devsecops-engine-tools 1.6.7__tar.gz

devsecops_engine_tools-1.6.7/PKG-INFO

@@ -0,0 +1,156 @@
+Metadata-Version: 2.1
+Name: devsecops-engine-tools
+Version: 1.6.7
+Summary: Tool for DevSecOps strategy
+Home-page: https://github.com/bancolombia/devsecops-engine-tools
+Author: Bancolombia DevSecOps Team
+Author-email: devsecops@bancolombia.com.co
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+Requires-Dist: requests==2.31.0
+Requires-Dist: multipledispatch==0.6.0
+Requires-Dist: PyYAML==6.0.1
+Requires-Dist: checkov==2.3.296
+Requires-Dist: pyfiglet==0.7
+Requires-Dist: prettytable==3.8.0
+Requires-Dist: azure-devops==7.1.0b3
+Requires-Dist: marshmallow==3.19.0
+Requires-Dist: pytz==2023.3
+Requires-Dist: python-decouple==3.8
+Requires-Dist: requests_toolbelt==1.0.0
+Requires-Dist: python-dateutil==2.8.2
+Requires-Dist: pexpect==4.9.0
+
+# DevSecOps Engine Tools
+
+[![Maintained by Bancolombia](https://img.shields.io/badge/maintained_by-Bancolombia-yellow)](#)
+[![Build](https://github.com/bancolombia/devsecops-engine-tools/actions/workflows/build.yml/badge.svg)](https://github.com/bancolombia/devsecops-engine-tools/actions/workflows/build.yml)
+[![Python Version](https://img.shields.io/badge/python%20-%203.8%20%7C%203.9%20%7C%203.10%20%7C%203.11%20%7C%203.12%20-blue)](#)
+
+# Objective
+
+Tool that unifies the evaluation of the different devsecops practices being agnostic to the devops platform, using both open source and market tools.
+
+# Component
+
+📦 [tools](https://github.com/bancolombia/devsecops-engine-tools/tree/trunk/tools): DevSecOps Practice Modules
+
+# Communications channel
+
+Here are the channels we use to communicate about the project:
+
+**1. Mailing list:** You can join our mailing list to always be informed at the following link: [CommunityDevsecopsEngine](https://groups.google.com/g/CommunityDevsecopsEngine)
+
+**2. Email:** You can write to us by email:  MaintainersDevsecopsEngine@googlegroups.com
+
+# Getting started
+
+### Requirements
+
+- Python >= 3.8
+
+### Installation
+
+```bash
+pip3 install devsecops-engine-tools
+```
+
+### Scan running - flags (CLI)
+
+```bash
+devsecops-engine-tools --platform_devops ["local","azure"] --remote_config_repo ["remote_config_repo"] --tool ["engine_iac", "engine_dast", "engine_secret", "engine_dependencies", "engine_container"] --folder_path ["Folder path scan engine_iac"] --platform ["eks","openshift"] --use_secrets_manager ["false", "true"] --use_vulnerability_management ["false", "true"] --send_metrics ["false", "true"] --token_cmdb ["token_cmdb"] --token_vulnerability_management ["token_vulnerability_management"] --token_engine_container ["token_engine_container"] --token_engine_dependencies ["token_engine_dependencies"] 
+```
+
+### Structure Remote Config
+[example_remote_config_local](https://github.com/bancolombia/devsecops-engine-tools/blob/trunk/example_remote_config_local/)
+```bash
+📦Remote_Config
+   ┣ 📂engine_core
+   ┃ ┗ 📜ConfigTool.json
+   ┣ 📂engine_sast
+   ┃ ┗ 📂engine_iac
+   ┃   ┗ 📜ConfigTool.json
+   ┃   ┗ 📜Exclusions.json
+   ┃ ┗ 📂engine_secret
+   ┃   ┗ 📜ConfigTool.json
+   ┣ 📂engine_sca
+   ┃ ┗ 📂engine_container
+   ┃   ┗ 📜ConfigTool.json
+   ┃   ┗ 📜Exclusions.json
+   ┃ ┗ 📂engine_dependencies
+   ┃   ┗ 📜ConfigTool.json
+   ┃   ┗ 📜Exclusions.json
+```
+### Scan running sample (CLI) - Local
+
+> Complete the value in **.envdetlocal** file a set in execution environment
+```
+$ set -a
+$ source .envdetlocal
+$ set +a
+```
+
+
+```bash
+devsecops-engine-tools --platform_devops local --remote_config_repo DevSecOps_Remote_Config --tool engine_iac
+
+```
+### Scan result sample (CLI)
+
+```bash
+    ____            _____           ____                ______            _               ______            __    
+   / __ \___ _   __/ ___/___  _____/ __ \____  _____   / ____/___  ____ _(_)___  ___     /_  __/___  ____  / /____
+  / / / / _ \ | / /\__ \/ _ \/ ___/ / / / __ \/ ___/  / __/ / __ \/ __ `/ / __ \/ _ \     / / / __ \/ __ \/ / ___/
+ / /_/ /  __/ |/ /___/ /  __/ /__/ /_/ / /_/ (__  )  / /___/ / / / /_/ / / / / /  __/    / / / /_/ / /_/ / (__  ) 
+/_____/\___/|___//____/\___/\___/\____/ .___/____/  /_____/_/ /_/\__, /_/_/ /_/\___/    /_/  \____/\____/_/____/  
+                                     /_/                        /____/                                            
+
+Secrets manager is not enabled to configure external checks
+
+Below are all vulnerabilities detected.
+╔══════════╦════════════╦════════════════════════════════════════════════════════════════════════════════════╦════════════════════════╗
+║ Severity ║ ID         ║ Description                                                                        ║ Where                  ║
+╠══════════╬════════════╬════════════════════════════════════════════════════════════════════════════════════╬════════════════════════╣
+║ critical ║ CKV_K8S_37 ║ IAC-CKV_K8S_37 Minimize the admission of containers with capabilities assigned     ║ /_AW1234/app.yaml      ║
+║ critical ║ CKV_K8S_20 ║ IAC-CKV_K8S_20 Containers should not run with allowPrivilegeEscalation             ║ /_AW1234/app.yaml      ║
+║ critical ║ CKV_K8S_30 ║ IAC-CKV_K8S_30 Apply security context to your containers                           ║ /_AW1234/app.yaml      ║
+║ critical ║ CKV_K8S_23 ║ IAC-CKV_K8S_23 Minimize the admission of root containers                           ║ /_AW1234/app.yaml      ║
+║ high     ║ CKV_AWS_20 ║ C-S3-005-AWS S3 buckets are accessible to public                                   ║ /_AW1234/template.yaml ║
+║ high     ║ CKV_K8S_22 ║ IAC-CKV_K8S_22 Use read-only filesystem for containers where possible              ║ /_AW1234/app.yaml      ║
+║ high     ║ CKV_K8S_28 ║ IAC-CKV_K8S_28 Minimize the admission of containers with the NET_RAW capability    ║ /_AW1234/app.yaml      ║
+║ high     ║ CKV_K8S_38 ║ IAC-CKV_K8S_38 Ensure that Service Account Tokens are only mounted where necessary ║ /_AW1234/app.yaml      ║
+╚══════════╩════════════╩════════════════════════════════════════════════════════════════════════════════════╩════════════════════════╝
+Security count issues (critical: 4, high: 4, medium: 0, low: 0) is greater than or equal to failure criteria (critical: 1, high: 8, medium: 10, low:15, operator: or)
+✘Failed
+
+Below are all compliances issues detected.
+╔══════════╦═══════════╦════════════════════════════════════════════════════╦═══════════════════╗
+║ Severity ║ ID        ║ Description                                        ║ Where             ║
+╠══════════╬═══════════╬════════════════════════════════════════════════════╬═══════════════════╣
+║ critical ║ CKV_K8S_8 ║ IAC-CKV_K8S_8 Liveness Probe Should be Configured  ║ /_AW1234/app.yaml ║
+║ critical ║ CKV_K8S_9 ║ IAC-CKV_K8S_9 Readiness Probe Should be Configured ║ /_AW1234/app.yaml ║
+╚══════════╩═══════════╩════════════════════════════════════════════════════╩═══════════════════╝
+Compliance issues count (critical: 2) is greater than or equal to failure criteria (critical: 1)
+✘Failed
+
+Bellow are all the findings that were accepted.
+╔══════════╦════════════╦═══════════════════╦═════════════╦══════════════╦══════════════════╗
+║ Severity ║ ID         ║ Where             ║ Create Date ║ Expired Date ║ Reason           ║
+╠══════════╬════════════╬═══════════════════╬═════════════╬══════════════╬══════════════════╣
+║ high     ║ CKV_K8S_38 ║ /_AW1234/app.yaml ║ 18/11/2023  ║ 18/03/2024   ║ False Positive   ║
+╚══════════╩════════════╩═══════════════════╩═════════════╩══════════════╩══════════════════╝
+
+message custom
+```
+
+# How can I help?
+
+Review the issues, we hear new ideas. Read more [Contributing](https://github.com/bancolombia/devsecops-engine-tools/blob/trunk/docs/CONTRIBUTING.md)
+
+
+
+
+

devsecops_engine_tools-1.6.7/README.md

@@ -0,0 +1,89 @@
+# Introduction
+
+DevSecOps Practice Modules
+
+# Project layout
+
+```
+devsecops_engine_tools
+├───engine_core -> Main module.
+|           test
+|           src
+|               applications
+|               deployment
+|               domain
+|                   model
+|                   usecases
+|               infraestructure
+|                   driven_adapters
+|                   entry_points
+|                   utils.
+|
+├───engine_dast -> DAST Practice
+|           test
+|           src
+|               applications
+|               deployment
+|               domain
+|                   model
+|                   usecases
+|               infraestructure
+|                   driven_adapters
+|                   entry_points
+|                   utils.
+|
+├───engine_sast -> SAST Practices
+|           engine_iac -> Infrastructure as code
+|              src
+|               applications
+|               deployment
+|               domain
+|                   model
+|                   usecases
+|               infraestructure
+|                   driven_adapters
+|                   entry_points
+|                   utils.
+|           engine_secret -> Secret Scanning
+|              src
+|               applications
+|               deployment
+|               domain
+|                   model
+|                   usecases
+|               infraestructure
+|                   driven_adapters
+|                   entry_points
+|                   utils.
+|
+├───engine_sca -> SCA Practices
+|            engine_container -> Container Scanning
+|              src
+|               applications
+|               deployment
+|               domain
+|                   model
+|                   usecases
+|               infraestructure
+|                   driven_adapters
+|                   entry_points
+|                   utils.
+|            engine_dependencies -> Dependency Scanning
+|              src
+|               applications
+|               deployment
+|               domain
+|                   model
+|                   usecases
+|               infraestructure
+|                   driven_adapters
+|                   entry_points
+|                   utils.
+├───engine_utilities -> Utilities transversal.
+|           azuredevops
+|           defect_dojo
+|           github
+|           input_validations
+|           ssh
+|           utils
+```

devsecops_engine_tools-1.6.7/devsecops_engine_tools/engine_core/src/applications/runner_engine_core.py

@@ -0,0 +1,124 @@
+from devsecops_engine_tools.engine_core.src.infrastructure.entry_points.entry_point_core import (
+    init_engine_core,
+)
+from devsecops_engine_tools.engine_core.src.infrastructure.driven_adapters.defect_dojo.defect_dojo import (
+    DefectDojoPlatform,
+)
+from devsecops_engine_tools.engine_core.src.infrastructure.driven_adapters.aws.secrets_manager import (
+    SecretsManager,
+)
+from devsecops_engine_tools.engine_core.src.infrastructure.driven_adapters.azure.azure_devops import (
+    AzureDevops,
+)
+from devsecops_engine_tools.engine_core.src.infrastructure.driven_adapters.runtime_local.runtime_local import (
+    RuntimeLocal,
+)
+from devsecops_engine_tools.engine_core.src.infrastructure.driven_adapters.aws.s3_manager import (
+    S3Manager,
+)
+from devsecops_engine_tools.engine_core.src.infrastructure.driven_adapters.printer_pretty_table.printer_pretty_table import (
+    PrinterPrettyTable,
+)
+import sys
+import argparse
+from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
+from devsecops_engine_tools.engine_utilities import settings
+from devsecops_engine_tools.version import version
+
+
+logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
+
+def get_inputs_from_cli(args):
+    parser = argparse.ArgumentParser()
+    parser.add_argument("-v", "--version", action='version', version='{version}'.format(version=version))
+    parser.add_argument("-pd", "--platform_devops", choices=["azure", "local"], type=str, required=True, help="Platform where is executed")
+    parser.add_argument("-rcf" ,"--remote_config_repo", type=str, required=True, help="Name or Folder Path of Config Repo")
+    parser.add_argument("-t",
+        "--tool",
+        choices=[
+            "engine_iac",
+            "engine_dast",
+            "engine_secret",
+            "engine_dependencies",
+            "engine_container",
+        ],
+        type=str,
+        required=True,
+        help="Tool to execute",
+    )
+    parser.add_argument("-fp", "--folder_path", type=str, required=False, help="Folder Path to scan, only apply engine_iac tool")
+    parser.add_argument("-p",
+        "--platform", choices=["eks", "openshift"], type=str, required=False, help="Platform to execute,  only apply engine_iac tool"
+    )
+    parser.add_argument(
+        "--use_secrets_manager",
+        choices=["true", "false"],
+        type=str,
+        required=False,
+        help="Use Secrets Manager to get the tokens",
+    )
+    parser.add_argument(
+        "--use_vulnerability_management",
+        choices=["true", "false"],
+        type=str,
+        required=False,
+        help="Use Vulnerability Management to send the vulnerabilities to the platform",
+    )
+    parser.add_argument(
+        "--send_metrics",
+        choices=["true", "false"],
+        type=str,
+        required=False,
+        help="Enable or Disable the send metrics to the driven adapter metrics",
+    )
+    parser.add_argument("--token_cmdb", required=False, help="Token to connect to the CMDB")
+    parser.add_argument("--token_vulnerability_management", required=False, help="Token to connect to the Vulnerability Management")
+    parser.add_argument("--token_engine_container", required=False, help="Token to execute engine_container if is necessary")
+    parser.add_argument("--token_engine_dependencies", required=False, help="Token to execute engine_dependencies if is necessary")
+    args = parser.parse_args()
+    return {
+        "platform_devops": args.platform_devops,
+        "remote_config_repo": args.remote_config_repo,
+        "tool": args.tool,
+        "folder_path": args.folder_path,
+        "platform": args.platform,
+        "use_secrets_manager": args.use_secrets_manager,
+        "use_vulnerability_management": args.use_vulnerability_management,
+        "send_metrics": args.send_metrics,
+        "token_cmdb": args.token_cmdb,
+        "token_vulnerability_management": args.token_vulnerability_management,
+        "token_engine_container": args.token_engine_container,
+        "token_engine_dependencies": args.token_engine_dependencies,
+    }
+
+def application_core():
+    try:
+        # Get inputs from CLI
+        args = get_inputs_from_cli(sys.argv[1:])
+
+        # Define driven adapters for gateways
+        vulnerability_management_gateway = DefectDojoPlatform()
+        secrets_manager_gateway = SecretsManager()
+        devops_platform_gateway = AzureDevops() if args["platform_devops"] == "azure" else RuntimeLocal()
+        printer_table_gateway = PrinterPrettyTable()
+        metrics_manager_gateway = S3Manager()
+        
+        init_engine_core(
+            vulnerability_management_gateway,
+            secrets_manager_gateway,
+            devops_platform_gateway,
+            printer_table_gateway,
+            metrics_manager_gateway,
+            args
+        )
+    except Exception as e:
+        logger.error("Error SCAN: {0} ".format(str(e)))
+        print(
+            devops_platform_gateway.message(
+                "error", "Error SCAN: {0} ".format(str(e))
+            )
+        )
+        print(devops_platform_gateway.result_pipeline("failed"))
+
+if __name__ == "__main__":
+    application_core()

devsecops_engine_tools-1.6.7/devsecops_engine_tools/engine_core/src/domain/model/customs_exceptions.py

@@ -0,0 +1,9 @@
+class ExceptionVulnerabilityManagement(Exception):
+    def __init__(self, message):
+        self.message = message
+        super().__init__(self.message)
+
+class ExceptionFindingsExcepted(Exception):
+    def __init__(self, message):
+        self.message = message
+        super().__init__(self.message)

devsecops_engine_tools-1.6.7/devsecops_engine_tools/engine_core/src/domain/model/exclusions.py

@@ -0,0 +1,14 @@
+from dataclasses import dataclass
+
+
+@dataclass
+class Exclusions:
+    def __init__(self, **kwargs):
+        self.id = kwargs.get("id", "")
+        self.where = kwargs.get("where", "")
+        self.cve_id = kwargs.get("cve_id", "")
+        self.create_date = kwargs.get("create_date", "")
+        self.expired_date = kwargs.get("expired_date", "")
+        self.severity = kwargs.get("severity", "")
+        self.hu = kwargs.get("hu", "")
+        self.reason = kwargs.get("reason", "Risk acceptance")

devsecops_engine_tools-1.6.7/devsecops_engine_tools/engine_core/src/domain/model/finding.py

@@ -0,0 +1,20 @@
+from enum import Enum
+from dataclasses import dataclass
+
+class Category(Enum):
+    VULNERABILITY = "vulnerability"
+    COMPLIANCE = "compliance"
+
+@dataclass
+class Finding:
+    id: str
+    cvss: str
+    where: str
+    description: str
+    severity: str
+    identification_date: str
+    published_date_cve: str
+    module: str
+    category: Category
+    requirements: str
+    tool: str

devsecops_engine_tools-1.6.7/devsecops_engine_tools/engine_core/src/domain/model/gateway/devops_platform_gateway.py

@@ -0,0 +1,27 @@
+from abc import ABCMeta, abstractmethod
+
+
+class DevopsPlatformGateway(metaclass=ABCMeta):
+    @abstractmethod
+    def get_remote_config(self, repository, path):
+        "get_remote_config"
+
+    @abstractmethod
+    def message(self, type, message):
+        "message"
+
+    @abstractmethod
+    def result_pipeline(self, type):
+        "result_pipeline"
+
+    @abstractmethod
+    def get_source_code_management_uri(self):
+        "get_source_code_management_uri"
+
+    @abstractmethod
+    def get_base_compact_remote_config_url(self, remote_config_repo):
+        "get_base_compact_remote_config_url"
+
+    @abstractmethod
+    def get_variable(self, variable):
+        "get_variable"

devsecops_engine_tools-1.6.7/devsecops_engine_tools/engine_core/src/domain/model/gateway/metrics_manager_gateway.py

@@ -0,0 +1,7 @@
+from abc import ABCMeta, abstractmethod
+
+
+class MetricsManagerGateway(metaclass=ABCMeta):
+    @abstractmethod
+    def send_metrics(self, config_tool, tool, file_path):
+        "send_metrics"

devsecops_engine_tools-1.6.7/devsecops_engine_tools/engine_core/src/domain/model/gateway/printer_table_gateway.py

@@ -0,0 +1,13 @@
+from abc import ABCMeta, abstractmethod
+from devsecops_engine_tools.engine_core.src.domain.model.finding import (
+    Finding,
+)
+
+class PrinterTableGateway(metaclass=ABCMeta):
+    @abstractmethod
+    def print_table_findings(self, finding_list: "list[Finding]"):
+        "print_table_findings"
+
+    @abstractmethod
+    def print_table_exclusions(self, exclusions_list):
+        "print_table_exclusions"

devsecops_engine_tools-1.6.7/devsecops_engine_tools/engine_core/src/domain/model/gateway/secrets_manager_gateway.py

@@ -0,0 +1,7 @@
+from abc import ABCMeta, abstractmethod
+
+
+class SecretsManagerGateway(metaclass=ABCMeta):
+    @abstractmethod
+    def get_secret(self, config_tool):
+        "get_secret"

devsecops_engine_tools-1.6.7/devsecops_engine_tools/engine_core/src/domain/model/gateway/vulnerability_management_gateway.py

@@ -0,0 +1,17 @@
+from abc import ABCMeta, abstractmethod
+
+from devsecops_engine_tools.engine_core.src.domain.model.vulnerability_management import VulnerabilityManagement
+
+
+class VulnerabilityManagementGateway(metaclass=ABCMeta):
+    @abstractmethod
+    def send_vulnerability_management(
+        self, vulnerability_management: VulnerabilityManagement
+    ):
+        "send_vulnerability_management"
+
+    @abstractmethod
+    def get_findings_excepted(
+        self, service, dict_args, secret_tool, config_tool
+    ):
+        "get_findings_excepted"

devsecops_engine_tools-1.6.7/devsecops_engine_tools/engine_core/src/domain/model/input_core.py

@@ -0,0 +1,12 @@
+from dataclasses import dataclass
+from devsecops_engine_tools.engine_core.src.domain.model.exclusions import Exclusions
+from devsecops_engine_tools.engine_core.src.domain.model.threshold import Threshold
+
+@dataclass
+class InputCore:
+    totalized_exclusions: "list[Exclusions]"
+    threshold_defined: Threshold
+    path_file_results: str
+    custom_message_break_build: str
+    scope_pipeline: str
+    stage_pipeline: str

devsecops_engine_tools-1.6.7/devsecops_engine_tools/engine_core/src/domain/model/level_compliance.py

@@ -0,0 +1,3 @@
+class LevelCompliance:
+    def __init__(self, data):
+        self.critical = data.get("Critical")

devsecops_engine_tools-1.6.7/devsecops_engine_tools/engine_core/src/domain/model/level_vulnerability.py

@@ -0,0 +1,7 @@
+class LevelVulnerability:
+    def __init__(self, data):
+        self.critical = data.get("Critical")
+        self.high = data.get("High")
+        self.medium = data.get("Medium")
+        self.low = data.get("Low")
+        self.unknown = data.get("Unknown")

devsecops_engine_tools-1.6.7/devsecops_engine_tools/engine_core/src/domain/model/threshold.py

@@ -0,0 +1,12 @@
+from devsecops_engine_tools.engine_core.src.domain.model.level_vulnerability import (
+    LevelVulnerability,
+)
+from devsecops_engine_tools.engine_core.src.domain.model.level_compliance import (
+    LevelCompliance,
+)
+
+class Threshold:
+    def __init__(self, data):
+        self.vulnerability = LevelVulnerability(data.get("VULNERABILITY"))
+        self.compliance = LevelCompliance(data.get("COMPLIANCE"))
+        self.cve = data.get("CVE",[])

devsecops_engine_tools-1.6.7/devsecops_engine_tools/engine_core/src/domain/model/vulnerability_management.py

@@ -0,0 +1,20 @@
+from dataclasses import dataclass
+
+from devsecops_engine_tools.engine_core.src.domain.model.input_core import InputCore
+
+
+@dataclass
+class VulnerabilityManagement:
+    scan_type: str
+    input_core: InputCore
+    dict_args: any
+    secret_tool: any
+    config_tool: any
+    source_code_management_uri: str
+    base_compact_remote_config_url: str
+    access_token: str
+    version: str
+    build_id: str
+    branch_tag: str
+    commit_hash: str
+    environment: str