devsecops-engine-tools 1.42.4__tar.gz → 1.43.1__tar.gz

{devsecops_engine_tools-1.42.4 → devsecops_engine_tools-1.43.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.42.4
+Version: 1.43.1
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.42.4 → devsecops_engine_tools-1.43.1}/devsecops_engine_tools/engine_sca/engine_container/src/domain/model/gateways/images_gateway.py

@@ -9,3 +9,7 @@ class ImagesGateway(metaclass=ABCMeta):
     @abstractmethod
     def get_base_image(self, image_to_scan) -> str:
         "get base image"
+
+    @abstractmethod
+    def validate_base_image_date(self, image_to_scan, referenced_date) -> str:
+        "validate base image date"

{devsecops_engine_tools-1.42.4 → devsecops_engine_tools-1.43.1}/devsecops_engine_tools/engine_sca/engine_container/src/domain/usecases/container_sca_scan.py

@@ -22,7 +22,8 @@ class ContainerScaScan:
         secret_tool,
         token_engine_container,
         image_to_scan,
-        exclusions
+        exclusions,
+        pipeline_name,
     ):
         self.tool_run = tool_run
         self.remote_config = remote_config
@@ -33,6 +34,7 @@ class ContainerScaScan:
         self.token_engine_container = token_engine_container
         self.image_to_scan = image_to_scan
         self.exclusions = exclusions
+        self.pipeline_name = pipeline_name
 
     def get_image(self, image_to_scan):
         """
@@ -44,13 +46,13 @@ class ContainerScaScan:
         return self.tool_images.list_images(image_to_scan)
 
     def get_base_image(self, matching_image):
-            """
+        """
             Process the base image.
 
             Returns:
                 String: base image.
             """
-            return self.tool_images.get_base_image(matching_image)
+        return self.tool_images.get_base_image(matching_image)
 
     def get_images_already_scanned(self):
         """
@@ -70,6 +72,17 @@ class ContainerScaScan:
         with open("scanned_images.txt", "a") as file:
             file.write(result_file + "\n")
 
+    def validate_base_image_date(self, matching_image, referenced_date):
+        """
+        Process the base image date validation.
+
+        Returns:
+            string: base image date.
+        """
+        return self.tool_images.validate_base_image_date(
+            matching_image, referenced_date
+        )
+
     def process(self):
         """
         Process SCA scanning.
@@ -80,8 +93,17 @@ class ContainerScaScan:
         base_image = None
         image_scanned = None
         matching_image = self.get_image(self.image_to_scan)
-        if self.remote_config['GET_IMAGE_BASE']:
+        if self.remote_config["GET_IMAGE_BASE"]:
             base_image = self.get_base_image(matching_image)
+        if self.remote_config["VALIDATE_BASE_IMAGE_DATE"][
+            "ENABLED"
+        ] and not self.exclusions.get(self.pipeline_name, {}).get(
+            "VALIDATE_BASE_IMAGE_DATE"
+        ):
+            self.validate_base_image_date(
+                matching_image,
+                self.remote_config["VALIDATE_BASE_IMAGE_DATE"]["REFERENCE_IMAGE_DATE"],
+            )
         sbom_components = None
         generate_sbom = self.remote_config["SBOM"]["ENABLED"] and any(
             branch in str(self.branch)
@@ -98,7 +120,9 @@ class ContainerScaScan:
                 self.secret_tool,
                 self.token_engine_container,
                 image_name,
-                result_file, base_image, self.exclusions,
+                result_file,
+                base_image,
+                self.exclusions,
                 generate_sbom,
             )
             self.set_image_scanned(image_name)

devsecops_engine_tools-1.43.1/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/docker/docker_images.py

@@ -0,0 +1,122 @@
+from datetime import datetime
+from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.gateways.images_gateway import (
+    ImagesGateway,
+)
+import docker
+
+from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
+from devsecops_engine_tools.engine_utilities import settings
+
+logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
+
+
+class DockerImages(ImagesGateway):
+    def list_images(self, image_to_scan):
+        try:
+            client = docker.from_env()
+            images = client.images.list()
+
+            matching_image = None
+            for image in images:
+                if any(image_to_scan in tag for tag in image.tags):
+                    matching_image = image
+                    break
+
+            if matching_image:
+                print("ID matching image:", matching_image.id)
+                print("Tag matching image:", matching_image.tags)
+                print("Created date matching image:", matching_image.attrs["Created"])
+                return matching_image
+
+        except Exception as e:
+            logger.error(
+                f"Error listing images, docker must be running and added to PATH: {e}"
+            )
+
+    def get_base_image(self, matching_image):
+        try:
+            image_details = self.get_image_details(matching_image.id)
+            if not image_details:
+                return None
+
+            labels = image_details.get("Config", {}).get("Labels", {})
+            return self.extract_base_image_from_labels(labels, matching_image)
+        except Exception as e:
+            logger.warning(f"Error obtaining base image: {e}")
+            return None
+
+    def validate_base_image_date(self, matching_image, referenced_date):
+        if matching_image is None or matching_image.id is None:
+            logger.error("Error: matching_image ID is None")
+            return False
+        image_details = self.get_image_details(matching_image.id)
+        if not image_details:
+            return False
+
+        labels = image_details.get("Config", {}).get("Labels", {})
+        baseline_date = labels.get("x86.baseline.date")
+
+        if baseline_date:
+            date_image = self.parse_date(baseline_date)
+        else:
+            base_image = self.extract_base_image_from_labels(labels)
+            date_image = self.extract_date_from_image(base_image)
+
+        return self.validate_date(date_image, referenced_date)
+
+    def get_image_details(self, image_id):
+        try:
+            client = docker.from_env()
+            return client.api.inspect_image(image_id)
+        except Exception as e:
+            logger.error(f"Error obtaining image details for '{image_id}': {e}")
+            return None
+
+    def extract_base_image_from_labels(self, labels, matching_image=None):
+        try:
+            source_image = labels.get("x86.image.name") or labels.get(
+                "image.base.ref.name"
+            )
+            if not source_image:
+                source_image = labels.get("source_images") or labels.get("source-image")
+
+            if source_image and matching_image:
+                logger.info(f"Base image for '{matching_image}' found: {source_image}")
+            elif matching_image:
+                logger.warning(f"Base image not found for '{matching_image}'.")
+
+            return source_image
+        except Exception as e:
+            logger.error(f"Error extracting base image from labels: {e}")
+            return None
+
+    def extract_date_from_image(self, image_name):
+        if not image_name:
+            return None
+        try:
+            date = image_name.split("_")[-1]
+            return self.parse_date(date)
+        except Exception as e:
+            logger.error(f"Error extracting date from image name '{image_name}': {e}")
+            return None
+
+    def parse_date(self, date_str):
+        try:
+            return datetime.strptime(date_str, "%Y%m%d")
+        except ValueError:
+            logger.error(f"Invalid date format: {date_str}")
+            return None
+
+    def validate_date(self, date, referenced_date):
+        if not date:
+            raise ValueError("Cannot validate date: Invalid or missing date.")
+
+        reference_date = self.parse_date(referenced_date)
+        if not reference_date:
+            raise ValueError("Cannot validate date: Referenced date is invalid.")
+
+        if date < reference_date:
+            raise ValueError(
+                f"Compliance issue: the source base image date ({date.strftime('%Y-%m-%d')}) is older than the referenced date ({reference_date.strftime('%Y-%m-%d')})."
+            )
+        return True

{devsecops_engine_tools-1.42.4 → devsecops_engine_tools-1.43.1}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/entry_points/entry_point_tool.py

@@ -52,7 +52,8 @@ def init_engine_sca_rm(
             secret_tool,
             dict_args["token_engine_container"],
             image_to_scan,
-            exclusions
+            exclusions,
+            pipeline_name
         )
         image_scanned, base_image, sbom_components = container_sca_scan.process()
         if image_scanned:

devsecops_engine_tools-1.43.1/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.43.1'

{devsecops_engine_tools-1.42.4 → devsecops_engine_tools-1.43.1}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.42.4
+Version: 1.43.1
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

devsecops_engine_tools-1.42.4/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/docker/docker_images.py

@@ -1,50 +0,0 @@
-from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.gateways.images_gateway import (
-    ImagesGateway,
-)
-import docker
-
-from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
-from devsecops_engine_tools.engine_utilities import settings
-
-logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
-
-
-class DockerImages(ImagesGateway):
-    def list_images(self, image_to_scan):
-        try:
-            client = docker.from_env()
-            images = client.images.list()
-
-            matching_image = None
-            for image in images:
-                if any(image_to_scan in tag for tag in image.tags):
-                    matching_image = image
-                    break
-
-            if matching_image:
-                print("ID matching image:", matching_image.id)
-                print("Tag matching image:", matching_image.tags)
-                print("Created date matching image:", matching_image.attrs["Created"])
-                return matching_image
-
-        except Exception as e:
-            logger.error(
-                f"Error listing images, docker must be running and added to PATH: {e}"
-            )
-
-    def get_base_image(self, matching_image):
-        try:
-            client = docker.from_env()
-            image_details = client.api.inspect_image(matching_image.id)
-            labels = image_details.get("Config", {}).get("Labels", {})
-            source_image = labels.get("x86.image.name")
-            if source_image:
-                logger.info(f"Base image for '{matching_image}' from source-image label: {source_image}")
-                return source_image
-
-            logger.warning(f"Base image not found for '{matching_image}'.")
-            return None
-
-        except Exception as e:
-            logger.error(f"Error getting base image: {e}")
-            return None

devsecops_engine_tools-1.42.4/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.42.4'