devsecops-engine-tools 1.56.4__tar.gz → 1.57.0__tar.gz

{devsecops_engine_tools-1.56.4 → devsecops_engine_tools-1.57.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.56.4
+Version: 1.57.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.56.4 → devsecops_engine_tools-1.57.0}/devsecops_engine_tools/engine_core/src/applications/runner_engine_core.py

@@ -123,6 +123,13 @@ def get_inputs_from_cli(args):
         required=False,
         help="Folder Path to scan, only apply engine_iac, engine_code, engine_secret and engine_dependencies tools",
     )
+    parser.add_argument(
+        "-tr",
+        "--terraform_repo_root",
+        type=str,
+        required=False,
+        help="Folder Path containing the terraform code used to generate a given plan file, only apply engine_iac with checkov",
+    )
     parser.add_argument(
         "-p",
         "--platform",
@@ -223,6 +230,7 @@ def get_inputs_from_cli(args):
         "tool": args.tool,
         "module": args.module,
         "folder_path": args.folder_path,
+        "terraform_repo_root": args.terraform_repo_root,
         "platform": args.platform,
         "use_secrets_manager": args.use_secrets_manager,
         "use_vulnerability_management": args.use_vulnerability_management,

{devsecops_engine_tools-1.56.4 → devsecops_engine_tools-1.57.0}/devsecops_engine_tools/engine_risk/src/infrastructure/driven_adapters/first_csv/first_epss_csv.py

@@ -16,7 +16,7 @@ logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 
 class FirstCsv(AddEpssGateway):
     def download_epss_data(self):
-        base_url = "https://epss.cyentia.com/epss_scores-{}.csv.gz"
+        base_url = "https://epss.empiricalsecurity.com/epss_scores-{}.csv.gz"
         date = datetime.datetime.now()
         attempts = 0
         while attempts < 2:

{devsecops_engine_tools-1.56.4 → devsecops_engine_tools-1.57.0}/devsecops_engine_tools/engine_sast/engine_iac/src/domain/usecases/iac_scan.py

@@ -48,6 +48,7 @@ class IacScan:
                 secret_tool=secret_tool,
                 secret_external_checks=dict_args["token_external_checks"],
                 work_folder=self.devops_platform_gateway.get_variable("temp_directory"),
+                dict_args=dict_args
             )
         else:
             print("Tool skipped by DevSecOps policy")

{devsecops_engine_tools-1.56.4 → devsecops_engine_tools-1.57.0}/devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_config.py

@@ -22,7 +22,8 @@ class CheckovConfigEnum(Enum):
     DOCKERFILEPATH = "dockerfile-path"
     EXTERNAL_CHECKS_GIT = "external-checks-git"
     SKIP_DOWNLOAD = "skip-download"
-
+    REPO_ROOT_FOR_PLAN_ENRICHMENT = "repo-root-for-plan-enrichment"
+    DEEP_ANALYSIS = "deep-analysis"
 
 class CheckovConfig:
     dict_confg_file = {}
@@ -45,6 +46,8 @@ class CheckovConfig:
         external_checks_git=None,
         skip_checks=None,
         skip_download=True,
+        repo_root_for_plan_enrichment=None,
+        deep_analysis=None
     ):
         self.path_config_file = path_config_file
         self.config_file_name = config_file_name
@@ -62,6 +65,8 @@ class CheckovConfig:
         self.skip_checks = skip_checks
         self.skip_download = skip_download
         self.env = env
+        self.repo_root_for_plan_enrichment = repo_root_for_plan_enrichment
+        self.deep_analysis = deep_analysis
 
     def create_config_dict(self):
         if self.framework is not None:
@@ -111,6 +116,20 @@ class CheckovConfig:
             raise ValueError(
                 MESSAGE_VALUE + CheckovConfigEnum.DIRECTORIES.value + MESSAGE_NIL
             )
+    
+        if self.repo_root_for_plan_enrichment is not None:
+            self.dict_confg_file[
+                CheckovConfigEnum.REPO_ROOT_FOR_PLAN_ENRICHMENT.value
+            ] = self.repo_root_for_plan_enrichment
+        else:
+            self.dict_confg_file.pop(CheckovConfigEnum.REPO_ROOT_FOR_PLAN_ENRICHMENT.value, None)
+    
+        if self.deep_analysis is not None:
+            self.dict_confg_file[
+                CheckovConfigEnum.DEEP_ANALYSIS.value
+            ] = self.deep_analysis
+        else:
+            self.dict_confg_file.pop(CheckovConfigEnum.DEEP_ANALYSIS.value, None)
 
         if self.evaluate_variables is not None:
             self.dict_confg_file[

{devsecops_engine_tools-1.56.4 → devsecops_engine_tools-1.57.0}/devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_tool.py

@@ -148,7 +148,8 @@ class CheckovTool(ToolGateway):
         agent_env,
         environment,
         platform_to_scan,
-        command_prefix
+        command_prefix,
+        dict_args
     ):
         output_queue = queue.Queue()
         # Crea una lista para almacenar los hilos
@@ -160,8 +161,10 @@ class CheckovTool(ToolGateway):
                     elem.upper() in rule for elem in platform_to_scan
                 ):
                     framework = [self.framework_mapping[rule]]
+                    repo_root = None
                     if "terraform" in platform_to_scan or ("all" in platform_to_scan and self.framework_mapping[rule] == "terraform"): 
                         framework.append("terraform_plan")
+                        repo_root = dict_args.get("terraform_repo_root", None)
 
                     checkov_config = CheckovConfig(
                         path_config_file="",
@@ -192,6 +195,12 @@ class CheckovTool(ToolGateway):
                             and rule in self.framework_external_checks
                             else []
                         ),
+                        repo_root_for_plan_enrichment=repo_root,
+                        deep_analysis=(
+                            True
+                            if repo_root
+                            else None
+                        )
                     )
 
                     checkov_config.create_config_dict()
@@ -240,7 +249,7 @@ class CheckovTool(ToolGateway):
         
         if command_prefix is not None:
             result_scans, rules_run = self.scan_folders(
-                folders_to_scan, config_tool, agent_env, environment, platform_to_scan, command_prefix
+                folders_to_scan, config_tool, agent_env, environment, platform_to_scan, command_prefix, kwargs.get("dict_args")
             )
 
             checkov_deserealizator = CheckovDeserealizator()

devsecops_engine_tools-1.57.0/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.57.0'

{devsecops_engine_tools-1.56.4 → devsecops_engine_tools-1.57.0}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.56.4
+Version: 1.57.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

devsecops_engine_tools-1.56.4/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.56.4'