devsecops-engine-tools 1.56.5__tar.gz → 1.58.0__tar.gz

{devsecops_engine_tools-1.56.5 → devsecops_engine_tools-1.58.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.56.5
+Version: 1.58.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team
@@ -32,6 +32,7 @@ Requires-Dist: ruamel.yaml==0.18.6
 Requires-Dist: Authlib==1.3.2
 Requires-Dist: PyJWT==2.9.0
 Requires-Dist: sympy==1.13.3
+Requires-Dist: holidays==0.58
 
 # DevSecOps Engine Tools
 

{devsecops_engine_tools-1.56.5 → devsecops_engine_tools-1.58.0}/devsecops_engine_tools/engine_core/src/applications/runner_engine_core.py

@@ -123,6 +123,13 @@ def get_inputs_from_cli(args):
         required=False,
         help="Folder Path to scan, only apply engine_iac, engine_code, engine_secret and engine_dependencies tools",
     )
+    parser.add_argument(
+        "-tr",
+        "--terraform_repo_root",
+        type=str,
+        required=False,
+        help="Folder Path containing the terraform code used to generate a given plan file, only apply engine_iac with checkov",
+    )
     parser.add_argument(
         "-p",
         "--platform",
@@ -223,6 +230,7 @@ def get_inputs_from_cli(args):
         "tool": args.tool,
         "module": args.module,
         "folder_path": args.folder_path,
+        "terraform_repo_root": args.terraform_repo_root,
         "platform": args.platform,
         "use_secrets_manager": args.use_secrets_manager,
         "use_vulnerability_management": args.use_vulnerability_management,

{devsecops_engine_tools-1.56.5 → devsecops_engine_tools-1.58.0}/devsecops_engine_tools/engine_risk/src/domain/usecases/break_build.py

@@ -15,6 +15,8 @@ from collections import Counter
 import copy
 import sympy as sp
 import math
+from datetime import datetime, timedelta
+import holidays
 
 
 class BreakBuild:
@@ -138,7 +140,16 @@ class BreakBuild:
         formula = sp.Eq(
             remediation_rate_name,
             100
-            * (mitigated_name / (all_findings_name - new_findings - white_list_name - transferred_name - base_image_name)),
+            * (
+                mitigated_name
+                / (
+                    all_findings_name
+                    - new_findings
+                    - white_list_name
+                    - transferred_name
+                    - base_image_name
+                )
+            ),
         )
         print("\n")
         sp.pretty_print(formula)
@@ -167,7 +178,13 @@ class BreakBuild:
         print(
             f"Mitigated: {mitigated_count}   AllFindings: {all_findings_count}   BaseImage: {base_image_count}   NewFindings: {self.policy_excluded}   Transferred: {transferred_list_count}   WhiteList: {white_list_count}\n\n"
         )
-        total = all_findings_count - self.policy_excluded - white_list_count - base_image_count - transferred_list_count
+        total = (
+            all_findings_count
+            - self.policy_excluded
+            - white_list_count
+            - base_image_count
+            - transferred_list_count
+        )
 
         if total == 0:
             print(
@@ -198,7 +215,9 @@ class BreakBuild:
             )
             self.warning_build = True
         else:
-            missing_findings = math.ceil((risk_threshold / 100 * total) - mitigated_count)
+            missing_findings = math.ceil(
+                (risk_threshold / 100 * total) - mitigated_count
+            )
             print(
                 self.devops_platform_gateway.message(
                     "error",
@@ -281,62 +300,85 @@ class BreakBuild:
         remote_config = self.remote_config
         if report_list:
             tag_blacklist = set(remote_config["TAG_BLACKLIST_EXCLUSION_DAYS"].keys())
+            colombian_holidays = holidays.Colombia()
 
-            filtered_reports_above_threshold = [
-                (report, tag)
-                for report in report_list
-                for tag in report.tags
-                if tag in tag_blacklist
-                and report.age >= remote_config["TAG_BLACKLIST_EXCLUSION_DAYS"][tag]
-            ]
+        def calculate_working_days(start_date, days):
+            current_date = start_date
+            working_days = 0
+            while working_days < days:
+                current_date += timedelta(days=1)
+                if (
+                    current_date.weekday() < 5
+                    and current_date not in colombian_holidays
+                ):
+                    working_days += 1
+            return current_date
 
-            filtered_reports_below_threshold = [
-                (report, tag)
-                for report in report_list
-                for tag in report.tags
-                if tag in tag_blacklist
-                and report.age < remote_config["TAG_BLACKLIST_EXCLUSION_DAYS"][tag]
-            ]
+        filtered_reports_above_threshold = []
+        filtered_reports_below_threshold = []
 
-            for report, tag in filtered_reports_above_threshold:
-                report.reason = "Blacklisted"
-                print(
-                    self.devops_platform_gateway.message(
-                        "error",
-                        f"Report {report.vm_id} with tag '{tag}' is blacklisted and age {report.age} is above threshold {remote_config['TAG_BLACKLIST_EXCLUSION_DAYS'][tag]}",
-                    )
+        for report in report_list:
+            for tag in report.tags:
+                if tag in tag_blacklist:
+                    exclusion_value = remote_config["TAG_BLACKLIST_EXCLUSION_DAYS"][tag]
+                    if isinstance(exclusion_value, str) and "WD" in exclusion_value:
+                        working_days_threshold = int(exclusion_value.replace("WD", ""))
+                        report_created_date = datetime.strptime(
+                            report.created.split("T")[0], "%Y-%m-%d"
+                        )
+                        threshold_date = calculate_working_days(
+                            report_created_date, working_days_threshold
+                        )
+                        if datetime.now() >= threshold_date:
+                            filtered_reports_above_threshold.append((report, tag))
+                        else:
+                            filtered_reports_below_threshold.append((report, tag))
+                    else:
+                        numeric_threshold = int(exclusion_value)
+                        if report.age >= numeric_threshold:
+                            filtered_reports_above_threshold.append((report, tag))
+                        else:
+                            filtered_reports_below_threshold.append((report, tag))
+
+        for report, tag in filtered_reports_above_threshold:
+            report.reason = "Blacklisted"
+            print(
+                self.devops_platform_gateway.message(
+                    "error",
+                    f"Report {report.vm_id} with tag '{tag}' is blacklisted and age {report.age} is above threshold {remote_config['TAG_BLACKLIST_EXCLUSION_DAYS'][tag]}",
                 )
+            )
 
-            for report, tag in filtered_reports_below_threshold:
-                print(
-                    self.devops_platform_gateway.message(
-                        "warning",
-                        f"Report {report.vm_id} with tag '{tag}' is blacklisted but age {report.age} is below threshold {remote_config['TAG_BLACKLIST_EXCLUSION_DAYS'][tag]}",
-                    )
+        for report, tag in filtered_reports_below_threshold:
+            print(
+                self.devops_platform_gateway.message(
+                    "warning",
+                    f"Report {report.vm_id} with tag '{tag}' is blacklisted but age {report.age} is below threshold {remote_config['TAG_BLACKLIST_EXCLUSION_DAYS'][tag]}",
                 )
-                self.policy_excluded += 1
+            )
+            self.policy_excluded += 1
 
-            if filtered_reports_above_threshold:
-                self.break_build = True
-                self.blacklisted += len(filtered_reports_above_threshold)
-                self.report_breaker.extend(
-                    copy.deepcopy(
-                        [report for report, _ in filtered_reports_above_threshold]
-                    )
+        if filtered_reports_above_threshold:
+            self.break_build = True
+            self.blacklisted += len(filtered_reports_above_threshold)
+            self.report_breaker.extend(
+                copy.deepcopy(
+                    [report for report, _ in filtered_reports_above_threshold]
                 )
+            )
 
-            for report in report_list:
-                if "On Blacklist" in report.risk_status:
-                    self.break_build = True
-                    report.reason = "Blacklisted"
-                    self.blacklisted += 1
-                    self.report_breaker.append(copy.deepcopy(report))
-                    print(
-                        self.devops_platform_gateway.message(
-                            "error",
-                            f"Report {report.vm_id} is blacklisted.",
-                        )
+        for report in report_list:
+            if "On Blacklist" in report.risk_status:
+                self.break_build = True
+                report.reason = "Blacklisted"
+                self.blacklisted += 1
+                self.report_breaker.append(copy.deepcopy(report))
+                print(
+                    self.devops_platform_gateway.message(
+                        "error",
+                        f"Report {report.vm_id} is blacklisted.",
                     )
+                )
 
     def _risk_score_control(self, report_list: "list[Report]"):
         remote_config = self.remote_config

{devsecops_engine_tools-1.56.5 → devsecops_engine_tools-1.58.0}/devsecops_engine_tools/engine_sast/engine_iac/src/domain/usecases/iac_scan.py

@@ -48,6 +48,7 @@ class IacScan:
                 secret_tool=secret_tool,
                 secret_external_checks=dict_args["token_external_checks"],
                 work_folder=self.devops_platform_gateway.get_variable("temp_directory"),
+                dict_args=dict_args
             )
         else:
             print("Tool skipped by DevSecOps policy")

{devsecops_engine_tools-1.56.5 → devsecops_engine_tools-1.58.0}/devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_config.py

@@ -22,7 +22,8 @@ class CheckovConfigEnum(Enum):
     DOCKERFILEPATH = "dockerfile-path"
     EXTERNAL_CHECKS_GIT = "external-checks-git"
     SKIP_DOWNLOAD = "skip-download"
-
+    REPO_ROOT_FOR_PLAN_ENRICHMENT = "repo-root-for-plan-enrichment"
+    DEEP_ANALYSIS = "deep-analysis"
 
 class CheckovConfig:
     dict_confg_file = {}
@@ -45,6 +46,8 @@ class CheckovConfig:
         external_checks_git=None,
         skip_checks=None,
         skip_download=True,
+        repo_root_for_plan_enrichment=None,
+        deep_analysis=None
     ):
         self.path_config_file = path_config_file
         self.config_file_name = config_file_name
@@ -62,6 +65,8 @@ class CheckovConfig:
         self.skip_checks = skip_checks
         self.skip_download = skip_download
         self.env = env
+        self.repo_root_for_plan_enrichment = repo_root_for_plan_enrichment
+        self.deep_analysis = deep_analysis
 
     def create_config_dict(self):
         if self.framework is not None:
@@ -111,6 +116,20 @@ class CheckovConfig:
             raise ValueError(
                 MESSAGE_VALUE + CheckovConfigEnum.DIRECTORIES.value + MESSAGE_NIL
             )
+    
+        if self.repo_root_for_plan_enrichment is not None:
+            self.dict_confg_file[
+                CheckovConfigEnum.REPO_ROOT_FOR_PLAN_ENRICHMENT.value
+            ] = self.repo_root_for_plan_enrichment
+        else:
+            self.dict_confg_file.pop(CheckovConfigEnum.REPO_ROOT_FOR_PLAN_ENRICHMENT.value, None)
+    
+        if self.deep_analysis is not None:
+            self.dict_confg_file[
+                CheckovConfigEnum.DEEP_ANALYSIS.value
+            ] = self.deep_analysis
+        else:
+            self.dict_confg_file.pop(CheckovConfigEnum.DEEP_ANALYSIS.value, None)
 
         if self.evaluate_variables is not None:
             self.dict_confg_file[

{devsecops_engine_tools-1.56.5 → devsecops_engine_tools-1.58.0}/devsecops_engine_tools/engine_sast/engine_iac/src/infrastructure/driven_adapters/checkov/checkov_tool.py

@@ -148,7 +148,8 @@ class CheckovTool(ToolGateway):
         agent_env,
         environment,
         platform_to_scan,
-        command_prefix
+        command_prefix,
+        dict_args
     ):
         output_queue = queue.Queue()
         # Crea una lista para almacenar los hilos
@@ -160,8 +161,10 @@ class CheckovTool(ToolGateway):
                     elem.upper() in rule for elem in platform_to_scan
                 ):
                     framework = [self.framework_mapping[rule]]
+                    repo_root = None
                     if "terraform" in platform_to_scan or ("all" in platform_to_scan and self.framework_mapping[rule] == "terraform"): 
                         framework.append("terraform_plan")
+                        repo_root = dict_args.get("terraform_repo_root", None)
 
                     checkov_config = CheckovConfig(
                         path_config_file="",
@@ -192,6 +195,12 @@ class CheckovTool(ToolGateway):
                             and rule in self.framework_external_checks
                             else []
                         ),
+                        repo_root_for_plan_enrichment=repo_root,
+                        deep_analysis=(
+                            True
+                            if repo_root
+                            else None
+                        )
                     )
 
                     checkov_config.create_config_dict()
@@ -240,7 +249,7 @@ class CheckovTool(ToolGateway):
         
         if command_prefix is not None:
             result_scans, rules_run = self.scan_folders(
-                folders_to_scan, config_tool, agent_env, environment, platform_to_scan, command_prefix
+                folders_to_scan, config_tool, agent_env, environment, platform_to_scan, command_prefix, kwargs.get("dict_args")
             )
 
             checkov_deserealizator = CheckovDeserealizator()

devsecops_engine_tools-1.58.0/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.58.0'

{devsecops_engine_tools-1.56.5 → devsecops_engine_tools-1.58.0}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.56.5
+Version: 1.58.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team
@@ -32,6 +32,7 @@ Requires-Dist: ruamel.yaml==0.18.6
 Requires-Dist: Authlib==1.3.2
 Requires-Dist: PyJWT==2.9.0
 Requires-Dist: sympy==1.13.3
+Requires-Dist: holidays==0.58
 
 # DevSecOps Engine Tools
 

{devsecops_engine_tools-1.56.5 → devsecops_engine_tools-1.58.0}/devsecops_engine_tools.egg-info/requires.txt

@@ -20,3 +20,4 @@ ruamel.yaml==0.18.6
 Authlib==1.3.2
 PyJWT==2.9.0
 sympy==1.13.3
+holidays==0.58

devsecops_engine_tools-1.56.5/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.56.5'