devsecops-engine-tools 1.20.0__tar.gz → 1.22.0__tar.gz

{devsecops_engine_tools-1.20.0 → devsecops_engine_tools-1.22.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.20.0
+Version: 1.22.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.20.0 → devsecops_engine_tools-1.22.0}/devsecops_engine_tools/engine_core/src/applications/runner_engine_core.py

@@ -144,7 +144,7 @@ def get_inputs_from_cli(args):
     parser.add_argument(
         "--token_external_checks",
         required=False,
-        help="Token for downloading external checks from engine_iac or engine_secret if is necessary. Ej: github:token, ssh:privatekey:pass",
+        help="Token for downloading external checks from engine_iac or engine_secret if is necessary. Ej: github_token:token, github_app:private_key, ssh:privatekey:pass",
     )
     parser.add_argument(
         "--xray_mode",

{devsecops_engine_tools-1.20.0 → devsecops_engine_tools-1.22.0}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/defect_dojo/defect_dojo.py

@@ -243,7 +243,7 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                 self.FALSE_POSITIVE,
             )
 
-            exclusions_false_positive = self._get_findings_with_exclusions(
+            exclusions_out_of_scope = self._get_findings_with_exclusions(
                 session_manager,
                 service,
                 dd_max_retries,
@@ -266,6 +266,7 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
             return (
                 list(exclusions_risk_accepted)
                 + list(exclusions_false_positive)
+                + list(exclusions_out_of_scope)
                 + list(exclusions_transfer_finding)
             )
         except Exception as ex:

{devsecops_engine_tools-1.20.0 → devsecops_engine_tools-1.22.0}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/github/github_actions.py

@@ -28,11 +28,8 @@ class GithubActions(DevopsPlatformGateway):
         split = github_repository.split("/")
         owner = split[0]
 
-        utils_github = GithubApi(
-            personal_access_token=SystemVariables.github_access_token.value()
-        )
-
-        git_client = utils_github.get_github_connection()
+        utils_github = GithubApi()
+        git_client = utils_github.get_github_connection(SystemVariables.github_access_token.value())
         json_config = utils_github.get_remote_json_config(git_client, owner, repository, path)
 
         return json_config
@@ -92,4 +89,4 @@ class GithubActions(DevopsPlatformGateway):
         try:
             return variable_map.get(variable).value()
         except ValueError:
-            return None
+            return None

{devsecops_engine_tools-1.20.0 → devsecops_engine_tools-1.22.0}/devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_tool.py

@@ -19,22 +19,15 @@ from devsecops_engine_tools.engine_sast.engine_iac.src.infrastructure.driven_ada
 from devsecops_engine_tools.engine_sast.engine_iac.src.infrastructure.helpers.file_generator_tool import (
     generate_file_from_tool,
 )
-from devsecops_engine_tools.engine_utilities.github.infrastructure.github_api import (
-    GithubApi,
-)
-from devsecops_engine_tools.engine_utilities.ssh.managment_private_key import (
-    create_ssh_private_file,
-    add_ssh_private_key,
-    decode_base64,
-    config_knowns_hosts,
-)
 from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
 from devsecops_engine_tools.engine_utilities import settings
+from devsecops_engine_tools.engine_utilities.utils.utils import Utils
 
 logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 
 
 class CheckovTool(ToolGateway):
+    
     CHECKOV_CONFIG_FILE = "checkov_config.yaml"
     TOOL_CHECKOV = "CHECKOV"
     framework_mapping = {
@@ -62,43 +55,6 @@ class CheckovTool(ToolGateway):
             yaml.dump(checkov_config.dict_confg_file, file)
             file.close()
 
-    def configurate_external_checks(self, config_tool, secret):
-        agent_env = None
-        try:
-            if secret is None:
-                logger.warning("The secret is not configured for external controls")
-
-            # Create configuration git external checks
-            elif config_tool[self.TOOL_CHECKOV][
-                "USE_EXTERNAL_CHECKS_GIT"
-            ] == "True" and platform.system() in (
-                "Linux",
-                "Darwin",
-            ):
-                config_knowns_hosts(
-                    config_tool[self.TOOL_CHECKOV]["EXTERNAL_GIT_SSH_HOST"],
-                    config_tool[self.TOOL_CHECKOV][
-                        "EXTERNAL_GIT_PUBLIC_KEY_FINGERPRINT"
-                    ],
-                )
-                ssh_key_content = decode_base64(secret["repository_ssh_private_key"])
-                ssh_key_file_path = "/tmp/ssh_key_file"
-                create_ssh_private_file(ssh_key_file_path, ssh_key_content)
-                ssh_key_password = decode_base64(secret["repository_ssh_password"])
-                agent_env = add_ssh_private_key(ssh_key_file_path, ssh_key_password)
-
-            # Create configuration dir external checks
-            elif config_tool[self.TOOL_CHECKOV]["USE_EXTERNAL_CHECKS_DIR"] == "True":
-                github_api = GithubApi(secret["github_token"])
-                github_api.download_latest_release_assets(
-                    config_tool[self.TOOL_CHECKOV]["EXTERNAL_DIR_OWNER"],
-                    config_tool[self.TOOL_CHECKOV]["EXTERNAL_DIR_REPOSITORY"],
-                    "/tmp",
-                )
-
-        except Exception as ex:
-            logger.error(f"An error ocurred configuring external checks {ex}")
-        return agent_env
 
     def retryable_install_package(self, package: str, version: str) -> bool:
         MAX_RETRIES = 3
@@ -258,29 +214,8 @@ class CheckovTool(ToolGateway):
         secret_tool,
         secret_external_checks,
     ):
-        secret = None
-        if secret_tool is not None:
-            secret = secret_tool
-        elif secret_external_checks is not None:
-            secret = {
-                "github_token": (
-                    secret_external_checks.split("github:")[1]
-                    if "github" in secret_external_checks
-                    else None
-                ),
-                "repository_ssh_private_key": (
-                    secret_external_checks.split("ssh:")[1].split(":")[0]
-                    if "ssh" in secret_external_checks
-                    else None
-                ),
-                "repository_ssh_password": (
-                    secret_external_checks.split("ssh:")[1].split(":")[1]
-                    if "ssh" in secret_external_checks
-                    else None
-                ),
-            }
-
-        agent_env = self.configurate_external_checks(config_tool, secret)
+        util = Utils()
+        agent_env = util.configurate_external_checks(self.TOOL_CHECKOV,config_tool, secret_tool,secret_external_checks)
 
         checkov_install = self.retryable_install_package(
             "checkov", config_tool[self.TOOL_CHECKOV]["VERSION"]
@@ -310,4 +245,4 @@ class CheckovTool(ToolGateway):
                 ),
             )
         else:
-            return [], None
+            return [], None

{devsecops_engine_tools-1.20.0 → devsecops_engine_tools-1.22.0}/devsecops_engine_tools/engine_sast/engine_secret/src/domain/model/DeserializeConfigTool.py

@@ -12,5 +12,7 @@ class DeserializeConfigTool:
         self.enable_custom_rules = json_data[tool]["ENABLE_CUSTOM_RULES"]
         self.external_dir_owner = json_data[tool]["EXTERNAL_DIR_OWNER"]
         self.external_dir_repo = json_data[tool]["EXTERNAL_DIR_REPOSITORY"]
+        self.app_id_github = json_data[tool]["APP_ID_GITHUB"]
+        self.installation_id_github = json_data[tool]["INSTALLATION_ID_GITHUB"]
         self.tool_version = json_data[tool]["VERSION"]
         self.extradata_rules = json_data[tool]["RULES"]

{devsecops_engine_tools-1.20.0 → devsecops_engine_tools-1.22.0}/devsecops_engine_tools/engine_sast/engine_secret/src/infrastructure/driven_adapters/trufflehog/trufflehog_run.py

@@ -73,9 +73,15 @@ class TrufflehogRun(ToolGateway):
         include_paths = self.config_include_path(files_commits, agent_work_folder, agent_os)
         enable_custom_rules = config_tool.enable_custom_rules.lower()
         secret = None
-        
+        github_api = GithubApi()
+
         if secret_tool is not None:
-            secret = secret_tool["github_token"] if "github_token" in secret_tool else None
+            secret_tmp = secret_tool
+            secret = github_api.get_installation_access_token(
+                secret_tmp["github_token"],
+                config_tool.app_id_github,
+                config_tool.installation_id_github
+            )
         elif secret_external_checks is not None:
             secret = secret_external_checks.split("github:")[1] if "github" in secret_external_checks else None            
 
@@ -161,10 +167,11 @@ class TrufflehogRun(ToolGateway):
     
     def configurate_external_checks(self, config_tool, secret):
         try:
-            github_api = GithubApi(secret)
+            github_api = GithubApi()
             github_api.download_latest_release_assets(
                 config_tool.external_dir_owner,
                 config_tool.external_dir_repo,
+                secret,
                 "/tmp",
             )
         except Exception as ex:

{devsecops_engine_tools-1.20.0 → devsecops_engine_tools-1.22.0}/devsecops_engine_tools/engine_utilities/github/infrastructure/github_api.py

@@ -1,28 +1,28 @@
 import requests
 import zipfile
 import json
-from github import Github
+from github import Github, GithubIntegration
 from devsecops_engine_tools.engine_utilities.utils.api_error import ApiError
 
 
 class GithubApi:
-    def __init__(
-            self,
-            personal_access_token: str = ""
-    ):
-        self.__personal_access_token = personal_access_token
 
     def unzip_file(self, zip_file_path, extract_path):
         with zipfile.ZipFile(zip_file_path, "r") as zip_ref:
             zip_ref.extractall(extract_path)
+    
+    def get_installation_access_token(self,private_key,app_id,instalation_id):
+        if private_key:
+            private_key = private_key.replace("\\n", "\n")
+        integration = GithubIntegration(app_id, private_key)
+        access_token = integration.get_access_token(instalation_id)
+        return access_token.token
 
     def download_latest_release_assets(
-        self, owner, repository, download_path="."
-    ):
+        self, owner, repository, token, download_path=".",
+    ):               
         url = f"https://api.github.com/repos/{owner}/{repository}/releases/latest"
-
-        headers = {"Authorization": f"token {self.__personal_access_token}"}
-
+        headers = {"Authorization": f"token {token}", "Accept": "application/vnd.github+json"}
         response = requests.get(url, headers=headers)
 
         if response.status_code == 200:
@@ -32,11 +32,8 @@ class GithubApi:
             for asset in assets:
                 asset_url = asset["url"]
                 asset_name = asset["name"]
-
                 headers.update({"Accept": "application/octet-stream"})
-
                 response = requests.get(asset_url, headers=headers, stream=True)
-
                 if response.status_code == 200:
                     with open(f"{download_path}/{asset_name}", "wb") as file:
                         for chunk in response.iter_content(chunk_size=8192):
@@ -51,9 +48,8 @@ class GithubApi:
                 f"Error getting the assets of the last release. Status code: {response.status_code}"
             )
 
-    def get_github_connection(self):
-        git_client = Github(self.__personal_access_token)
-
+    def get_github_connection(self,personal_access_token):
+        git_client = Github(personal_access_token)
         return git_client
 
     def get_remote_json_config(self, git_client: Github, owner, repository, path):
@@ -65,4 +61,4 @@ class GithubApi:
 
             return content_json
         except Exception as e:
-            raise ApiError("Error getting remote github configuration file: " + str(e))
+            raise ApiError("Error getting remote github configuration file: " + str(e))

{devsecops_engine_tools-1.20.0 → devsecops_engine_tools-1.22.0}/devsecops_engine_tools/engine_utilities/sonarqube/src/infrastructure/entry_points/entry_point_report_sonar.py

@@ -26,8 +26,9 @@ def init_report_sonar(vulnerability_management_gateway, secrets_manager_gateway,
     branch = devops_platform_gateway.get_variable("branch_name")
     is_valid_pipeline = not re.match(report_config_tool["IGNORE_SEARCH_PATTERN"], pipeline_name, re.IGNORECASE)
     is_valid_branch = branch in report_config_tool["TARGET_BRANCHES"]
-
-    if config_tool["REPORT_SONAR"]["ENABLED"] == "true" and is_valid_pipeline and is_valid_branch:
+    is_enabled = config_tool["REPORT_SONAR"]["ENABLED"] == "true"
+    
+    if is_enabled and is_valid_pipeline and is_valid_branch:
         input_core = ReportSonar(
             vulnerability_management_gateway,
             secrets_manager_gateway, 
@@ -40,7 +41,10 @@ def init_report_sonar(vulnerability_management_gateway, secrets_manager_gateway,
                 config_tool, input_core, {"tool": "report_sonar"}, ""
             )
     else:
+        if not is_enabled: message = "DevSecOps Engine Tool - {0} in maintenance...".format("report_sonar")
+        else: message = "Tool skipped by DevSecOps policy"
+
         print(
             devops_platform_gateway.message(
-                "warning", "DevSecOps Engine Tool - {0} in maintenance...".format("report_sonar")),
+                "warning", message),
         )

devsecops_engine_tools-1.22.0/devsecops_engine_tools/engine_utilities/utils/utils.py

@@ -0,0 +1,138 @@
+import zipfile
+import platform
+from devsecops_engine_tools.engine_utilities.github.infrastructure.github_api import (
+    GithubApi,
+)
+from devsecops_engine_tools.engine_utilities.ssh.managment_private_key import (
+    create_ssh_private_file,
+    add_ssh_private_key,
+    decode_base64,
+    config_knowns_hosts,
+)
+from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
+from devsecops_engine_tools.engine_utilities import settings
+logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
+import base64
+import re
+
+from devsecops_engine_tools.engine_core.src.domain.model.threshold import Threshold
+from devsecops_engine_tools.engine_core.src.domain.model.level_vulnerability import (
+    LevelVulnerability,
+)
+from devsecops_engine_tools.engine_core.src.domain.model.level_compliance import (
+    LevelCompliance,
+)
+
+
+class Utils:
+
+    def unzip_file(self, zip_file_path, extract_path):
+        with zipfile.ZipFile(zip_file_path, "r") as zip_ref:
+            zip_ref.extractall(extract_path)
+
+    def configurate_external_checks(self, tool, config_tool, secret_tool, secret_external_checks):
+        try:
+            agent_env = None
+            secret = None
+            github_token = None
+            github_api = GithubApi()
+
+            if secret_tool is not None:
+                secret = secret_tool
+                github_token = github_api.get_installation_access_token(
+                    secret["github_token"],
+                    config_tool[tool]["APP_ID_GITHUB"],
+                    config_tool[tool]["INSTALLATION_ID_GITHUB"]
+                )
+
+            elif secret_external_checks is not None:
+                secret_external_checks_parts = {
+                    "github_token": (
+                        secret_external_checks.split("github_token:")[1]
+                        if "github_token" in secret_external_checks
+                        else None
+                    ),
+                    "github_apps": (
+                        secret_external_checks.split("github_apps:")[1]
+                        if "github_apps" in secret_external_checks
+                        else None
+                    ),
+                    "repository_ssh_private_key": (
+                        secret_external_checks.split("ssh:")[1].split(":")[0]
+                        if "ssh" in secret_external_checks
+                        else None
+                    ),
+                    "repository_ssh_password": (
+                        secret_external_checks.split("ssh:")[1].split(":")[1]
+                        if "ssh" in secret_external_checks
+                        else None
+                    ),
+                }
+
+                secret = {
+                    key: secret_external_checks_parts[key]
+                    for key in secret_external_checks_parts
+                    if secret_external_checks_parts[key] is not None
+                }
+
+            if secret is None:
+                logger.warning("The secret is not configured for external controls")
+
+            
+            elif config_tool[tool]["USE_EXTERNAL_CHECKS_GIT"] == "True" and platform.system() in (
+                "Linux", "Darwin",
+            ):
+                config_knowns_hosts(
+                    config_tool[tool]["EXTERNAL_GIT_SSH_HOST"],
+                    config_tool[tool]["EXTERNAL_GIT_PUBLIC_KEY_FINGERPRINT"],
+                )
+                ssh_key_content = decode_base64(secret["repository_ssh_private_key"])
+                ssh_key_file_path = "/tmp/ssh_key_file"
+                create_ssh_private_file(ssh_key_file_path, ssh_key_content)
+                ssh_key_password = decode_base64(secret["repository_ssh_password"])
+                agent_env = add_ssh_private_key(ssh_key_file_path, ssh_key_password)
+
+            elif config_tool[tool]["USE_EXTERNAL_CHECKS_DIR"] == "True":
+                if not github_token:
+                    github_token = github_api.get_installation_access_token(
+                        secret.get("github_apps"),
+                        config_tool[tool]["APP_ID_GITHUB"],
+                        config_tool[tool]["INSTALLATION_ID_GITHUB"]
+                    ) if secret.get("github_apps") else secret.get("github_token") 
+                github_api.download_latest_release_assets(
+                    config_tool[tool]["EXTERNAL_DIR_OWNER"],
+                    config_tool[tool]["EXTERNAL_DIR_REPOSITORY"],
+                    github_token,
+                    "/tmp",
+                )
+
+        except Exception as ex:
+            logger.error(f"An error occurred configuring external checks: {ex}")
+        return agent_env
+    
+    def encode_token_to_base64(self, token):
+        token_bytes = f"{token}:".encode("utf-8")
+        base64_token = base64.b64encode(token_bytes).decode("utf-8")
+        return base64_token
+
+    def update_threshold(self, threshold: Threshold, exclusions_data, pipeline_name):
+        def set_threshold(new_threshold):
+            threshold.vulnerability = LevelVulnerability(new_threshold.get("VULNERABILITY"))
+            threshold.compliance = LevelCompliance(new_threshold.get("COMPLIANCE")) if new_threshold.get("COMPLIANCE") else threshold.compliance
+            threshold.cve = new_threshold.get("CVE") if new_threshold.get("CVE") is not None else threshold.cve
+            return threshold
+
+        threshold_pipeline = exclusions_data.get(pipeline_name, {}).get("THRESHOLD", {})
+        if threshold_pipeline:
+            return set_threshold(threshold_pipeline)
+
+        search_patterns = exclusions_data.get("BY_PATTERN_SEARCH", {})
+        
+        match_pattern = next(
+            (v["THRESHOLD"]
+            for pattern, v in search_patterns.items()
+            if re.match(pattern, pipeline_name, re.IGNORECASE)),
+            None
+        )
+
+        return set_threshold(match_pattern) if match_pattern else threshold

devsecops_engine_tools-1.22.0/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.22.0'

{devsecops_engine_tools-1.20.0 → devsecops_engine_tools-1.22.0}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.20.0
+Version: 1.22.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

devsecops_engine_tools-1.20.0/devsecops_engine_tools/engine_utilities/utils/utils.py

@@ -1,45 +0,0 @@
-import zipfile
-import base64
-import re
-
-from devsecops_engine_tools.engine_core.src.domain.model.threshold import Threshold
-from devsecops_engine_tools.engine_core.src.domain.model.level_vulnerability import (
-    LevelVulnerability,
-)
-from devsecops_engine_tools.engine_core.src.domain.model.level_compliance import (
-    LevelCompliance,
-)
-
-
-class Utils:
-
-    def unzip_file(self, zip_file_path, extract_path):
-        with zipfile.ZipFile(zip_file_path, "r") as zip_ref:
-            zip_ref.extractall(extract_path)
-
-    def encode_token_to_base64(self, token):
-        token_bytes = f"{token}:".encode("utf-8")
-        base64_token = base64.b64encode(token_bytes).decode("utf-8")
-        return base64_token
-
-    def update_threshold(self, threshold: Threshold, exclusions_data, pipeline_name):
-        def set_threshold(new_threshold):
-            threshold.vulnerability = LevelVulnerability(new_threshold.get("VULNERABILITY"))
-            threshold.compliance = LevelCompliance(new_threshold.get("COMPLIANCE")) if new_threshold.get("COMPLIANCE") else threshold.compliance
-            threshold.cve = new_threshold.get("CVE") if new_threshold.get("CVE") is not None else threshold.cve
-            return threshold
-
-        threshold_pipeline = exclusions_data.get(pipeline_name, {}).get("THRESHOLD", {})
-        if threshold_pipeline:
-            return set_threshold(threshold_pipeline)
-
-        search_patterns = exclusions_data.get("BY_PATTERN_SEARCH", {})
-        
-        match_pattern = next(
-            (v["THRESHOLD"]
-            for pattern, v in search_patterns.items()
-            if re.match(pattern, pipeline_name, re.IGNORECASE)),
-            None
-        )
-
-        return set_threshold(match_pattern) if match_pattern else threshold

devsecops_engine_tools-1.20.0/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.20.0'