devsecops-engine-tools 1.7.13__py3-none-any.whl → 1.7.15__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Potentially problematic release.
This version of devsecops-engine-tools might be problematic. Click here for more details.
- devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/usecases/find_artifacts.py +37 -37
- devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/usecases/handle_remote_config_patterns.py +0 -1
- devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/entry_points/entry_point_tool.py +1 -1
- devsecops_engine_tools/version.py +1 -1
- devsecops_engine_tools-1.7.15.dist-info/METADATA +120 -0
- {devsecops_engine_tools-1.7.13.dist-info → devsecops_engine_tools-1.7.15.dist-info}/RECORD +9 -9
- devsecops_engine_tools-1.7.13.dist-info/METADATA +0 -156
- {devsecops_engine_tools-1.7.13.dist-info → devsecops_engine_tools-1.7.15.dist-info}/WHEEL +0 -0
- {devsecops_engine_tools-1.7.13.dist-info → devsecops_engine_tools-1.7.15.dist-info}/entry_points.txt +0 -0
- {devsecops_engine_tools-1.7.13.dist-info → devsecops_engine_tools-1.7.15.dist-info}/top_level.txt +0 -0
|
@@ -15,43 +15,32 @@ class FindArtifacts:
|
|
|
15
15
|
self,
|
|
16
16
|
working_dir,
|
|
17
17
|
pattern,
|
|
18
|
+
packages,
|
|
18
19
|
):
|
|
19
20
|
self.working_dir = working_dir
|
|
20
21
|
self.pattern = pattern
|
|
22
|
+
self.packages = packages
|
|
21
23
|
|
|
22
|
-
def find_packages(self, pattern, working_dir):
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
ext_files = []
|
|
24
|
+
def find_packages(self, pattern, packages, working_dir):
|
|
25
|
+
packages_list = []
|
|
26
|
+
files_list = []
|
|
26
27
|
extension_pattern = re.compile(pattern, re.IGNORECASE)
|
|
27
28
|
for root, dirs, files in os.walk(working_dir):
|
|
28
29
|
components = root.split(os.path.sep)
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
30
|
+
flag = 0
|
|
31
|
+
for package in packages:
|
|
32
|
+
if not (package in components):
|
|
33
|
+
flag = 1
|
|
34
|
+
if package in dirs:
|
|
35
|
+
packages_list.append(os.path.join(root, package))
|
|
36
|
+
if flag:
|
|
36
37
|
for file in files:
|
|
37
38
|
if extension_pattern.search(file):
|
|
38
|
-
|
|
39
|
-
return
|
|
40
|
-
|
|
41
|
-
def get_recent_package(self, packages):
|
|
42
|
-
recent_package = None
|
|
43
|
-
recent_time = 0
|
|
44
|
-
for path in packages:
|
|
45
|
-
created_time = os.path.getctime(path)
|
|
46
|
-
if created_time > recent_time:
|
|
47
|
-
recent_time = created_time
|
|
48
|
-
recent_package = path
|
|
49
|
-
return recent_package
|
|
39
|
+
files_list.append(os.path.join(root, file))
|
|
40
|
+
return packages_list, files_list
|
|
50
41
|
|
|
51
42
|
def compress_and_mv(self, tar_path, package):
|
|
52
43
|
try:
|
|
53
|
-
if os.path.exists(tar_path):
|
|
54
|
-
os.remove(tar_path)
|
|
55
44
|
with tarfile.open(tar_path, "w") as tar:
|
|
56
45
|
tar.add(
|
|
57
46
|
package,
|
|
@@ -75,21 +64,32 @@ class FindArtifacts:
|
|
|
75
64
|
shutil.rmtree(dir_to_scan_path)
|
|
76
65
|
os.makedirs(dir_to_scan_path)
|
|
77
66
|
|
|
78
|
-
|
|
79
|
-
self.pattern, self.working_dir
|
|
67
|
+
packages_list, files_list = self.find_packages(
|
|
68
|
+
self.pattern, self.packages, self.working_dir
|
|
80
69
|
)
|
|
81
70
|
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
71
|
+
for package in packages_list:
|
|
72
|
+
tar_path = os.path.join(
|
|
73
|
+
dir_to_scan_path,
|
|
74
|
+
"pkg"
|
|
75
|
+
+ str(packages_list.index(package) + 1)
|
|
76
|
+
+ "_"
|
|
77
|
+
+ os.path.basename(package)
|
|
78
|
+
+ ".tar",
|
|
79
|
+
)
|
|
80
|
+
self.compress_and_mv(tar_path, package)
|
|
86
81
|
|
|
87
|
-
if len(
|
|
88
|
-
|
|
89
|
-
tar_path = os.path.join(dir_to_scan_path, "site-packages.tar")
|
|
90
|
-
self.compress_and_mv(tar_path, py_recent)
|
|
82
|
+
if len(files_list):
|
|
83
|
+
self.move_files(dir_to_scan_path, files_list)
|
|
91
84
|
|
|
92
|
-
|
|
93
|
-
|
|
85
|
+
files = os.listdir(dir_to_scan_path)
|
|
86
|
+
files = [
|
|
87
|
+
file
|
|
88
|
+
for file in files
|
|
89
|
+
if os.path.isfile(os.path.join(dir_to_scan_path, file))
|
|
90
|
+
]
|
|
91
|
+
if files:
|
|
92
|
+
logger.debug(f"Files to scan: {", ".join(files)}")
|
|
93
|
+
print(f"Files to scan: {", ".join(files)}")
|
|
94
94
|
|
|
95
95
|
return dir_to_scan_path
|
|
@@ -49,7 +49,7 @@ def init_engine_dependencies(
|
|
|
49
49
|
bypass_limits_flag = handle_remote_config_patterns.bypass_archive_limits()
|
|
50
50
|
pattern = handle_remote_config_patterns.excluded_files()
|
|
51
51
|
|
|
52
|
-
find_artifacts = FindArtifacts(os.getcwd(), pattern)
|
|
52
|
+
find_artifacts = FindArtifacts(os.getcwd(), pattern, remote_config["PACKAGES_TO_SCAN"])
|
|
53
53
|
dir_to_scan_path = find_artifacts.find_artifacts()
|
|
54
54
|
|
|
55
55
|
dependencies_sca_scan = DependenciesScan(
|
|
@@ -1 +1 @@
|
|
|
1
|
-
version = '1.7.
|
|
1
|
+
version = '1.7.15'
|
|
@@ -0,0 +1,120 @@
|
|
|
1
|
+
Metadata-Version: 2.1
|
|
2
|
+
Name: devsecops-engine-tools
|
|
3
|
+
Version: 1.7.15
|
|
4
|
+
Summary: Tool for DevSecOps strategy
|
|
5
|
+
Home-page: https://github.com/bancolombia/devsecops-engine-tools
|
|
6
|
+
Author: Bancolombia DevSecOps Team
|
|
7
|
+
Author-email: devsecops@bancolombia.com.co
|
|
8
|
+
Classifier: Programming Language :: Python :: 3
|
|
9
|
+
Classifier: License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)
|
|
10
|
+
Classifier: Operating System :: OS Independent
|
|
11
|
+
Requires-Python: >=3.8
|
|
12
|
+
Description-Content-Type: text/markdown
|
|
13
|
+
Requires-Dist: requests ==2.31.0
|
|
14
|
+
Requires-Dist: multipledispatch ==0.6.0
|
|
15
|
+
Requires-Dist: PyYAML ==6.0.1
|
|
16
|
+
Requires-Dist: checkov ==2.3.296
|
|
17
|
+
Requires-Dist: pyfiglet ==0.7
|
|
18
|
+
Requires-Dist: prettytable ==3.8.0
|
|
19
|
+
Requires-Dist: azure-devops ==7.1.0b3
|
|
20
|
+
Requires-Dist: marshmallow ==3.19.0
|
|
21
|
+
Requires-Dist: pytz ==2023.3
|
|
22
|
+
Requires-Dist: python-decouple ==3.8
|
|
23
|
+
Requires-Dist: requests-toolbelt ==1.0.0
|
|
24
|
+
Requires-Dist: python-dateutil ==2.8.2
|
|
25
|
+
Requires-Dist: pexpect ==4.9.0
|
|
26
|
+
|
|
27
|
+
# DevSecOps Engine Tools
|
|
28
|
+
|
|
29
|
+
[](#)
|
|
30
|
+
[](https://github.com/bancolombia/devsecops-engine-tools/actions/workflows/build.yml)
|
|
31
|
+
[](https://sonarcloud.io/summary/new_code?id=bancolombia_devsecops-engine-tools)
|
|
32
|
+
[](https://sonarcloud.io/summary/new_code?id=bancolombia_devsecops-engine-tools)
|
|
33
|
+
[](#)
|
|
34
|
+
|
|
35
|
+
# Objective
|
|
36
|
+
|
|
37
|
+
Tool that unifies the evaluation of the different devsecops practices being agnostic to the devops platform, using both open source and market tools.
|
|
38
|
+
|
|
39
|
+
# Component
|
|
40
|
+
|
|
41
|
+
📦 [tools](https://github.com/bancolombia/devsecops-engine-tools/tree/trunk/tools): DevSecOps Practice Modules
|
|
42
|
+
|
|
43
|
+
# Communications channel
|
|
44
|
+
|
|
45
|
+
Here are the channels we use to communicate about the project:
|
|
46
|
+
|
|
47
|
+
**1. Mailing list:** You can join our mailing list to always be informed at the following link: [CommunityDevsecopsEngine](https://groups.google.com/g/CommunityDevsecopsEngine)
|
|
48
|
+
|
|
49
|
+
**2. Email:** You can write to us by email: MaintainersDevsecopsEngine@googlegroups.com
|
|
50
|
+
|
|
51
|
+
# Getting started
|
|
52
|
+
|
|
53
|
+
### Requirements
|
|
54
|
+
|
|
55
|
+
- Python >= 3.8
|
|
56
|
+
|
|
57
|
+
### Installation
|
|
58
|
+
|
|
59
|
+
```bash
|
|
60
|
+
pip3 install devsecops-engine-tools
|
|
61
|
+
```
|
|
62
|
+
|
|
63
|
+
### Scan running - flags (CLI)
|
|
64
|
+
|
|
65
|
+
```bash
|
|
66
|
+
devsecops-engine-tools --platform_devops ["local","azure"] --remote_config_repo ["remote_config_repo"] --tool ["engine_iac", "engine_dast", "engine_secret", "engine_dependencies", "engine_container"] --folder_path ["Folder path scan engine_iac"] --platform ["eks","openshift"] --use_secrets_manager ["false", "true"] --use_vulnerability_management ["false", "true"] --send_metrics ["false", "true"] --token_cmdb ["token_cmdb"] --token_vulnerability_management ["token_vulnerability_management"] --token_engine_container ["token_engine_container"] --token_engine_dependencies ["token_engine_dependencies"]
|
|
67
|
+
```
|
|
68
|
+
|
|
69
|
+
### Structure Remote Config
|
|
70
|
+
[example_remote_config_local](https://github.com/bancolombia/devsecops-engine-tools/blob/trunk/example_remote_config_local/)
|
|
71
|
+
```bash
|
|
72
|
+
📦Remote_Config
|
|
73
|
+
┣ 📂engine_core
|
|
74
|
+
┃ ┗ 📜ConfigTool.json
|
|
75
|
+
┣ 📂engine_sast
|
|
76
|
+
┃ ┗ 📂engine_iac
|
|
77
|
+
┃ ┗ 📜ConfigTool.json
|
|
78
|
+
┃ ┗ 📜Exclusions.json
|
|
79
|
+
┃ ┗ 📂engine_secret
|
|
80
|
+
┃ ┗ 📜ConfigTool.json
|
|
81
|
+
┣ 📂engine_sca
|
|
82
|
+
┃ ┗ 📂engine_container
|
|
83
|
+
┃ ┗ 📜ConfigTool.json
|
|
84
|
+
┃ ┗ 📜Exclusions.json
|
|
85
|
+
┃ ┗ 📂engine_dependencies
|
|
86
|
+
┃ ┗ 📜ConfigTool.json
|
|
87
|
+
┃ ┗ 📜Exclusions.json
|
|
88
|
+
```
|
|
89
|
+
### Scan running sample (CLI) - Local
|
|
90
|
+
|
|
91
|
+
> Complete the value in **.envdetlocal** file a set in execution environment
|
|
92
|
+
```
|
|
93
|
+
$ set -a
|
|
94
|
+
$ source .envdetlocal
|
|
95
|
+
$ set +a
|
|
96
|
+
```
|
|
97
|
+
|
|
98
|
+
|
|
99
|
+
```bash
|
|
100
|
+
devsecops-engine-tools --platform_devops local --remote_config_repo DevSecOps_Remote_Config --tool engine_iac
|
|
101
|
+
|
|
102
|
+
```
|
|
103
|
+
### Scan result sample (CLI)
|
|
104
|
+
|
|
105
|
+
|
|
106
|
+
|
|
107
|
+
# Metrics
|
|
108
|
+
|
|
109
|
+
With the flag **--send_metrics true** and the configuration of the AWS-METRICS_MANAGER driven adapter in ConfigTool.json of the engine_core the tool will send the report to bucket s3. In the [metrics](https://github.com/bancolombia/devsecops-engine-tools/blob/trunk/metrics/) folder you will find the base of the cloud formation template to deploy the infra and dashboard in grafana.
|
|
110
|
+
|
|
111
|
+
|
|
112
|
+
|
|
113
|
+
# How can I help?
|
|
114
|
+
|
|
115
|
+
Review the issues, we hear new ideas. Read more [Contributing](https://github.com/bancolombia/devsecops-engine-tools/blob/trunk/docs/CONTRIBUTING.md)
|
|
116
|
+
|
|
117
|
+
|
|
118
|
+
|
|
119
|
+
|
|
120
|
+
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
devsecops_engine_tools/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
2
|
-
devsecops_engine_tools/version.py,sha256=
|
|
2
|
+
devsecops_engine_tools/version.py,sha256=IIHUhIf5OXqrRi08nL04TS7-H4UqIv9fS8E_EgG0lmk,18
|
|
3
3
|
devsecops_engine_tools/engine_core/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
4
4
|
devsecops_engine_tools/engine_core/src/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
5
5
|
devsecops_engine_tools/engine_core/src/applications/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
@@ -168,8 +168,8 @@ devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/model/gateways/
|
|
|
168
168
|
devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/model/gateways/tool_gateway.py,sha256=ceRndnbWphvYxqt2EzqDkEw7NEgBXAmf0FMohA7_i1o,258
|
|
169
169
|
devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/usecases/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
170
170
|
devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/usecases/dependencies_sca_scan.py,sha256=YqgfoS5uXpZ8l30TI_UsmgusONNNvVbgpPnFKajmU38,1349
|
|
171
|
-
devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/usecases/find_artifacts.py,sha256=
|
|
172
|
-
devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/usecases/handle_remote_config_patterns.py,sha256=
|
|
171
|
+
devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/usecases/find_artifacts.py,sha256=T-fqMn4FktqsN7oA2oyqHjj1f-citdTbNbmmP2vEnHU,3156
|
|
172
|
+
devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/usecases/handle_remote_config_patterns.py,sha256=ct_TinG3-UnHmG0Ic2fgPAc6mvWjiyq1bxU7RqFIZXA,2203
|
|
173
173
|
devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/usecases/set_input_core.py,sha256=ZMr9l1h9-JdoT7QlLN8K9VTP2VP0B_5TZGMUQ6KyIYo,2525
|
|
174
174
|
devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
175
175
|
devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
@@ -177,7 +177,7 @@ devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_
|
|
|
177
177
|
devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/xray_tool/xray_deserialize_output.py,sha256=Vm0pj1i6a34xXouXUU95Y04hzR--9tcMQuycR7IMUnQ,2221
|
|
178
178
|
devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/driven_adapters/xray_tool/xray_manager_scan.py,sha256=mlGtHeZza3b4n0OeOcHLOALQHKU-C63wtHXSxfMRA_A,5780
|
|
179
179
|
devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/entry_points/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
180
|
-
devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/entry_points/entry_point_tool.py,sha256=
|
|
180
|
+
devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/entry_points/entry_point_tool.py,sha256=gsVZpEVUPvDWS4mrzsD-t1vCkasiOfJf88Z0DWQc9-4,2650
|
|
181
181
|
devsecops_engine_tools/engine_sca/engine_dependencies/src/infrastructure/helpers/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
182
182
|
devsecops_engine_tools/engine_utilities/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
183
183
|
devsecops_engine_tools/engine_utilities/settings.py,sha256=CPnDndwVeRgQNml3HVzvytVruDd8dTd1ICHbkMDSgTM,2144
|
|
@@ -242,8 +242,8 @@ devsecops_engine_tools/engine_utilities/utils/logger_info.py,sha256=4Mz8Bwlm9Mku
|
|
|
242
242
|
devsecops_engine_tools/engine_utilities/utils/name_conversion.py,sha256=ADJrRGaxYSDe0ZRh6VHRf53H4sXPcb-vNP_i81PUn3I,307
|
|
243
243
|
devsecops_engine_tools/engine_utilities/utils/printers.py,sha256=GAslbWaBpwP3mP6fBsgVl07TTBgcCggQTy8h2M9ibeo,612
|
|
244
244
|
devsecops_engine_tools/engine_utilities/utils/session_manager.py,sha256=yNtlT-8Legz1sHbGPH8LNYjL-LgDUE0zXG2rYjiab7U,290
|
|
245
|
-
devsecops_engine_tools-1.7.
|
|
246
|
-
devsecops_engine_tools-1.7.
|
|
247
|
-
devsecops_engine_tools-1.7.
|
|
248
|
-
devsecops_engine_tools-1.7.
|
|
249
|
-
devsecops_engine_tools-1.7.
|
|
245
|
+
devsecops_engine_tools-1.7.15.dist-info/METADATA,sha256=GUJEhgymElx7E5od7xgsAafkE56MrbZCoWhccou3LtE,4840
|
|
246
|
+
devsecops_engine_tools-1.7.15.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
|
|
247
|
+
devsecops_engine_tools-1.7.15.dist-info/entry_points.txt,sha256=9IjXF_7Zpgowq_SY6OSmsA9vZze18a8_AeHwkQVrgKk,131
|
|
248
|
+
devsecops_engine_tools-1.7.15.dist-info/top_level.txt,sha256=ge6y0X_xBAU1aG3EMWFtl9djbVyg5BxuSp2r2Lg6EQU,23
|
|
249
|
+
devsecops_engine_tools-1.7.15.dist-info/RECORD,,
|
|
@@ -1,156 +0,0 @@
|
|
|
1
|
-
Metadata-Version: 2.1
|
|
2
|
-
Name: devsecops-engine-tools
|
|
3
|
-
Version: 1.7.13
|
|
4
|
-
Summary: Tool for DevSecOps strategy
|
|
5
|
-
Home-page: https://github.com/bancolombia/devsecops-engine-tools
|
|
6
|
-
Author: Bancolombia DevSecOps Team
|
|
7
|
-
Author-email: devsecops@bancolombia.com.co
|
|
8
|
-
Classifier: Programming Language :: Python :: 3
|
|
9
|
-
Classifier: License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)
|
|
10
|
-
Classifier: Operating System :: OS Independent
|
|
11
|
-
Requires-Python: >=3.8
|
|
12
|
-
Description-Content-Type: text/markdown
|
|
13
|
-
Requires-Dist: requests ==2.31.0
|
|
14
|
-
Requires-Dist: multipledispatch ==0.6.0
|
|
15
|
-
Requires-Dist: PyYAML ==6.0.1
|
|
16
|
-
Requires-Dist: checkov ==2.3.296
|
|
17
|
-
Requires-Dist: pyfiglet ==0.7
|
|
18
|
-
Requires-Dist: prettytable ==3.8.0
|
|
19
|
-
Requires-Dist: azure-devops ==7.1.0b3
|
|
20
|
-
Requires-Dist: marshmallow ==3.19.0
|
|
21
|
-
Requires-Dist: pytz ==2023.3
|
|
22
|
-
Requires-Dist: python-decouple ==3.8
|
|
23
|
-
Requires-Dist: requests-toolbelt ==1.0.0
|
|
24
|
-
Requires-Dist: python-dateutil ==2.8.2
|
|
25
|
-
Requires-Dist: pexpect ==4.9.0
|
|
26
|
-
|
|
27
|
-
# DevSecOps Engine Tools
|
|
28
|
-
|
|
29
|
-
[](#)
|
|
30
|
-
[](https://github.com/bancolombia/devsecops-engine-tools/actions/workflows/build.yml)
|
|
31
|
-
[](#)
|
|
32
|
-
|
|
33
|
-
# Objective
|
|
34
|
-
|
|
35
|
-
Tool that unifies the evaluation of the different devsecops practices being agnostic to the devops platform, using both open source and market tools.
|
|
36
|
-
|
|
37
|
-
# Component
|
|
38
|
-
|
|
39
|
-
📦 [tools](https://github.com/bancolombia/devsecops-engine-tools/tree/trunk/tools): DevSecOps Practice Modules
|
|
40
|
-
|
|
41
|
-
# Communications channel
|
|
42
|
-
|
|
43
|
-
Here are the channels we use to communicate about the project:
|
|
44
|
-
|
|
45
|
-
**1. Mailing list:** You can join our mailing list to always be informed at the following link: [CommunityDevsecopsEngine](https://groups.google.com/g/CommunityDevsecopsEngine)
|
|
46
|
-
|
|
47
|
-
**2. Email:** You can write to us by email: MaintainersDevsecopsEngine@googlegroups.com
|
|
48
|
-
|
|
49
|
-
# Getting started
|
|
50
|
-
|
|
51
|
-
### Requirements
|
|
52
|
-
|
|
53
|
-
- Python >= 3.8
|
|
54
|
-
|
|
55
|
-
### Installation
|
|
56
|
-
|
|
57
|
-
```bash
|
|
58
|
-
pip3 install devsecops-engine-tools
|
|
59
|
-
```
|
|
60
|
-
|
|
61
|
-
### Scan running - flags (CLI)
|
|
62
|
-
|
|
63
|
-
```bash
|
|
64
|
-
devsecops-engine-tools --platform_devops ["local","azure"] --remote_config_repo ["remote_config_repo"] --tool ["engine_iac", "engine_dast", "engine_secret", "engine_dependencies", "engine_container"] --folder_path ["Folder path scan engine_iac"] --platform ["eks","openshift"] --use_secrets_manager ["false", "true"] --use_vulnerability_management ["false", "true"] --send_metrics ["false", "true"] --token_cmdb ["token_cmdb"] --token_vulnerability_management ["token_vulnerability_management"] --token_engine_container ["token_engine_container"] --token_engine_dependencies ["token_engine_dependencies"]
|
|
65
|
-
```
|
|
66
|
-
|
|
67
|
-
### Structure Remote Config
|
|
68
|
-
[example_remote_config_local](https://github.com/bancolombia/devsecops-engine-tools/blob/trunk/example_remote_config_local/)
|
|
69
|
-
```bash
|
|
70
|
-
📦Remote_Config
|
|
71
|
-
┣ 📂engine_core
|
|
72
|
-
┃ ┗ 📜ConfigTool.json
|
|
73
|
-
┣ 📂engine_sast
|
|
74
|
-
┃ ┗ 📂engine_iac
|
|
75
|
-
┃ ┗ 📜ConfigTool.json
|
|
76
|
-
┃ ┗ 📜Exclusions.json
|
|
77
|
-
┃ ┗ 📂engine_secret
|
|
78
|
-
┃ ┗ 📜ConfigTool.json
|
|
79
|
-
┣ 📂engine_sca
|
|
80
|
-
┃ ┗ 📂engine_container
|
|
81
|
-
┃ ┗ 📜ConfigTool.json
|
|
82
|
-
┃ ┗ 📜Exclusions.json
|
|
83
|
-
┃ ┗ 📂engine_dependencies
|
|
84
|
-
┃ ┗ 📜ConfigTool.json
|
|
85
|
-
┃ ┗ 📜Exclusions.json
|
|
86
|
-
```
|
|
87
|
-
### Scan running sample (CLI) - Local
|
|
88
|
-
|
|
89
|
-
> Complete the value in **.envdetlocal** file a set in execution environment
|
|
90
|
-
```
|
|
91
|
-
$ set -a
|
|
92
|
-
$ source .envdetlocal
|
|
93
|
-
$ set +a
|
|
94
|
-
```
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
```bash
|
|
98
|
-
devsecops-engine-tools --platform_devops local --remote_config_repo DevSecOps_Remote_Config --tool engine_iac
|
|
99
|
-
|
|
100
|
-
```
|
|
101
|
-
### Scan result sample (CLI)
|
|
102
|
-
|
|
103
|
-
```bash
|
|
104
|
-
____ _____ ____ ______ _ ______ __
|
|
105
|
-
/ __ \___ _ __/ ___/___ _____/ __ \____ _____ / ____/___ ____ _(_)___ ___ /_ __/___ ____ / /____
|
|
106
|
-
/ / / / _ \ | / /\__ \/ _ \/ ___/ / / / __ \/ ___/ / __/ / __ \/ __ `/ / __ \/ _ \ / / / __ \/ __ \/ / ___/
|
|
107
|
-
/ /_/ / __/ |/ /___/ / __/ /__/ /_/ / /_/ (__ ) / /___/ / / / /_/ / / / / / __/ / / / /_/ / /_/ / (__ )
|
|
108
|
-
/_____/\___/|___//____/\___/\___/\____/ .___/____/ /_____/_/ /_/\__, /_/_/ /_/\___/ /_/ \____/\____/_/____/
|
|
109
|
-
/_/ /____/
|
|
110
|
-
|
|
111
|
-
Secrets manager is not enabled to configure external checks
|
|
112
|
-
|
|
113
|
-
Below are all vulnerabilities detected.
|
|
114
|
-
╔══════════╦════════════╦════════════════════════════════════════════════════════════════════════════════════╦════════════════════════╗
|
|
115
|
-
║ Severity ║ ID ║ Description ║ Where ║
|
|
116
|
-
╠══════════╬════════════╬════════════════════════════════════════════════════════════════════════════════════╬════════════════════════╣
|
|
117
|
-
║ critical ║ CKV_K8S_37 ║ IAC-CKV_K8S_37 Minimize the admission of containers with capabilities assigned ║ /_AW1234/app.yaml ║
|
|
118
|
-
║ critical ║ CKV_K8S_20 ║ IAC-CKV_K8S_20 Containers should not run with allowPrivilegeEscalation ║ /_AW1234/app.yaml ║
|
|
119
|
-
║ critical ║ CKV_K8S_30 ║ IAC-CKV_K8S_30 Apply security context to your containers ║ /_AW1234/app.yaml ║
|
|
120
|
-
║ critical ║ CKV_K8S_23 ║ IAC-CKV_K8S_23 Minimize the admission of root containers ║ /_AW1234/app.yaml ║
|
|
121
|
-
║ high ║ CKV_AWS_20 ║ C-S3-005-AWS S3 buckets are accessible to public ║ /_AW1234/template.yaml ║
|
|
122
|
-
║ high ║ CKV_K8S_22 ║ IAC-CKV_K8S_22 Use read-only filesystem for containers where possible ║ /_AW1234/app.yaml ║
|
|
123
|
-
║ high ║ CKV_K8S_28 ║ IAC-CKV_K8S_28 Minimize the admission of containers with the NET_RAW capability ║ /_AW1234/app.yaml ║
|
|
124
|
-
║ high ║ CKV_K8S_38 ║ IAC-CKV_K8S_38 Ensure that Service Account Tokens are only mounted where necessary ║ /_AW1234/app.yaml ║
|
|
125
|
-
╚══════════╩════════════╩════════════════════════════════════════════════════════════════════════════════════╩════════════════════════╝
|
|
126
|
-
Security count issues (critical: 4, high: 4, medium: 0, low: 0) is greater than or equal to failure criteria (critical: 1, high: 8, medium: 10, low:15, operator: or)
|
|
127
|
-
✘Failed
|
|
128
|
-
|
|
129
|
-
Below are all compliances issues detected.
|
|
130
|
-
╔══════════╦═══════════╦════════════════════════════════════════════════════╦═══════════════════╗
|
|
131
|
-
║ Severity ║ ID ║ Description ║ Where ║
|
|
132
|
-
╠══════════╬═══════════╬════════════════════════════════════════════════════╬═══════════════════╣
|
|
133
|
-
║ critical ║ CKV_K8S_8 ║ IAC-CKV_K8S_8 Liveness Probe Should be Configured ║ /_AW1234/app.yaml ║
|
|
134
|
-
║ critical ║ CKV_K8S_9 ║ IAC-CKV_K8S_9 Readiness Probe Should be Configured ║ /_AW1234/app.yaml ║
|
|
135
|
-
╚══════════╩═══════════╩════════════════════════════════════════════════════╩═══════════════════╝
|
|
136
|
-
Compliance issues count (critical: 2) is greater than or equal to failure criteria (critical: 1)
|
|
137
|
-
✘Failed
|
|
138
|
-
|
|
139
|
-
Bellow are all the findings that were accepted.
|
|
140
|
-
╔══════════╦════════════╦═══════════════════╦═════════════╦══════════════╦══════════════════╗
|
|
141
|
-
║ Severity ║ ID ║ Where ║ Create Date ║ Expired Date ║ Reason ║
|
|
142
|
-
╠══════════╬════════════╬═══════════════════╬═════════════╬══════════════╬══════════════════╣
|
|
143
|
-
║ high ║ CKV_K8S_38 ║ /_AW1234/app.yaml ║ 18/11/2023 ║ 18/03/2024 ║ False Positive ║
|
|
144
|
-
╚══════════╩════════════╩═══════════════════╩═════════════╩══════════════╩══════════════════╝
|
|
145
|
-
|
|
146
|
-
message custom
|
|
147
|
-
```
|
|
148
|
-
|
|
149
|
-
# How can I help?
|
|
150
|
-
|
|
151
|
-
Review the issues, we hear new ideas. Read more [Contributing](https://github.com/bancolombia/devsecops-engine-tools/blob/trunk/docs/CONTRIBUTING.md)
|
|
152
|
-
|
|
153
|
-
|
|
154
|
-
|
|
155
|
-
|
|
156
|
-
|
|
File without changes
|
{devsecops_engine_tools-1.7.13.dist-info → devsecops_engine_tools-1.7.15.dist-info}/entry_points.txt
RENAMED
|
File without changes
|
{devsecops_engine_tools-1.7.13.dist-info → devsecops_engine_tools-1.7.15.dist-info}/top_level.txt
RENAMED
|
File without changes
|