
             if not context_list:
@@ -116,6 +118,9 @@ class ContextExtractionManager(ContextExtractionGateway):
             elif hasattr(context_item, 'id'):
                 # For IaC: id is a string
                 finding_id = context_item.id
+            elif hasattr(context_item, 'name'):
+                # For license: name is the identifier
+                finding_id = context_item.name
             else:
                 finding_id = "unknown"
             

devsecops_engine_tools-1.162.0/devsecops_engine_tools/engine_sca/engine_license/src/applications/runner_license_scan.py

@@ -0,0 +1,95 @@
+import json
+
+from devsecops_engine_tools.engine_core.src.domain.model.finding import (
+    Finding,
+    Category,
+)
+from devsecops_engine_tools.engine_core.src.domain.model.input_core import InputCore
+from devsecops_engine_tools.engine_core.src.domain.model.threshold import Threshold
+from devsecops_engine_tools.engine_sca.engine_license.src.infrastructure.entry_points.entry_point_tool import (
+    init_engine_license,
+)
+
+_RELEVANT_POLICIES = ("fail", "warn")
+_DEFAULT_COMPLIANCE_THRESHOLD = {"Critical": 1}
+
+def _build_findings_from_license_json(license_json_path):
+    if not license_json_path:
+        return []
+    with open(license_json_path, "r") as fh:
+        data = json.load(fh)
+    findings = []
+    for dep in data.get("dependencies", []):
+        policy = dep.get("policy_applied", "")
+        if policy not in _RELEVANT_POLICIES:
+            continue
+        name = dep.get("name", "unknown")
+        version = dep.get("version", "")
+        license_label = dep.get("license_matched") or (dep.get("licenses", []) or ["UNKNOWN"])[0]
+        findings.append(
+            Finding(
+                id=f"{license_label}-{name}",
+                cvss="",
+                where=f"{name}:{version}",
+                description=f"License '{license_label}' for package '{name}' ({dep.get('policy_reason', '')}). ",
+                severity=dep.get("severity", "info"),
+                identification_date="",
+                published_date_cve="",
+                module="engine_license",
+                category=Category.COMPLIANCE,
+                requirements="",
+                tool="CDXGEN",
+            )
+        )
+    return findings
+
+
+def runner_engine_license(
+    dict_args,
+    config_tool,
+    secret_tool,
+    devops_platform_gateway,
+    remote_config_source_gateway,
+    sbom_tool_gateway,
+):
+    """Run the engine_license standalone flow.
+
+    Produces ''{pipeline_name}_LICENSE.json''  in the CWD.
+
+    Returns:
+        Tuple ''{findings_list, input_core, sbom_components}''.
+    """
+    try:
+        license_json_path, sbom_components, remote_config = init_engine_license(
+            devops_platform_gateway,
+            remote_config_source_gateway,
+            dict_args,
+            config_tool,
+            sbom_tool_gateway,
+        )
+
+        pipeline_name = devops_platform_gateway.get_variable("pipeline_name")
+        findings_list = _build_findings_from_license_json(license_json_path)
+
+        threshold_data = (remote_config or {}).get("THRESHOLD", {})
+        input_core = InputCore(
+            totalized_exclusions=[],
+            threshold_defined=Threshold({
+                "VULNERABILITY": threshold_data.get("VULNERABILITY", {}),
+                "COMPLIANCE": threshold_data.get("COMPLIANCE", _DEFAULT_COMPLIANCE_THRESHOLD),
+            }),
+            path_file_results=license_json_path,
+            custom_message_break_build="License scan completed",
+            scope_pipeline=pipeline_name,
+            scope_service=pipeline_name,
+            stage_pipeline="Build",
+        )
+
+        return findings_list, input_core, sbom_components
+
+    except Exception as e:
+        raise Exception(f"Error SCAN engine license : {str(e)}")
+
+
+if __name__ == "__main__":
+    runner_engine_license()

devsecops_engine_tools-1.162.0/devsecops_engine_tools/engine_sca/engine_license/src/domain/model/context_license.py

@@ -0,0 +1,14 @@
+from dataclasses import dataclass, field
+from typing import List, Optional
+
+
+@dataclass
+class ContextLicense:
+    name: str
+    version: str
+    licenses: List[str]
+    policy_applied: str
+    policy_reason: str
+    policy_pattern_matched: str
+    severity: str
+    priority: Optional[str] = field(default=None)

devsecops_engine_tools-1.162.0/devsecops_engine_tools/engine_sca/engine_license/src/domain/usecases/build_license_report.py

@@ -0,0 +1,138 @@
+"""Use case that builds the LICENSE.json artifact from a CycloneDX SBOM.
+
+The output is a hybrid JSON: top-level ``metadata`` block (pipeline name,
+scan date, tool, applied policy echo, summary counts) plus a flat
+``dependencies`` array listing every package found in the SBOM with its
+license(s) and the policy decision.
+
+The artifact is written to ``{pipeline_name}_LICENSE.json`` in the chosen
+output directory (CWD by default).
+"""
+
+import copy
+import json
+import os
+from datetime import datetime
+
+from devsecops_engine_tools.engine_sca.engine_license.src.infrastructure.helpers.license_policy import (
+    build_policy_from_remote_config,
+    classify_package,
+)
+from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
+from devsecops_engine_tools.engine_utilities import settings
+
+logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
+
+TOOL = "CDXGEN"
+_SUMMARY_BUCKETS = ("ok", "fail", "warn", "unlicensed", "unknown")
+
+
+class BuildLicenseReport:
+    """Build the LICENSE.json artifact from a CycloneDX SBOM.
+
+    The ``process`` method returns the absolute path to the file it writes
+    or ``None`` when no report could be generated.
+    """
+
+    def __init__(self, output_dir: str = None):
+        self.output_dir = output_dir or os.getcwd()
+
+    def process(self, sbom_path, remote_config, pipeline_name):
+        policy = build_policy_from_remote_config(remote_config)
+        if policy is None:
+            logger.error(
+                "Cannot build LICENSE report: LICENSE_POLICY missing in remote config."
+            )
+            return None
+
+        data = self._read_sbom(sbom_path)
+        if data is None:
+            return None
+
+        dependencies = self._build_dependencies(data, policy)
+        report = {
+            "metadata": self._build_metadata(
+                pipeline_name, remote_config, dependencies
+            ),
+            "dependencies": dependencies,
+        }
+        return self._write_report(report, pipeline_name)
+
+    @staticmethod
+    def _read_sbom(sbom_path):
+        if not sbom_path:
+            logger.error("SBOM path is empty; cannot build LICENSE report.")
+            return None
+        if not os.path.exists(sbom_path):
+            logger.error(f"SBOM not found: {sbom_path}")
+            return None
+        try:
+            with open(sbom_path, "r") as fh:
+                return json.load(fh)
+        except Exception as e:
+            logger.error(f"Error reading SBOM '{sbom_path}': {e}")
+            return None
+
+    def _build_dependencies(self, data, policy):
+        components = data.get("components", [])
+        dependencies = []
+        for component in components:
+            pkg_name = component.get("name", "unknown")
+            pkg_version = component.get("version", "")
+            raw_licenses = component.get("licenses", [])
+            licenses = [
+                entry.get("license", entry) for entry in raw_licenses
+                if isinstance(entry, dict)
+            ]
+
+            classification = classify_package(licenses, policy)
+            dependencies.append(
+                {
+                    "name": pkg_name,
+                    "version": pkg_version,
+                    "licenses": classification["licenses"],
+                    "policy_applied": classification["policy_applied"],
+                    "policy_reason": classification["reason"],
+                    "policy_pattern_matched": classification[
+                        "pattern_matched"
+                    ],
+                    "license_matched": classification["label"],
+                    "severity": classification["severity"],
+                }
+            )
+        return dependencies
+
+    def _build_metadata(self, pipeline_name, remote_config, dependencies):
+        policy_used = copy.deepcopy(
+            (remote_config or {}).get("LICENSE", {}).get("LICENSE_POLICY", {})
+        )
+
+        summary = {
+            "total_dependencies": len(dependencies),
+        }
+        for bucket in _SUMMARY_BUCKETS:
+            summary[bucket] = sum(
+                1 for d in dependencies if d["policy_applied"] == bucket
+            )
+
+        return {
+            "pipeline_name": pipeline_name,
+            "scan_date": datetime.now().isoformat(timespec="seconds"),
+            "tool": TOOL,
+            "policy_used": policy_used,
+            "summary": summary,
+        }
+
+    def _write_report(self, report, pipeline_name):
+        os.makedirs(self.output_dir, exist_ok=True)
+        file_name = f"{pipeline_name}_LICENSE.json"
+        path = os.path.join(self.output_dir, file_name)
+        try:
+            with open(path, "w") as fh:
+                json.dump(report, fh, indent=2)
+            abs_path = os.path.abspath(path)
+            logger.info(f"License report saved to: {abs_path}")
+            return abs_path
+        except Exception as e:
+            logger.error(f"Error writing LICENSE report '{path}': {e}")
+            return None

devsecops_engine_tools-1.162.0/devsecops_engine_tools/engine_sca/engine_license/src/infrastructure/driven_adapters/license_scan/license_scan_manager.py

@@ -0,0 +1,34 @@
+import json
+from typing import List
+
+from devsecops_engine_tools.engine_sca.engine_license.src.domain.model.context_license import (
+    ContextLicense,
+)
+
+_RELEVANT_POLICIES = ("fail", "warn")
+
+
+class LicenseScanManager:
+    """Reads the LICENSE.json and provides context extraction for engine_license."""
+
+    def get_license_context_from_results(self, path_file_results) -> List[ContextLicense]:
+        with open(path_file_results, "r") as fh:
+            data = json.load(fh)
+
+        context_list = []
+        for dep in data.get("dependencies", []):
+            policy = dep.get("policy_applied", "unknown")
+            if policy not in _RELEVANT_POLICIES:
+                continue
+            context_list.append(
+                ContextLicense(
+                    name=dep.get("name", "unknown"),
+                    version=dep.get("version", ""),
+                    licenses=dep.get("licenses", []),
+                    policy_applied=policy,
+                    policy_reason=dep.get("policy_reason", ""),
+                    policy_pattern_matched=dep.get("policy_pattern_matched", "") or "",
+                    severity=dep.get("severity", "info"),
+                )
+            )
+        return context_list

devsecops_engine_tools-1.162.0/devsecops_engine_tools/engine_sca/engine_license/src/infrastructure/entry_points/entry_point_tool.py

@@ -0,0 +1,71 @@
+"""Entry point of the engine_license module.
+
+The flow is:
+
+    1. Generate a fresh SBOM via CdxGen.
+    2. Build the ``{pipeline_name}_LICENSE.json`` artifact directly from
+       the SBOM, applying the policy declared in remote_config.
+
+The entry point returns ``(license_json_path, sbom_components)``.
+"""
+
+import os
+
+from devsecops_engine_tools.engine_sca.engine_license.src.domain.usecases.build_license_report import (
+    BuildLicenseReport,
+)
+from devsecops_engine_tools.engine_core.src.domain.model.gateway.devops_platform_gateway import (
+    DevopsPlatformGateway,
+)
+from devsecops_engine_tools.engine_core.src.domain.model.gateway.sbom_manager import (
+    SbomManagerGateway,
+)
+from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
+from devsecops_engine_tools.engine_utilities import settings
+
+logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
+
+
+def init_engine_license(
+    devops_platform_gateway: DevopsPlatformGateway,
+    remote_config_source_gateway,
+    dict_args,
+    config_tool,
+    tool_sbom: SbomManagerGateway,
+):
+    """Run the standalone engine_license flow.
+
+    Returns a tuple ``(license_json_path, sbom_components, remote_config)``.
+    ``license_json_path``/``sbom_components`` may be ``None`` if the
+    corresponding step failed. ``remote_config`` is always the module's
+    remote config (used e.g. to build the compliance threshold).
+    """
+    remote_config = remote_config_source_gateway.get_remote_config(
+        dict_args["remote_config_repo"],
+        "engine_sca/engine_license/ConfigTool.json",
+        dict_args["remote_config_branch"],
+    )
+
+    pipeline_name = devops_platform_gateway.get_variable("pipeline_name")
+    to_scan = dict_args.get("folder_path") or os.getcwd()
+
+    if not os.path.exists(to_scan):
+        logger.error(f"Path {to_scan} does not exist; aborting license scan.")
+        return None, None, remote_config
+
+    config_sbom = config_tool.get("SBOM_MANAGER", {}) or {}
+    if tool_sbom is None:
+        logger.error("SBOM tool gateway is not configured; aborting license scan.")
+        return None, None, remote_config
+    sbom_components = tool_sbom.get_components(to_scan, config_sbom, pipeline_name)
+    sbom_path = f"{pipeline_name}_SBOM.json"
+    if not os.path.exists(sbom_path):
+        logger.error(
+            f"SBOM file {sbom_path} not found after generation; aborting license scan."
+        )
+        return None, sbom_components, remote_config
+
+    license_json_path = BuildLicenseReport().process(
+        sbom_path, remote_config, pipeline_name
+    )
+    return license_json_path, sbom_components, remote_config