devsecops-engine-tools 1.176.0__tar.gz → 1.177.0__tar.gz

{devsecops_engine_tools-1.176.0 → devsecops_engine_tools-1.177.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devsecops-engine-tools
-Version: 1.176.0
+Version: 1.177.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.176.0 → devsecops_engine_tools-1.177.0}/devsecops_engine_tools/engine_core/src/domain/model/input_core.py

@@ -11,3 +11,4 @@ class InputCore:
     scope_pipeline: str
     scope_service: str
     stage_pipeline: str
+    debug_exclusion_diagnostics: bool = False

{devsecops_engine_tools-1.176.0 → devsecops_engine_tools-1.177.0}/devsecops_engine_tools/engine_core/src/domain/usecases/break_build.py

@@ -1,4 +1,6 @@
 import sys
+from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
+from devsecops_engine_tools.engine_utilities import settings
 from itertools import chain
 from dataclasses import dataclass
 
@@ -19,6 +21,8 @@ from collections import Counter
 from datetime import timedelta, datetime
 import pytz
 
+logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
+
 
 @dataclass
 class BreakBuild:
@@ -49,7 +53,11 @@ class BreakBuild:
             )
 
             findings_excluded, findings_without_exclusions = self._filter_findings(
-                findings_list, exclusions, args
+                findings_list,
+                exclusions,
+                args,
+                debug=input_core.debug_exclusion_diagnostics,
+                pipeline_name=input_core.scope_pipeline,
             )
             scan_result["findings_excluded"] = [self._map_finding_excluded(item) for item in findings_excluded]
             
@@ -95,24 +103,60 @@ class BreakBuild:
                             )
                         )
 
-    def _filter_findings(self, findings_list, exclusions, args):
-        findings_excluded_list = [
-            item
-            for item in findings_list
-            if any(self._matches_exclusion(item, exclusion, args) for exclusion in exclusions)
-        ]
-        findings_without_exclusions_list = [
-            v for v in findings_list if v not in findings_excluded_list
-        ]
+    def _filter_findings(
+        self, findings_list, exclusions, args, debug=False, pipeline_name=""
+    ):
+        findings_excluded_list = []
+        findings_without_exclusions_list = []
+        image_to_scan = args.get("image_to_scan", "")
+
+        for item in findings_list:
+            checks = [
+                (exclusion, self._exclusion_match_details(item, exclusion, args))
+                for exclusion in exclusions
+            ]
+            if debug:
+                candidates = [
+                    {
+                        "exclusion_id": exclusion.id,
+                        "exclusion_images": exclusion.check_in_desc,
+                        **details,
+                    }
+                    for exclusion, details in checks
+                    if details["id_match"]
+                    or (details["image_check_required"] and details["image_match"])
+                ]
+                logger.info(
+                    "Cross-approval exclusion diagnostics for pipeline %s: "
+                    "finding=%s checked=%s candidates=%s",
+                    pipeline_name,
+                    {
+                        "id": item.id,
+                        "where": item.where,
+                        "severity": item.severity,
+                        "priority": item.priority.scale if item.priority else None,
+                        "module": args.get("module"),
+                        "image_to_scan": image_to_scan,
+                    },
+                    len(exclusions),
+                    candidates,
+                )
+
+            if any(details["matched"] for _, details in checks):
+                findings_excluded_list.append(item)
+            else:
+                findings_without_exclusions_list.append(item)
+
         return findings_excluded_list, findings_without_exclusions_list
 
     @staticmethod
     def _matches_exclusion(item, exclusion, args):
-        if exclusion.id != item.id:
-            return False
-        if exclusion.where not in item.where and "all" not in exclusion.where:
-            return False
+        return BreakBuild._exclusion_match_details(item, exclusion, args)["matched"]
 
+    @staticmethod
+    def _exclusion_match_details(item, exclusion, args):
+        id_match = exclusion.id == item.id
+        where_match = exclusion.where in item.where or "all" in exclusion.where
         finding_priority = item.priority.scale if item.priority else None
         severity_match = BreakBuild._value_in_exclusion_list(
             exclusion.severity, item.severity
@@ -120,17 +164,29 @@ class BreakBuild:
         priority_match = BreakBuild._value_in_exclusion_list(
             exclusion.priority, finding_priority
         )
-        if not severity_match and not priority_match:
-            return False
-
-        if args.get("module") == "engine_container" and exclusion.check_in_desc:
-            image_to_scan = args.get("image_to_scan", "")
-            if not image_to_scan or not any(
-                image_to_scan in image_name for image_name in exclusion.check_in_desc
-            ):
-                return False
-
-        return True
+        image_check_required = (
+            args.get("module") == "engine_container" and bool(exclusion.check_in_desc)
+        )
+        image_to_scan = args.get("image_to_scan", "")
+        image_match = not image_check_required or (
+            bool(image_to_scan)
+            and any(image_to_scan in image_name for image_name in exclusion.check_in_desc)
+        )
+        matched = (
+            id_match
+            and where_match
+            and (severity_match or priority_match)
+            and image_match
+        )
+        return {
+            "id_match": id_match,
+            "where_match": where_match,
+            "severity_match": severity_match,
+            "priority_match": priority_match,
+            "image_check_required": image_check_required,
+            "image_match": image_match,
+            "matched": matched,
+        }
 
     @staticmethod
     def _value_in_exclusion_list(exclusion_value, finding_value):

{devsecops_engine_tools-1.176.0 → devsecops_engine_tools-1.177.0}/devsecops_engine_tools/engine_sca/engine_container/src/domain/usecases/set_input_core.py

@@ -15,6 +15,7 @@ class SetInputCore:
         tool,
         stage,
         cross_approval_exclusions=None,
+        debug_exclusion_diagnostics=False,
     ):
         self.remote_config = remote_config
         self.exclusions = exclusions
@@ -22,6 +23,7 @@ class SetInputCore:
         self.tool = tool
         self.stage = stage
         self.cross_approval_exclusions = cross_approval_exclusions or []
+        self.debug_exclusion_diagnostics = debug_exclusion_diagnostics
 
     def _build_exclusions(self, items, base_image_list, filter_by_base_image):
         list_exclusions = []
@@ -100,4 +102,5 @@ class SetInputCore:
             self.pipeline_name,
             self.pipeline_name,
             self.stage.capitalize(),
+            self.debug_exclusion_diagnostics,
         )

{devsecops_engine_tools-1.176.0 → devsecops_engine_tools-1.177.0}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/entry_points/entry_point_tool.py

@@ -61,6 +61,7 @@ def init_engine_sca_rm(
     sbom_components = None
     deseralized = []
     cross_approval_exclusions = []
+    debug_pipeline_enabled = False
     if scan_flag and not (skip_flag):
         host_defect_dojo = None
         if remote_config.get("CROSS_APPROVAL_EXCLUSIONS", {}).get("ENABLED", False):
@@ -75,6 +76,32 @@ def init_engine_sca_rm(
         cross_approval_exclusions = GetCrossApprovalExclusions(
             DefectDojoCrossApprovalAdapter()
         ).execute(remote_config, dict_args, secret_tool, host_defect_dojo)
+        debug_pipeline_config = remote_config.get("DEBUG_PIPELINE", {})
+        debug_pipelines = debug_pipeline_config.get("PIPELINES", [])
+        if (
+            debug_pipeline_config.get("ENABLED", False)
+            and isinstance(debug_pipelines, (list, tuple))
+            and pipeline_name in debug_pipelines
+        ):
+            debug_pipeline_enabled = True
+            logger.info(
+                "Container debug enabled for pipeline %s. Cross-approval exclusions: %s",
+                pipeline_name,
+                [
+                    {
+                        "id": exclusion.id,
+                        "where": exclusion.where,
+                        "create_date": exclusion.create_date,
+                        "expired_date": exclusion.expired_date,
+                        "severity": exclusion.severity,
+                        "priority": exclusion.priority,
+                        "hu": exclusion.hu,
+                        "reason": exclusion.reason,
+                        "images": exclusion.check_in_desc,
+                    }
+                    for exclusion in cross_approval_exclusions
+                ],
+            )
         container_sca_scan = ContainerScaScan(
             tool_run,
             remote_config,
@@ -105,6 +132,7 @@ def init_engine_sca_rm(
         tool,
         stage,
         cross_approval_exclusions,
+        debug_pipeline_enabled,
     )
     core_input = input_core.set_input_core(image_scanned, base_image)
 

devsecops_engine_tools-1.177.0/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.177.0'

{devsecops_engine_tools-1.176.0 → devsecops_engine_tools-1.177.0}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devsecops-engine-tools
-Version: 1.176.0
+Version: 1.177.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

devsecops_engine_tools-1.176.0/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.176.0'