devsecops-engine-tools 1.176.0__tar.gz → 1.178.0__tar.gz

{devsecops_engine_tools-1.176.0 → devsecops_engine_tools-1.178.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devsecops-engine-tools
-Version: 1.176.0
+Version: 1.178.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.176.0 → devsecops_engine_tools-1.178.0}/devsecops_engine_tools/engine_core/src/domain/model/input_core.py

@@ -1,4 +1,4 @@
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from devsecops_engine_tools.engine_core.src.domain.model.exclusions import Exclusions
 from devsecops_engine_tools.engine_core.src.domain.model.threshold import Threshold
 
@@ -11,3 +11,5 @@ class InputCore:
     scope_pipeline: str
     scope_service: str
     stage_pipeline: str
+    debug_exclusion_diagnostics: bool = False
+    base_image_names: list[str] = field(default_factory=list)

{devsecops_engine_tools-1.176.0 → devsecops_engine_tools-1.178.0}/devsecops_engine_tools/engine_core/src/domain/usecases/break_build.py

@@ -1,4 +1,6 @@
 import sys
+from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
+from devsecops_engine_tools.engine_utilities import settings
 from itertools import chain
 from dataclasses import dataclass
 
@@ -19,6 +21,8 @@ from collections import Counter
 from datetime import timedelta, datetime
 import pytz
 
+logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
+
 
 @dataclass
 class BreakBuild:
@@ -49,7 +53,12 @@ class BreakBuild:
             )
 
             findings_excluded, findings_without_exclusions = self._filter_findings(
-                findings_list, exclusions, args
+                findings_list,
+                exclusions,
+                args,
+                debug=input_core.debug_exclusion_diagnostics,
+                pipeline_name=input_core.scope_pipeline,
+                base_image_names=input_core.base_image_names,
             )
             scan_result["findings_excluded"] = [self._map_finding_excluded(item) for item in findings_excluded]
             
@@ -62,7 +71,13 @@ class BreakBuild:
             self._handle_vulnerabilities(vulnerability_counts, vulnerabilities, threshold, warning_release, scan_result, args, manager)
             self._handle_cve_policy(vulnerabilities, threshold)
             self._handle_compliances(compliance_counts, compliances, threshold, warning_release, scan_result, args, manager)
-            self._handle_exclusions(findings_excluded, exclusions, manager, args)
+            self._handle_exclusions(
+                findings_excluded,
+                exclusions,
+                manager,
+                args,
+                input_core.base_image_names,
+            )
         else:
             print(devops_platform_gateway.message("succeeded", "There are no findings"))
             print(devops_platform_gateway.result_pipeline("succeeded"))
@@ -95,24 +110,76 @@ class BreakBuild:
                             )
                         )
 
-    def _filter_findings(self, findings_list, exclusions, args):
-        findings_excluded_list = [
-            item
-            for item in findings_list
-            if any(self._matches_exclusion(item, exclusion, args) for exclusion in exclusions)
-        ]
-        findings_without_exclusions_list = [
-            v for v in findings_list if v not in findings_excluded_list
-        ]
+    def _filter_findings(
+        self,
+        findings_list,
+        exclusions,
+        args,
+        debug=False,
+        pipeline_name="",
+        base_image_names=None,
+    ):
+        findings_excluded_list = []
+        findings_without_exclusions_list = []
+        image_to_scan = args.get("image_to_scan", "")
+
+        for item in findings_list:
+            checks = [
+                (
+                    exclusion,
+                    self._exclusion_match_details(
+                        item, exclusion, args, base_image_names
+                    ),
+                )
+                for exclusion in exclusions
+            ]
+            if debug:
+                candidates = [
+                    {
+                        "exclusion_id": exclusion.id,
+                        "exclusion_images": exclusion.check_in_desc,
+                        **details,
+                    }
+                    for exclusion, details in checks
+                    if details["id_match"]
+                    or (details["image_check_required"] and details["image_match"])
+                ]
+                logger.info(
+                    "Cross-approval exclusion diagnostics for pipeline %s: "
+                    "finding=%s checked=%s candidates=%s",
+                    pipeline_name,
+                    {
+                        "id": item.id,
+                        "where": item.where,
+                        "severity": item.severity,
+                        "priority": item.priority.scale if item.priority else None,
+                        "module": args.get("module"),
+                        "image_to_scan": image_to_scan,
+                        "base_image_names": base_image_names or [],
+                    },
+                    len(exclusions),
+                    candidates,
+                )
+
+            if any(details["matched"] for _, details in checks):
+                findings_excluded_list.append(item)
+            else:
+                findings_without_exclusions_list.append(item)
+
         return findings_excluded_list, findings_without_exclusions_list
 
     @staticmethod
-    def _matches_exclusion(item, exclusion, args):
-        if exclusion.id != item.id:
-            return False
-        if exclusion.where not in item.where and "all" not in exclusion.where:
-            return False
+    def _matches_exclusion(item, exclusion, args, base_image_names=None):
+        return BreakBuild._exclusion_match_details(
+            item, exclusion, args, base_image_names
+        )["matched"]
 
+    @staticmethod
+    def _exclusion_match_details(item, exclusion, args, base_image_names=None):
+        id_match = exclusion.id == item.id
+        where_match = bool(exclusion.where) and (
+            exclusion.where in item.where or "all" in exclusion.where
+        )
         finding_priority = item.priority.scale if item.priority else None
         severity_match = BreakBuild._value_in_exclusion_list(
             exclusion.severity, item.severity
@@ -120,17 +187,34 @@ class BreakBuild:
         priority_match = BreakBuild._value_in_exclusion_list(
             exclusion.priority, finding_priority
         )
-        if not severity_match and not priority_match:
-            return False
-
-        if args.get("module") == "engine_container" and exclusion.check_in_desc:
-            image_to_scan = args.get("image_to_scan", "")
-            if not image_to_scan or not any(
-                image_to_scan in image_name for image_name in exclusion.check_in_desc
-            ):
-                return False
-
-        return True
+        image_check_required = (
+            args.get("module") == "engine_container" and bool(exclusion.check_in_desc)
+        )
+        image_to_scan = args.get("image_to_scan", "")
+        image_names = [image_to_scan] if image_to_scan else []
+        image_names.extend(base_image_names or [])
+        image_match = not image_check_required or (
+            any(
+                image_name in excluded_image
+                for image_name in image_names
+                for excluded_image in exclusion.check_in_desc
+            )
+        )
+        matched = (
+            id_match
+            and where_match
+            and (severity_match or priority_match)
+            and image_match
+        )
+        return {
+            "id_match": id_match,
+            "where_match": where_match,
+            "severity_match": severity_match,
+            "priority_match": priority_match,
+            "image_check_required": image_check_required,
+            "image_match": image_match,
+            "matched": matched,
+        }
 
     @staticmethod
     def _value_in_exclusion_list(exclusion_value, finding_value):
@@ -309,7 +393,12 @@ class BreakBuild:
             print(devops_platform_gateway.result_pipeline("succeeded"))
 
     def _handle_exclusions(
-        self, findings_excluded_list, exclusions, break_build_manager, args
+        self,
+        findings_excluded_list,
+        exclusions,
+        break_build_manager,
+        args,
+        base_image_names=None,
     ):
         devops_platform_gateway = self.devops_platform_gateway
         printer_table_gateway = self.printer_table_gateway
@@ -322,7 +411,9 @@ class BreakBuild:
                 matching_exclusions = [
                     exclusion
                     for exclusion in exclusions
-                    if self._matches_exclusion(item, exclusion, args)
+                    if self._matches_exclusion(
+                        item, exclusion, args, base_image_names
+                    )
                 ]
                 image_exclusions = [
                     exclusion

{devsecops_engine_tools-1.176.0 → devsecops_engine_tools-1.178.0}/devsecops_engine_tools/engine_sca/engine_container/src/domain/usecases/set_input_core.py

@@ -15,6 +15,7 @@ class SetInputCore:
         tool,
         stage,
         cross_approval_exclusions=None,
+        debug_exclusion_diagnostics=False,
     ):
         self.remote_config = remote_config
         self.exclusions = exclusions
@@ -22,6 +23,19 @@ class SetInputCore:
         self.tool = tool
         self.stage = stage
         self.cross_approval_exclusions = cross_approval_exclusions or []
+        self.debug_exclusion_diagnostics = debug_exclusion_diagnostics
+
+    @staticmethod
+    def _get_base_image_names(base_image):
+        if not base_image:
+            return []
+
+        images = base_image[0] if isinstance(base_image, (list, tuple)) else base_image
+        if isinstance(images, str):
+            return [images]
+        if isinstance(images, (list, tuple)):
+            return [image for image in images if isinstance(image, str) and image]
+        return []
 
     def _build_exclusions(self, items, base_image_list, filter_by_base_image):
         list_exclusions = []
@@ -51,7 +65,8 @@ class SetInputCore:
 
     def get_exclusions(self, exclusions_data, pipeline_name, tool, base_image):
         list_exclusions = []
-        base_image_list = base_image[0][0] if base_image else None
+        base_image_names = self._get_base_image_names(base_image)
+        base_image_list = base_image_names[0] if base_image_names else None
         print("The base image used is:", base_image_list)
         for key, value in exclusions_data.items():
             if key not in {"All", pipeline_name} or not value.get(tool):
@@ -100,4 +115,6 @@ class SetInputCore:
             self.pipeline_name,
             self.pipeline_name,
             self.stage.capitalize(),
+            self.debug_exclusion_diagnostics,
+            self._get_base_image_names(base_image),
         )

{devsecops_engine_tools-1.176.0 → devsecops_engine_tools-1.178.0}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/entry_points/entry_point_tool.py

@@ -61,6 +61,7 @@ def init_engine_sca_rm(
     sbom_components = None
     deseralized = []
     cross_approval_exclusions = []
+    debug_pipeline_enabled = False
     if scan_flag and not (skip_flag):
         host_defect_dojo = None
         if remote_config.get("CROSS_APPROVAL_EXCLUSIONS", {}).get("ENABLED", False):
@@ -75,6 +76,32 @@ def init_engine_sca_rm(
         cross_approval_exclusions = GetCrossApprovalExclusions(
             DefectDojoCrossApprovalAdapter()
         ).execute(remote_config, dict_args, secret_tool, host_defect_dojo)
+        debug_pipeline_config = remote_config.get("DEBUG_PIPELINE", {})
+        debug_pipelines = debug_pipeline_config.get("PIPELINES", [])
+        if (
+            debug_pipeline_config.get("ENABLED", False)
+            and isinstance(debug_pipelines, (list, tuple))
+            and pipeline_name in debug_pipelines
+        ):
+            debug_pipeline_enabled = True
+            logger.info(
+                "Container debug enabled for pipeline %s. Cross-approval exclusions: %s",
+                pipeline_name,
+                [
+                    {
+                        "id": exclusion.id,
+                        "where": exclusion.where,
+                        "create_date": exclusion.create_date,
+                        "expired_date": exclusion.expired_date,
+                        "severity": exclusion.severity,
+                        "priority": exclusion.priority,
+                        "hu": exclusion.hu,
+                        "reason": exclusion.reason,
+                        "images": exclusion.check_in_desc,
+                    }
+                    for exclusion in cross_approval_exclusions
+                ],
+            )
         container_sca_scan = ContainerScaScan(
             tool_run,
             remote_config,
@@ -105,6 +132,7 @@ def init_engine_sca_rm(
         tool,
         stage,
         cross_approval_exclusions,
+        debug_pipeline_enabled,
     )
     core_input = input_core.set_input_core(image_scanned, base_image)
 

devsecops_engine_tools-1.178.0/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.178.0'

{devsecops_engine_tools-1.176.0 → devsecops_engine_tools-1.178.0}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devsecops-engine-tools
-Version: 1.176.0
+Version: 1.178.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

devsecops_engine_tools-1.176.0/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.176.0'