devsecops-engine-tools 1.171.0__tar.gz → 1.173.0__tar.gz

{devsecops_engine_tools-1.171.0 → devsecops_engine_tools-1.173.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devsecops-engine-tools
-Version: 1.171.0
+Version: 1.173.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.171.0 → devsecops_engine_tools-1.173.0}/devsecops_engine_tools/engine_core/src/applications/runner_engine_core.py

@@ -149,6 +149,14 @@ def get_inputs_from_cli(args):
         required=False,
         help="Folder Path to scan, only apply engine_iac, engine_code, engine_secret and engine_dependencies tools",
     )
+    parser.add_argument(
+        "--generate_sbom_only",
+        choices=["true", "false"],
+        type=str,
+        required=False,
+        default="false",
+        help="Generate the dependencies SBOM without scanning it. Only applies to engine_dependencies.",
+    )
     parser.add_argument(
         "-tr",
         "--terraform_repo_root",
@@ -263,6 +271,15 @@ def get_inputs_from_cli(args):
         required=False,
         help="Address of the Docker daemon to connect to."
     )
+    parser.add_argument(
+        "--excepted_checks",
+        type=str,
+        required=False,
+        default="",
+        help="Comma-separated list of check ids already excepted for this execution, they are treated as \
+        soft-fail: the findings are reported but do not break the build. Only applies to engine_iac. \
+        Ej: CKV_AWS_18,CKV_AWS_21",
+    )
     TOOLS = {
         "engine_iac": ["checkov", "kics", "kubescape", "conftest"],
         "engine_secret": ["trufflehog", "gitleaks", "all_tools"],
@@ -292,6 +309,7 @@ def get_inputs_from_cli(args):
         "tool": args.tool,
         "module": args.module,
         "folder_path": args.folder_path,
+        "generate_sbom_only": args.generate_sbom_only,
         "terraform_repo_root": args.terraform_repo_root,
         "platform": args.platform,
         "use_secrets_manager": args.use_secrets_manager,
@@ -310,6 +328,7 @@ def get_inputs_from_cli(args):
         "dast_file_path": args.dast_file_path,
         "context": args.context,
         "docker_address": args.docker_address,
+        "excepted_checks": args.excepted_checks,
     }
 
 

{devsecops_engine_tools-1.171.0 → devsecops_engine_tools-1.173.0}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/defect_dojo/defect_dojo.py

@@ -17,6 +17,7 @@ from devsecops_engine_tools.engine_utilities.defect_dojo import (
     Product,
     Component,
     FindingExclusion,
+    LongRiskAcceptance,
 )
 from devsecops_engine_tools.engine_core.src.domain.model.exclusions import Exclusions
 from devsecops_engine_tools.engine_core.src.domain.model.report import Report
@@ -49,6 +50,7 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
     FALSE_POSITIVE = "False Positive"
     TRANSFERRED_FINDING = "Transferred Finding"
     ON_WHITELIST = "On Whitelist"
+    LONG_TERM_RISK_ACCEPTANCE_TAG = "long_term_risk_acceptance"
 
     enviroment_mapping: Dict[str, str] = field(default_factory=lambda: {
         "dev": "Development",
@@ -83,6 +85,11 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
         }
     })
 
+    # memoizes the long-term risk acceptance object per service to avoid duplicate API calls
+    _long_risk_acceptance_cache: Dict[str, object] = field(
+        default_factory=dict, init=False, repr=False
+    )
+
     def send_vulnerability_management(
         self, vulnerability_management: VulnerabilityManagement
     ):
@@ -330,6 +337,14 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                 "fields": "id,vuln_id_from_tool,vulnerability_ids,severity,priority_classification,endpoints,component_name,component_version,tags,file_path"
             }
 
+            long_term_risk_acceptance_lookup = partial(
+                self._get_long_risk_acceptance,
+                service,
+                dict_args,
+                secret_tool,
+                config_tool,
+            )
+
             exclusions_risk_accepted = self._get_findings_with_exclusions(
                 session_manager,
                 service,
@@ -338,6 +353,7 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                 tool,
                 self._format_date_to_dd_format,
                 self.RISK_ACCEPTED,
+                long_term_risk_acceptance_lookup=long_term_risk_acceptance_lookup,
             )
 
             exclusions_false_positive = self._get_findings_with_exclusions(
@@ -447,11 +463,20 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                 },
             )
 
+            long_term_risk_acceptance_lookup = partial(
+                self._get_long_risk_acceptance,
+                service,
+                dict_args,
+                secret_tool,
+                config_tool,
+            )
+
             all_exclusions = self._get_report_exclusions(
                 all_findings,
                 self._format_date_to_dd_format,
                 host_dd=host_dd,
                 white_list=white_list,
+                long_term_risk_acceptance_lookup=long_term_risk_acceptance_lookup,
             )
 
             return all_findings, all_exclusions
@@ -699,6 +724,37 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
         )
         return session_manager
 
+    def _get_long_risk_acceptance(self, service, dict_args, secret_tool, config_tool):
+        if service in self._long_risk_acceptance_cache:
+            return self._long_risk_acceptance_cache[service]
+
+        long_risk_acceptance = None
+        engagements = self.get_active_engagements(
+            service, dict_args, secret_tool, config_tool
+        )
+        engagement = next((e for e in engagements if e.name == service), None)
+
+        if engagement and engagement.long_risk_acceptances:
+            session_manager = self._get_session_manager(
+                dict_args, secret_tool, config_tool
+            )
+            max_retries = config_tool["VULNERABILITY_MANAGER"]["DEFECT_DOJO"][
+                "MAX_RETRIES_QUERY"
+            ]
+
+            def request_func():
+                return LongRiskAcceptance.get_long_risk_acceptance(
+                    session=session_manager,
+                    long_risk_acceptance_id=engagement.long_risk_acceptances,
+                )
+
+            long_risk_acceptance = Utils().retries_requests(
+                request_func, max_retries, retry_delay=5
+            )
+
+        self._long_risk_acceptance_cache[service] = long_risk_acceptance
+        return long_risk_acceptance
+
     def _get_report_exclusions(self, total_findings, date_fn, host_dd, **kwargs):
         exclusions = []
         for finding in total_findings:
@@ -801,6 +857,29 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
 
         return Utils().retries_requests(request_func, max_retries, retry_delay=5)
 
+    def _long_term_risk_acceptance_for_finding(self, finding, long_term_risk_acceptance_lookup):
+        if long_term_risk_acceptance_lookup and self.LONG_TERM_RISK_ACCEPTANCE_TAG in (
+            finding.tags or []
+        ):
+            return long_term_risk_acceptance_lookup()
+        return None
+
+    def _risk_accepted_expiration_date(self, finding, date_fn, long_term_risk_acceptance_lookup):
+        long_risk_acceptance = self._long_term_risk_acceptance_for_finding(
+            finding, long_term_risk_acceptance_lookup
+        )
+        if long_risk_acceptance:
+            return date_fn(long_risk_acceptance.expiration_date)
+        return date_fn(finding.accepted_risks[-1]["expiration_date"])
+
+    def _risk_accepted_created_date(self, finding, date_fn, long_term_risk_acceptance_lookup):
+        long_risk_acceptance = self._long_term_risk_acceptance_for_finding(
+            finding, long_term_risk_acceptance_lookup
+        )
+        if long_risk_acceptance:
+            return date_fn(long_risk_acceptance.created)
+        return date_fn(finding.accepted_risks[-1]["created"])
+
     def _date_reason_based(self, finding, date_fn, reason, tool, **kwargs):
         def get_vuln_id(finding, tool):
             if tool == "engine_risk":
@@ -839,8 +918,12 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                     date_fn(finding.transfer_finding.expiration_date),
                 ),
                 self.RISK_ACCEPTED: lambda: (
-                    date_fn(finding.accepted_risks[-1]["created"]),
-                    date_fn(finding.accepted_risks[-1]["expiration_date"]),
+                    self._risk_accepted_created_date(
+                        finding, date_fn, kwargs.get("long_term_risk_acceptance_lookup")
+                    ),
+                    self._risk_accepted_expiration_date(
+                        finding, date_fn, kwargs.get("long_term_risk_acceptance_lookup")
+                    ),
                 ),
                 self.ON_WHITELIST: lambda: get_dates_from_whitelist(
                     get_vuln_id(finding, tool), kwargs.get("white_list", [])

{devsecops_engine_tools-1.171.0 → devsecops_engine_tools-1.173.0}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/printer_pretty_table/printer_pretty_table.py

@@ -10,7 +10,7 @@ from devsecops_engine_tools.engine_core.src.domain.model.report import (
     Report,
 )
 from devsecops_engine_tools.engine_core.src.infrastructure.helpers.util import (
-    format_date,
+    format_optional_date,
     format_expired_date,
 )
 from prettytable import PrettyTable, DOUBLE_BORDER
@@ -120,7 +120,7 @@ class PrinterPrettyTable(PrinterTableGateway):
                     self._check_spaces(exclusion["vm_id"]),
                     self._check_spaces(exclusion["service"]),
                     ", ".join(exclusion["tags"]),
-                    format_date(exclusion["create_date"], "%d%m%Y", "%d/%m/%Y"),
+                    format_optional_date(exclusion["create_date"]),
                     format_expired_date(exclusion["expired_date"]),
                     exclusion["reason"],
                 ]
@@ -163,7 +163,7 @@ class PrinterPrettyTable(PrinterTableGateway):
                     exclusion["severity"],
                     exclusion["id"],
                     exclusion["where"],
-                    format_date(exclusion["create_date"], "%d%m%Y", "%d/%m/%Y"),
+                    format_optional_date(exclusion["create_date"]),
                     format_expired_date(exclusion["expired_date"]),
                     exclusion["reason"],
                 ]

{devsecops_engine_tools-1.171.0 → devsecops_engine_tools-1.173.0}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/printer_rich_table/printer_rich_table.py

@@ -10,7 +10,7 @@ from devsecops_engine_tools.engine_core.src.domain.model.report import (
     Report,
 )
 from devsecops_engine_tools.engine_core.src.infrastructure.helpers.util import (
-    format_date,
+    format_optional_date,
     format_expired_date,
 )
 from rich.console import Console
@@ -64,7 +64,7 @@ class PrinterRichTable(PrinterTableGateway):
                     self._check_spaces(exclusion["vm_id"], exclusion["vm_id_url"]),
                     ", ".join(exclusion["tags"]),
                     exclusion["service"],
-                    format_date(exclusion["create_date"], "%d%m%Y", "%d/%m/%Y"),
+                    format_optional_date(exclusion["create_date"]),
                     format_expired_date(exclusion["expired_date"]),
                     exclusion["reason"],
                 ]
@@ -87,7 +87,7 @@ class PrinterRichTable(PrinterTableGateway):
                     self._check_spaces(exclusion["vm_id"], exclusion["vm_id_url"]),
                     exclusion.get("service", ""),
                     ", ".join(exclusion["tags"]),
-                    format_date(exclusion["create_date"], "%d%m%Y", "%d/%m/%Y"),
+                    format_optional_date(exclusion["create_date"]),
                     format_expired_date(exclusion["expired_date"]),
                     exclusion["reason"],
                 ]

{devsecops_engine_tools-1.171.0 → devsecops_engine_tools-1.173.0}/devsecops_engine_tools/engine_core/src/infrastructure/helpers/util.py

@@ -5,12 +5,21 @@ def format_date(date, to_format, from_format):
     return datetime.strptime(date, to_format).strftime(from_format)
 
 
-def format_expired_date(expired_date, input_format="%d%m%Y", output_format="%d/%m/%Y"):
-    if expired_date and expired_date != "undefined":
-        return format_date(expired_date, input_format, output_format)
+def format_optional_date(date, input_format="%d%m%Y", output_format="%d/%m/%Y"):
+    """
+    Formats a date that may not be defined. Exclusions can legitimately come without
+    dates (the Exclusions model defaults them to an empty string), so rendering them
+    must not fail.
+    """
+    if date and date != "undefined":
+        return format_date(date, input_format, output_format)
     return "NA"
 
 
+def format_expired_date(expired_date, input_format="%d%m%Y", output_format="%d/%m/%Y"):
+    return format_optional_date(expired_date, input_format, output_format)
+
+
 def define_env(variable_env, branch):
     if variable_env is not None:
         return variable_env.lower()

{devsecops_engine_tools-1.171.0 → devsecops_engine_tools-1.173.0}/devsecops_engine_tools/engine_sast/engine_iac/src/domain/usecases/iac_scan.py

@@ -1,5 +1,6 @@
 import os
 import re
+from datetime import datetime
 from devsecops_engine_tools.engine_sast.engine_iac.src.domain.model.gateways.tool_gateway import (
     ToolGateway,
 )
@@ -19,6 +20,8 @@ logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 
 
 class IacScan:
+    EXCEPTED_CHECKS_REASON = "Excepted check (soft fail)"
+
     def __init__(
         self, tool_gateway: ToolGateway, devops_platform_gateway: DevopsPlatformGateway, remote_config_source_gateway: DevopsPlatformGateway
     ):
@@ -69,6 +72,9 @@ class IacScan:
             totalized_exclusions.extend(
                 [Exclusions(**elem) for elem in config_tool_core.exclusions_scope]
             )
+        totalized_exclusions.extend(
+            self._build_excepted_checks_exclusions(dict_args, findings_list)
+        )
 
         input_core = InputCore(
             totalized_exclusions=totalized_exclusions,
@@ -89,6 +95,56 @@ class IacScan:
 
         return findings_list, input_core
 
+    def _build_excepted_checks_exclusions(self, dict_args, findings_list):
+        """
+        Translates the --excepted_checks CLI flag (comma separated check ids already
+        approved as exceptions outside the engine) into Exclusions, so those findings
+        are still reported but do not break the build.
+
+        The severity is taken from each finding instead of being hardcoded because
+        BreakBuild._filter_findings only excludes a finding when the exclusion matches
+        its severity or its priority scale, and the priority is not resolved yet at
+        this point of the execution.
+        """
+        excepted_checks = {
+            check.strip()
+            for check in (dict_args.get("excepted_checks") or "").split(",")
+            if check.strip()
+        }
+        if not excepted_checks:
+            return []
+
+        severities_by_check = {}
+        for finding in findings_list:
+            if finding.id in excepted_checks:
+                severities_by_check.setdefault(finding.id, set()).add(finding.severity)
+
+        without_findings = excepted_checks - set(severities_by_check)
+        if without_findings:
+            logger.info(
+                "%s of %s excepted checks have no findings in this execution",
+                len(without_findings),
+                len(excepted_checks),
+            )
+            logger.debug(
+                "Excepted checks without findings: %s", ", ".join(sorted(without_findings))
+            )
+
+        create_date = datetime.now().strftime("%d%m%Y")
+        return [
+            Exclusions(
+                **{
+                    "id": check_id,
+                    "where": "all",
+                    "severity": severity,
+                    "create_date": create_date,
+                    "reason": self.EXCEPTED_CHECKS_REASON,
+                }
+            )
+            for check_id in sorted(severities_by_check)
+            for severity in sorted(severities_by_check[check_id])
+        ]
+
     def _complete_config_tool(self, data_file_tool, exclusions, tool, dict_args):
         config_tool = ConfigTool(json_data=data_file_tool)
 

{devsecops_engine_tools-1.171.0 → devsecops_engine_tools-1.173.0}/devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/trivy_tool/trivy_manager_scan.py

@@ -32,7 +32,7 @@ class TrivyScanSBOM(ToolGateway):
     ):
         trivy_version = remote_config["TRIVY"]["CLI_VERSION"]
         command_prefix = TrivyManagerScanUtils().identify_os_and_install(trivy_version)
-        sbom = f"{pipeline_name}_SBOM.json"
+        sbom = to_scan if isinstance(to_scan, str) and os.path.isfile(to_scan) else f"{pipeline_name}_SBOM.json"
 
         if not command_prefix:
             return None

{devsecops_engine_tools-1.171.0 → devsecops_engine_tools-1.173.0}/devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/entry_points/entry_point_tool.py

@@ -14,6 +14,7 @@ from devsecops_engine_tools.engine_core.src.domain.model.gateway.devops_platform
 from devsecops_engine_tools.engine_core.src.domain.model.gateway.sbom_manager import (
     SbomManagerGateway,
 )
+from devsecops_engine_tools.engine_utilities.sbom.deserealizator import get_list_component
 
 import os
 
@@ -69,18 +70,6 @@ def init_engine_dependencies(
     if scan_flag and not (skip_flag):
         to_scan = dict_args["folder_path"] if dict_args["folder_path"] else os.getcwd()
         if os.path.exists(to_scan):
-            dependencies_sca_scan = DependenciesScan(
-                tool_run,
-                tool_deserializator,
-                remote_config,
-                dict_args,
-                exclusions,
-                pipeline_name,
-                to_scan,
-                secret_tool,
-                build_id,
-                build_url
-            )
             sbom_components = _process_sbom_and_license_analysis(
                 tool_remote,
                 tool_sbom,
@@ -92,12 +81,29 @@ def init_engine_dependencies(
                 to_scan,
             )
 
-            dependencies_scanned = dependencies_sca_scan.process()
-            deserialized = (
-                dependencies_sca_scan.deserializator(dependencies_scanned)
-                if dependencies_scanned is not None
-                else []
-            )
+            if dict_args.get("generate_sbom_only") != "true":
+                dependencies_sca_scan = DependenciesScan(
+                    tool_run,
+                    tool_deserializator,
+                    remote_config,
+                    dict_args,
+                    exclusions,
+                    pipeline_name,
+                    to_scan,
+                    secret_tool,
+                    build_id,
+                    build_url
+                )
+                dependencies_scanned = dependencies_sca_scan.process()
+                deserialized = (
+                    dependencies_sca_scan.deserializator(dependencies_scanned)
+                    if dependencies_scanned is not None
+                    else []
+                )
+            else:
+                logger.info(
+                    "Dependency vulnerability scan skipped for this execution. (Only SBOM generation)"
+                )
         else:
             logger.error(f"Path {to_scan} does not exist")
     else:
@@ -134,7 +140,10 @@ def _process_sbom_and_license_analysis(
     ):
         return None
 
-    sbom_components = tool_sbom.get_components(to_scan, config_sbom, pipeline_name)
+    if os.path.isfile(to_scan):
+        sbom_components = get_list_component(to_scan)
+    else:
+        sbom_components = tool_sbom.get_components(to_scan, config_sbom, pipeline_name)
 
     if dict_args.get("use_license_analyzer") == "true":
         _upload_sbom_to_license_analyzer(
@@ -144,13 +153,14 @@ def _process_sbom_and_license_analysis(
             dict_args,
             secret_tool,
             pipeline_name,
+            to_scan,
         )
 
     return sbom_components
 
 
 def _upload_sbom_to_license_analyzer(
-    tool_remote, tool_license_manager, config_license, dict_args, secret_tool, pipeline_name
+    tool_remote, tool_license_manager, config_license, dict_args, secret_tool, pipeline_name, to_scan
 ):
     license_tool = config_license.get("TOOL")
     token_license_analyzer = (
@@ -171,7 +181,7 @@ def _upload_sbom_to_license_analyzer(
         request=SbomUpload(
             project_name=pipeline_name,
             project_version=str(tool_remote.get_variable("branch_tag")),
-            sbom_filename=f"{pipeline_name}_SBOM.json"
+            sbom_filename=to_scan if os.path.isfile(to_scan) else f"{pipeline_name}_SBOM.json"
         )
     )
 

{devsecops_engine_tools-1.171.0 → devsecops_engine_tools-1.173.0}/devsecops_engine_tools/engine_utilities/defect_dojo/__init__.py

@@ -6,4 +6,5 @@ from .applications.connect import Connect
 from .applications.engagement import Engagement
 from .applications.product import Product
 from .applications.component import Component
-from .applications.finding_exclusion import FindingExclusion
+from .applications.finding_exclusion import FindingExclusion
+from .applications.long_risk_acceptance import LongRiskAcceptance

devsecops_engine_tools-1.173.0/devsecops_engine_tools/engine_utilities/defect_dojo/applications/long_risk_acceptance.py

@@ -0,0 +1,24 @@
+from devsecops_engine_tools.engine_utilities.utils.api_error import ApiError
+from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
+from devsecops_engine_tools.engine_utilities.defect_dojo.domain.user_case.long_risk_acceptance import (
+    LongRiskAcceptanceUserCase,
+)
+from devsecops_engine_tools.engine_utilities.defect_dojo.infraestructure.driver_adapters.long_risk_acceptance import (
+    LongRiskAcceptanceRestConsumer,
+)
+from devsecops_engine_tools.engine_utilities.settings import SETTING_LOGGER
+
+logger = MyLogger.__call__(**SETTING_LOGGER).get_logger()
+
+
+class LongRiskAcceptance:
+    @staticmethod
+    def get_long_risk_acceptance(session, long_risk_acceptance_id):
+        try:
+            rest_long_risk_acceptance = LongRiskAcceptanceRestConsumer(session=session)
+
+            uc = LongRiskAcceptanceUserCase(rest_long_risk_acceptance)
+            return uc.execute(long_risk_acceptance_id)
+        except ApiError as e:
+            logger.error(f"Error during get long risk acceptance: {e}")
+            raise e

{devsecops_engine_tools-1.171.0 → devsecops_engine_tools-1.173.0}/devsecops_engine_tools/engine_utilities/defect_dojo/domain/models/engagement.py

@@ -45,6 +45,7 @@ class Engagement(FromDictMixin):
     notes: List[None] = dataclasses.field(default_factory=list)
     files: List[None] = dataclasses.field(default_factory=list)
     risk_acceptance: List[None] = dataclasses.field(default_factory=list)
+    long_risk_acceptances: int = 0
 
 
 @dataclasses.dataclass

devsecops_engine_tools-1.173.0/devsecops_engine_tools/engine_utilities/defect_dojo/domain/models/long_risk_acceptance.py

@@ -0,0 +1,10 @@
+import dataclasses
+from devsecops_engine_tools.engine_utilities.utils.dataclass_classmethod import FromDictMixin
+
+
+@dataclasses.dataclass
+class LongRiskAcceptance(FromDictMixin):
+    id: int = 0
+    name: str = ""
+    created: str = ""
+    expiration_date: str = ""

devsecops_engine_tools-1.173.0/devsecops_engine_tools/engine_utilities/defect_dojo/domain/user_case/long_risk_acceptance.py

@@ -0,0 +1,13 @@
+from devsecops_engine_tools.engine_utilities.defect_dojo.infraestructure.driver_adapters.long_risk_acceptance import (
+    LongRiskAcceptanceRestConsumer,
+)
+
+
+class LongRiskAcceptanceUserCase:
+    def __init__(self, rest_long_risk_acceptance: LongRiskAcceptanceRestConsumer):
+        self.__rest_long_risk_acceptance = rest_long_risk_acceptance
+
+    def execute(self, long_risk_acceptance_id):
+        return self.__rest_long_risk_acceptance.get_long_risk_acceptance(
+            long_risk_acceptance_id
+        )

devsecops_engine_tools-1.173.0/devsecops_engine_tools/engine_utilities/defect_dojo/infraestructure/driver_adapters/long_risk_acceptance.py

@@ -0,0 +1,36 @@
+from devsecops_engine_tools.engine_utilities.utils.api_error import ApiError
+from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
+from devsecops_engine_tools.engine_utilities.defect_dojo.domain.models.long_risk_acceptance import (
+    LongRiskAcceptance,
+)
+from devsecops_engine_tools.engine_utilities.defect_dojo.infraestructure.driver_adapters.settings.settings import (
+    VERIFY_CERTIFICATE,
+)
+from devsecops_engine_tools.engine_utilities.utils.session_manager import SessionManager
+from devsecops_engine_tools.engine_utilities.settings import SETTING_LOGGER
+
+logger = MyLogger.__call__(**SETTING_LOGGER).get_logger()
+
+
+class LongRiskAcceptanceRestConsumer:
+    def __init__(self, session: SessionManager):
+        self.__token = session._token
+        self.__host = session._host
+        self.__session = session._instance
+
+    def get_long_risk_acceptance(self, long_risk_acceptance_id) -> LongRiskAcceptance:
+        url = f"{self.__host}/api/v2/long_risk_acceptance/{long_risk_acceptance_id}/"
+        headers = {
+            "Authorization": f"Token {self.__token}",
+            "Content-Type": "application/json",
+        }
+        try:
+            response = self.__session.get(
+                url, headers=headers, verify=VERIFY_CERTIFICATE
+            )
+            if response.status_code != 200:
+                raise ApiError(response.json())
+            return LongRiskAcceptance.from_dict(response.json())
+        except Exception as e:
+            logger.error(f"from dict LongRiskAcceptance: {e}")
+            raise ApiError(e)

{devsecops_engine_tools-1.171.0 → devsecops_engine_tools-1.173.0}/devsecops_engine_tools/engine_utilities/sbom/deserealizator.py

@@ -3,14 +3,19 @@ import json
 from devsecops_engine_tools.engine_core.src.domain.model.component import Component
 
 
-def get_list_component(result_sbom, format) -> "list[Component]":
+def get_list_component(result_sbom, format=None) -> "list[Component]":
     list_components = []
 
     with open(result_sbom, "rb") as file:
         sbom_object = file.read()
         json_data = json.loads(sbom_object)
 
-        if "cyclonedx" in format:
+        is_cyclonedx = (
+            "cyclonedx" in format.lower()
+            if format is not None
+            else json_data.get("bomFormat", "").lower() == "cyclonedx"
+        )
+        if is_cyclonedx:
             for component in json_data.get("components", []):
                 if component.get("version") != "UNKNOWN":
                     component_name = (

devsecops_engine_tools-1.173.0/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.173.0'

{devsecops_engine_tools-1.171.0 → devsecops_engine_tools-1.173.0}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devsecops-engine-tools
-Version: 1.171.0
+Version: 1.173.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.171.0 → devsecops_engine_tools-1.173.0}/devsecops_engine_tools.egg-info/SOURCES.txt

@@ -355,6 +355,7 @@ devsecops_engine_tools/engine_utilities/defect_dojo/applications/defect_dojo.py
 devsecops_engine_tools/engine_utilities/defect_dojo/applications/engagement.py
 devsecops_engine_tools/engine_utilities/defect_dojo/applications/finding.py
 devsecops_engine_tools/engine_utilities/defect_dojo/applications/finding_exclusion.py
+devsecops_engine_tools/engine_utilities/defect_dojo/applications/long_risk_acceptance.py
 devsecops_engine_tools/engine_utilities/defect_dojo/applications/product.py
 devsecops_engine_tools/engine_utilities/defect_dojo/domain/__init__.py
 devsecops_engine_tools/engine_utilities/defect_dojo/domain/models/__init__.py
@@ -363,6 +364,7 @@ devsecops_engine_tools/engine_utilities/defect_dojo/domain/models/component.py
 devsecops_engine_tools/engine_utilities/defect_dojo/domain/models/engagement.py
 devsecops_engine_tools/engine_utilities/defect_dojo/domain/models/finding.py
 devsecops_engine_tools/engine_utilities/defect_dojo/domain/models/finding_exclusion.py
+devsecops_engine_tools/engine_utilities/defect_dojo/domain/models/long_risk_acceptance.py
 devsecops_engine_tools/engine_utilities/defect_dojo/domain/models/product.py
 devsecops_engine_tools/engine_utilities/defect_dojo/domain/models/product_list.py
 devsecops_engine_tools/engine_utilities/defect_dojo/domain/models/product_type.py
@@ -381,6 +383,7 @@ devsecops_engine_tools/engine_utilities/defect_dojo/domain/user_case/engagement.
 devsecops_engine_tools/engine_utilities/defect_dojo/domain/user_case/finding.py
 devsecops_engine_tools/engine_utilities/defect_dojo/domain/user_case/finding_exclusion.py
 devsecops_engine_tools/engine_utilities/defect_dojo/domain/user_case/import_scan.py
+devsecops_engine_tools/engine_utilities/defect_dojo/domain/user_case/long_risk_acceptance.py
 devsecops_engine_tools/engine_utilities/defect_dojo/domain/user_case/product.py
 devsecops_engine_tools/engine_utilities/defect_dojo/infraestructure/__init__.py
 devsecops_engine_tools/engine_utilities/defect_dojo/infraestructure/driver_adapters/__init__.py
@@ -390,6 +393,7 @@ devsecops_engine_tools/engine_utilities/defect_dojo/infraestructure/driver_adapt
 devsecops_engine_tools/engine_utilities/defect_dojo/infraestructure/driver_adapters/finding.py
 devsecops_engine_tools/engine_utilities/defect_dojo/infraestructure/driver_adapters/finding_exclusion.py
 devsecops_engine_tools/engine_utilities/defect_dojo/infraestructure/driver_adapters/import_scan.py
+devsecops_engine_tools/engine_utilities/defect_dojo/infraestructure/driver_adapters/long_risk_acceptance.py
 devsecops_engine_tools/engine_utilities/defect_dojo/infraestructure/driver_adapters/product.py
 devsecops_engine_tools/engine_utilities/defect_dojo/infraestructure/driver_adapters/product_type.py
 devsecops_engine_tools/engine_utilities/defect_dojo/infraestructure/driver_adapters/scan_configurations.py

devsecops_engine_tools-1.171.0/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.171.0'