devsecops-engine-tools 1.7.15__tar.gz → 1.7.17__tar.gz

{devsecops_engine_tools-1.7.15 → devsecops_engine_tools-1.7.17}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.7.15
+Version: 1.7.17
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.7.15 → devsecops_engine_tools-1.7.17}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/defect_dojo/defect_dojo.py

@@ -54,6 +54,7 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                 "PRISMA": "Twistlock Image Scan",
                 "XRAY": "JFrog Xray On Demand Binary Scan",
                 "TRUFFLEHOG": "Trufflehog Scan",
+                "TRIVY": "Trivy Scan",
             }
 
             if any(

devsecops_engine_tools-1.7.17/devsecops_engine_tools/engine_sca/engine_container/src/domain/usecases/container_sca_scan.py

@@ -0,0 +1,90 @@
+from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.gateways.tool_gateway import (
+    ToolGateway,
+)
+from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.gateways.images_gateway import (
+    ImagesGateway,
+)
+from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.gateways.deserealizator_gateway import (
+    DeseralizatorGateway,
+)
+
+import os
+
+
+class ContainerScaScan:
+    def __init__(
+        self,
+        tool_run: ToolGateway,
+        remote_config,
+        tool_images: ImagesGateway,
+        tool_deseralizator: DeseralizatorGateway,
+        build_id,
+        token,
+    ):
+        self.tool_run = tool_run
+        self.remote_config = remote_config
+        self.tool_images = tool_images
+        self.tool_deseralizator = tool_deseralizator
+        self.build_id = build_id
+        self.token = token
+
+    def get_latest_image(self):
+        """
+        Process the list of images.
+
+        Returns:
+            list: List of processed images.
+        """
+        return self.tool_images.list_images()
+
+    def get_images_already_scanned(self):
+        """
+        Create images scanned file if it does not exist and get the images that have already been scanned.
+        """
+        scanned_images_file = os.path.join(os.getcwd(), "scanned_images.txt")
+        if not os.path.exists(scanned_images_file):
+            open(scanned_images_file, "w").close()
+        with open(scanned_images_file, "r") as file:
+            images_scanned = file.read().splitlines()
+        return images_scanned
+
+    def set_image_scanned(self, result_file):
+        """
+        Write in scanned_images.txt the result file
+        """
+        with open("scanned_images.txt", "a") as file:
+            file.write(result_file + "\n")
+
+    def process(self):
+        """
+        Process SCA scanning.
+
+        Returns:
+            string: file scanning results name.
+        """
+        latest_image = self.get_latest_image()
+        image_name = latest_image.tags[0]
+        image_scanned = None
+        if str(self.build_id) in image_name:
+            result_file = image_name + "_scan_result.json"
+            if result_file in self.get_images_already_scanned():
+                print(f"The image {image_name} has already been scanned previously.")
+                return image_scanned
+            image_scanned = self.tool_run.run_tool_container_sca(
+                self.remote_config, self.token, image_name, result_file
+            )
+            self.set_image_scanned(result_file)
+        else:
+            print(
+                f"'{image_name}' name does not contain build number '{self.build_id}'. Tool skipped."
+            )
+        return image_scanned
+
+    def deseralizator(self, image_scanned):
+        """
+        Process the results deserializer.
+
+        Returns:
+            list: Deserialized list of findings.
+        """
+        return self.tool_deseralizator.get_list_findings(image_scanned)

{devsecops_engine_tools-1.7.15 → devsecops_engine_tools-1.7.17}/devsecops_engine_tools/engine_sca/engine_container/src/domain/usecases/set_input_core.py

@@ -31,7 +31,7 @@ class SetInputCore:
         ]
         return list_exclusions
 
-    def set_input_core(self, images_scanned):
+    def set_input_core(self, image_scanned):
         """
         Set the input core.
 
@@ -45,7 +45,7 @@ class SetInputCore:
                 self.tool,
             ),
             Threshold(self.remote_config["THRESHOLD"]),
-            images_scanned[-1] if images_scanned else None,
+            image_scanned,
             self.remote_config["MESSAGE_INFO_ENGINE_CONTAINER"],
             self.pipeline_name,
             self.stage.capitalize(),

{devsecops_engine_tools-1.7.15 → devsecops_engine_tools-1.7.17}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/docker/docker_images.py

@@ -4,6 +4,11 @@ from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.gateway
 )
 import docker
 
+from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
+from devsecops_engine_tools.engine_utilities import settings
+
+logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
+
 
 class DockerImages(ImagesGateway):
     def list_images(self):
@@ -18,5 +23,7 @@ class DockerImages(ImagesGateway):
             print("Tag last image:", latest_image.tags)
             print("Created date last image:", latest_image.attrs["Created"])
             return latest_image
-        except subprocess.CalledProcessError as e:
-            raise ValueError(f"Error listing images:{e.stderr}")
+        except Exception as e:
+            logger.error(
+                f"Error listing images, docker must be running and added to PATH: {e}"
+            )

devsecops_engine_tools-1.7.17/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/prisma_cloud/prisma_cloud_manager_scan.py

@@ -0,0 +1,100 @@
+import stat
+import requests
+import os
+import subprocess
+import logging
+import base64
+from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.gateways.tool_gateway import (
+    ToolGateway,
+)
+from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
+from devsecops_engine_tools.engine_utilities import settings
+
+logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
+
+
+class PrismaCloudManagerScan(ToolGateway):
+    def download_twistcli(
+        self,
+        file_path,
+        prisma_access_key,
+        prisma_secret_key,
+        prisma_console_url,
+        prisma_api_version,
+    ):
+        url = f"{prisma_console_url}/api/{prisma_api_version}/util/twistcli"
+        credentials = base64.b64encode(
+            f"{prisma_access_key}:{prisma_secret_key}".encode()
+        ).decode()
+        headers = {"Authorization": f"Basic {credentials}"}
+        try:
+            response = requests.get(url, headers=headers)
+            response.raise_for_status()
+
+            with open(file_path, "wb") as file:
+                file.write(response.content)
+
+            os.chmod(file_path, stat.S_IRWXU)
+            logging.info(f"twistcli downloaded and saved to: {file_path}")
+            return 0
+
+        except Exception as e:
+            raise ValueError(f"Error downloading twistcli: {e}")
+
+    def scan_image(
+        self, file_path, image_name, result_file, remoteconfig, prisma_secret_key
+    ):
+        command = (
+            file_path,
+            "images",
+            "scan",
+            "--address",
+            remoteconfig["PRISMA_CLOUD"]["PRISMA_CONSOLE_URL"],
+            "--user",
+            remoteconfig["PRISMA_CLOUD"]["PRISMA_ACCESS_KEY"],
+            "--password",
+            prisma_secret_key,
+            "--output-file",
+            result_file,
+            "--details",
+            image_name,
+        )
+        try:
+            subprocess.run(
+                command,
+                check=True,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                text=True,
+            )
+            print(f"The image {image_name} was scanned")
+
+            return result_file
+
+        except subprocess.CalledProcessError as e:
+            logger.error(f"Error during image scan of {image_name}: {e.stderr}")
+
+    def run_tool_container_sca(
+        self, remoteconfig, prisma_secret_key, image_name, result_file
+    ):
+        file_path = os.path.join(
+            os.getcwd(), remoteconfig["PRISMA_CLOUD"]["TWISTCLI_PATH"]
+        )
+
+        if not os.path.exists(file_path):
+            self.download_twistcli(
+                file_path,
+                remoteconfig["PRISMA_CLOUD"]["PRISMA_ACCESS_KEY"],
+                prisma_secret_key,
+                remoteconfig["PRISMA_CLOUD"]["PRISMA_CONSOLE_URL"],
+                remoteconfig["PRISMA_CLOUD"]["PRISMA_API_VERSION"],
+            )
+        image_scanned = self.scan_image(
+            file_path,
+            image_name,
+            result_file,
+            remoteconfig,
+            prisma_secret_key,
+        )
+
+        return image_scanned

devsecops_engine_tools-1.7.17/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/prisma_cloud/prisma_deserialize_output.py

@@ -0,0 +1,64 @@
+from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.gateways.deserealizator_gateway import (
+    DeseralizatorGateway,
+)
+from devsecops_engine_tools.engine_core.src.domain.model.finding import (
+    Finding,
+    Category,
+)
+from datetime import datetime
+from dataclasses import dataclass
+import json
+
+
+@dataclass
+class PrismaDeserealizator(DeseralizatorGateway):
+    def get_list_findings(self, image_scanned) -> "list[Finding]":
+        list_open_vulnerabilities = []
+        SEVERITY_MAP = {
+            "unimportant": "low",
+            "unassigned": "low",
+            "negligible": "low",
+            "not yet assigned": "low",
+            "low": "low",
+            "medium": "medium",
+            "moderate": "medium",
+            "high": "high",
+            "important": "high",
+            "critical": "critical",
+        }
+        with open(image_scanned, "rb") as file:
+            image_object = file.read()
+
+            json_data = json.loads(image_object)
+            vulnerabilities_data = (
+                json_data["results"][0]["vulnerabilities"]
+                if "vulnerabilities" in json_data["results"][0]
+                else []
+            )
+
+            # Create a list of findings instances from the JSON data
+            vulnerabilities = [
+                Finding(
+                    id=vul.get("id", ""),
+                    cvss=float(vul.get("cvss", 0.0)),
+                    where=vul.get("packageName", "")
+                    + ":"
+                    + vul.get("packageVersion", ""),
+                    description=vul.get("description", "")[:150],
+                    severity=SEVERITY_MAP.get(vul.get("severity", ""), ""),
+                    identification_date=datetime.strptime(
+                        vul.get("discoveredDate", ""), "%Y-%m-%dT%H:%M:%S%z"
+                    ),
+                    published_date_cve=vul.get("publishedDate", "").replace("Z", "+00:00"),
+                    module="engine_container",
+                    category=Category.VULNERABILITY,
+                    requirements=vul.get("status", ""),
+                    tool="PrismaCloud",
+                )
+                for vul in vulnerabilities_data
+            ]
+
+            # Add the Vulnerability instances to the list
+            list_open_vulnerabilities.extend(vulnerabilities)
+
+        return list_open_vulnerabilities

devsecops_engine_tools-1.7.17/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/trivy_tool/trivy_deserialize_output.py

@@ -0,0 +1,63 @@
+from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.gateways.deserealizator_gateway import (
+    DeseralizatorGateway,
+)
+from devsecops_engine_tools.engine_core.src.domain.model.finding import (
+    Finding,
+    Category,
+)
+from dataclasses import dataclass
+import json
+from datetime import datetime, timezone
+
+
+@dataclass
+class TrivyDeserializator(DeseralizatorGateway):
+    def check_date_format(self, vul):
+        try:
+            published_date_cve=datetime.strptime(
+                vul.get("PublishedDate"),
+                "%Y-%m-%dT%H:%M:%S.%fZ"
+            ).replace(tzinfo=timezone.utc).isoformat()
+        except:
+            published_date_cve=datetime.strptime(
+                vul.get("PublishedDate"),
+                "%Y-%m-%dT%H:%M:%SZ"
+            ).replace(tzinfo=timezone.utc).isoformat()
+        return published_date_cve
+
+    def get_list_findings(self, image_scanned) -> "list[Finding]":
+        list_open_vulnerabilities = []
+        with open(image_scanned, "rb") as file:
+            image_object = file.read()
+            json_data = json.loads(image_object)
+            vulnerabilities_data = json_data["Results"][0].get("Vulnerabilities", [])
+            vulnerabilities = [
+                Finding(
+                    id=vul.get("VulnerabilityID", ""),
+                    cvss=str(next(
+                        (
+                            v["V3Score"]
+                            for v in vul["CVSS"].values()
+                            if "V3Score" in v
+                        ),
+                        None,
+                    )),
+                    where=vul.get("PkgName", "")
+                    + " "
+                    + vul.get("InstalledVersion", ""),
+                    description=vul.get("Description", "").replace("\n", "")[:150],
+                    severity=vul.get("Severity", "").lower(),
+                    identification_date=datetime.now().strftime(
+                        "%Y-%m-%dT%H:%M:%S%z"
+                    ),
+                    published_date_cve=self.check_date_format(vul),
+                    module="engine_container",
+                    category=Category.VULNERABILITY,
+                    requirements=vul.get("FixedVersion") or vul.get("Status", ""),
+                    tool="Trivy",
+                )
+                for vul in vulnerabilities_data
+                if vul.get("CVSS") and vul.get("PublishedDate")
+            ]
+            list_open_vulnerabilities.extend(vulnerabilities)
+        return list_open_vulnerabilities

devsecops_engine_tools-1.7.17/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/trivy_tool/trivy_manager_scan.py

@@ -0,0 +1,106 @@
+from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.gateways.tool_gateway import (
+    ToolGateway,
+)
+
+import subprocess
+import platform
+import requests
+import tarfile
+import zipfile
+
+from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
+from devsecops_engine_tools.engine_utilities import settings
+
+logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
+
+
+class TrivyScan(ToolGateway):
+    def download_tool(self, file, url):
+        try:
+            response = requests.get(url, allow_redirects=True)
+            with open(file, "wb") as compress_file:
+                compress_file.write(response.content)
+        except Exception as e:
+            logger.error(f"Error downloading trivy: {e}")
+
+    def install_tool(self, file, url):
+        installed = subprocess.run(
+            ["which", "./trivy"],
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+        )
+        if installed.returncode == 1:
+            try:
+                self.download_tool(file, url)
+                with tarfile.open(file, 'r:gz') as tar_file:
+                    tar_file.extract(member=tar_file.getmember("trivy"))
+            except Exception as e:
+                logger.error(f"Error installing trivy: {e}")
+        
+    def install_tool_windows(self, file, url):
+        try:
+            subprocess.run(
+                ["./trivy.exe", "--version"],
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+            )
+        except:
+            try:
+                self.download_tool(file, url)
+                with zipfile.ZipFile(file, 'r') as zip_file:
+                    zip_file.extract(member="trivy.exe")
+            except Exception as e:
+                logger.error(f"Error installing trivy: {e}")
+
+    def scan_image(self, prefix, image_name, result_file):
+        command = [
+            prefix,
+            "--scanners",
+            "vuln",
+            "-f",
+            "json",
+            "-o",
+            result_file,
+        ]
+        command.extend(["--quiet", "image", image_name])
+        try:
+            subprocess.run(
+                command,
+                check=True,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                text=True,
+            )
+            print(f"The image {image_name} was scanned")
+
+            return result_file
+
+        except Exception as e:
+            logger.error(f"Error during image scan of {image_name}: {e}")
+
+    def run_tool_container_sca(self, remoteconfig, token, image_name, result_file):
+        trivy_version = remoteconfig["TRIVY"]["TRIVY_VERSION"]
+        os_platform = platform.system()
+        base_url = f"https://github.com/aquasecurity/trivy/releases/download/v{trivy_version}/"
+
+        if os_platform == "Linux":
+            file=f"trivy_{trivy_version}_Linux-64bit.tar.gz"
+            self.install_tool(file, base_url+file)
+            command_prefix = "./trivy"
+        elif os_platform == "Darwin":
+            file=f"trivy_{trivy_version}_macOS-64bit.tar.gz"
+            self.install_tool(file, base_url+file)
+            command_prefix = "./trivy"
+        elif os_platform == "Windows":
+            file=f"trivy_{trivy_version}_windows-64bit.zip"
+            self.install_tool_windows(file, base_url+file)
+            command_prefix = "./trivy.exe"
+        else:
+            logger.warning(f"{os_platform} is not supported.")
+            return None
+
+        image_scanned = (
+            self.scan_image(command_prefix, image_name, result_file)
+        )
+
+        return image_scanned

{devsecops_engine_tools-1.7.15 → devsecops_engine_tools-1.7.17}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/entry_points/entry_point_tool.py

@@ -36,7 +36,7 @@ def init_engine_sca_rm(
     scan_flag = handle_remote_config_patterns.ignore_analysis_pattern()
     build_id = tool_remote.get_variable("build_id")
     stage = tool_remote.get_variable("stage")
-    images_scanned = []
+    image_scanned = None
     deseralized = []
     input_core = SetInputCore(remote_config, exclusions, pipeline_name, tool, stage)
     if scan_flag and not (skip_flag):
@@ -48,11 +48,12 @@ def init_engine_sca_rm(
             build_id,
             token,
         )
-        images_scanned = container_sca_scan.process()
-        deseralized = container_sca_scan.deseralizator(images_scanned)
+        image_scanned = container_sca_scan.process()
+        if image_scanned:
+            deseralized = container_sca_scan.deseralizator(image_scanned)
     else:
         print("Tool skipped by DevSecOps policy")
         logger.info("Tool skipped by DevSecOps policy")
-    core_input = input_core.set_input_core(images_scanned)
+    core_input = input_core.set_input_core(image_scanned)
 
     return deseralized, core_input

{devsecops_engine_tools-1.7.15 → devsecops_engine_tools-1.7.17}/devsecops_engine_tools/engine_sca/engine_dependencies/src/domain/usecases/find_artifacts.py

@@ -89,7 +89,8 @@ class FindArtifacts:
             if os.path.isfile(os.path.join(dir_to_scan_path, file))
         ]
         if files:
-            logger.debug(f"Files to scan: {", ".join(files)}")
-            print(f"Files to scan: {", ".join(files)}")
+            files_string = ", ".join(files)
+            logger.debug(f"Files to scan: {files_string}")
+            print(f"Files to scan: {files_string}")
 
         return dir_to_scan_path

devsecops_engine_tools-1.7.17/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.7.17'

{devsecops_engine_tools-1.7.15 → devsecops_engine_tools-1.7.17}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.7.15
+Version: 1.7.17
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.7.15 → devsecops_engine_tools-1.7.17}/devsecops_engine_tools.egg-info/SOURCES.txt

@@ -162,7 +162,6 @@ devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_ada
 devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/entry_points/__init__.py
 devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/entry_points/entry_point_tool.py
 devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/helpers/__init__.py
-devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/helpers/images_scanned.py
 devsecops_engine_tools/engine_sca/engine_dependencies/__init__.py
 devsecops_engine_tools/engine_sca/engine_dependencies/src/__init__.py
 devsecops_engine_tools/engine_sca/engine_dependencies/src/applications/__init__.py

devsecops_engine_tools-1.7.15/devsecops_engine_tools/engine_sca/engine_container/src/domain/usecases/container_sca_scan.py

@@ -1,56 +0,0 @@
-from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.gateways.tool_gateway import (
-    ToolGateway,
-)
-from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.gateways.images_gateway import (
-    ImagesGateway,
-)
-from devsecops_engine_tools.engine_sca.engine_container.src.domain.model.gateways.deserealizator_gateway import (
-    DeseralizatorGateway,
-)
-
-
-class ContainerScaScan:
-    def __init__(
-        self,
-        tool_run: ToolGateway,
-        remote_config,
-        tool_images: ImagesGateway,
-        tool_deseralizator: DeseralizatorGateway,
-        build_id,
-        token,
-    ):
-        self.tool_run = tool_run
-        self.remote_config = remote_config
-        self.tool_images = tool_images
-        self.tool_deseralizator = tool_deseralizator
-        self.build_id = build_id
-        self.token = token
-
-    def scan_image(self):
-        """
-        Process the list of images.
-
-        Returns:
-            list: List of processed images.
-        """
-        return self.tool_images.list_images()
-
-    def process(self):
-        """
-        Process SCA scanning.
-
-        Returns:
-            dict: SCA scanning results.
-        """
-        return self.tool_run.run_tool_container_sca(
-            self.remote_config, self.token, self.scan_image(), self.build_id
-        )
-
-    def deseralizator(self, image_scanned):
-        """
-        Process the results deserializer.
-
-        Returns:
-            list: Deserialized list of findings.
-        """
-        return self.tool_deseralizator.get_list_findings(image_scanned)