devsecops-engine-tools 1.8.2__tar.gz → 1.8.4__tar.gz

{devsecops_engine_tools-1.8.2 → devsecops_engine_tools-1.8.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.8.2
+Version: 1.8.4
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team
@@ -33,6 +33,8 @@ Requires-Dist: setuptools==72.1.0
 [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=bancolombia_devsecops-engine-tools&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=bancolombia_devsecops-engine-tools)
 [![Coverage](https://sonarcloud.io/api/project_badges/measure?project=bancolombia_devsecops-engine-tools&metric=coverage)](https://sonarcloud.io/summary/new_code?id=bancolombia_devsecops-engine-tools)
 [![Python Version](https://img.shields.io/badge/python%20-%203.8%20%7C%203.9%20%7C%203.10%20%7C%203.11%20%7C%203.12%20-blue)](#)
+[![Docker Pulls](https://img.shields.io/docker/pulls/bancolombia/devsecops-engine-tools
+)](https://hub.docker.com/r/bancolombia/devsecops-engine-tools)
 
 # Objective
 
@@ -65,7 +67,7 @@ pip3 install devsecops-engine-tools
 ### Scan running - flags (CLI)
 
 ```bash
-devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_config_repo ["remote_config_repo"] --tool ["engine_iac", "engine_dast", "engine_secret", "engine_dependencies", "engine_container"] --folder_path ["Folder path scan engine_iac"] --platform ["k8s","cloudformation","docker", "openapi"] --use_secrets_manager ["false", "true"] --use_vulnerability_management ["false", "true"] --send_metrics ["false", "true"] --token_cmdb ["token_cmdb"] --token_vulnerability_management ["token_vulnerability_management"] --token_engine_container ["token_engine_container"] --token_engine_dependencies ["token_engine_dependencies"] --xray_mode ["scan", "audit"] --image_to_scan ["image_to_scan"]
+devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_config_repo ["remote_config_repo"] --tool ["engine_iac", "engine_dast", "engine_secret", "engine_dependencies", "engine_container"] --folder_path ["Folder path scan engine_iac"] --platform ["k8s","cloudformation","docker", "openapi"] --use_secrets_manager ["false", "true"] --use_vulnerability_management ["false", "true"] --send_metrics ["false", "true"] --token_cmdb ["token_cmdb"] --token_vulnerability_management ["token_vulnerability_management"] --token_engine_container ["token_engine_container"] --token_engine_dependencies ["token_engine_dependencies"] --token_external_checks ["token_external_checks"] --xray_mode ["scan", "audit"] --image_to_scan ["image_to_scan"]
 ```
 
 ### Structure Remote Config
@@ -154,6 +156,23 @@ devsecops-engine-tools --platform_devops local --remote_config_repo DevSecOps_Re
 
 ![Demo CLI Local](docs/demo_session.svg)
 
+### Scan running sample (Docker)
+
+> Installation
+
+```bash
+docker pull bancolombia/devsecops-engine-tools
+```
+```bash
+docker run --rm -v ./folder_to_analyze:/folder_to_analyze bancolombia/devsecops-engine-tools:latest devsecops-engine-tools --platform_devops local --remote_config_repo docker_default_remote_config --tool engine_iac --folder_path /folder_to_analyze
+```
+
+The docker image have it own default remote config with basic configuration called docker_default_remote_config, but you can define your own config and pass it as volume
+
+```bash
+docker run --rm -v ./folder_to_analyze:/folder_to_analyze -v ./custom_remote_config:/custom_remote_config bancolombia/devsecops-engine-tools:latest devsecops-engine-tools --platform_devops local --remote_config_repo custom_remote_config --tool engine_iac --folder_path /folder_to_analyze
+```
+
 
 ### Scan running sample - Azure Pipelines
 

{devsecops_engine_tools-1.8.2 → devsecops_engine_tools-1.8.4}/devsecops_engine_tools/engine_core/src/domain/usecases/break_build.py

@@ -333,7 +333,7 @@ class BreakBuild:
                                 (
                                     elem.create_date
                                     for elem in exclusions
-                                    if elem.id == item.id
+                                    if elem.id == item.id and elem.where in item.where or "all" in elem.where
                                 ),
                                 None,
                             ),
@@ -341,7 +341,7 @@ class BreakBuild:
                                 (
                                     elem.expired_date
                                     for elem in exclusions
-                                    if elem.id == item.id
+                                    if elem.id == item.id and elem.where in item.where or "all" in elem.where
                                 ),
                                 None,
                             ),
@@ -349,7 +349,7 @@ class BreakBuild:
                                 (
                                     elem.reason
                                     for elem in exclusions
-                                    if elem.id == item.id
+                                    if elem.id == item.id and elem.where in item.where or "all" in elem.where
                                 ),
                                 None,
                             ),

{devsecops_engine_tools-1.8.2 → devsecops_engine_tools-1.8.4}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/azure/azure_devops.py

@@ -91,7 +91,6 @@ class AzureDevops(DevopsPlatformGateway):
                 "path_directory": SystemVariables.System_DefaultWorkingDirectory,
                 "os": AgentVariables.Agent_OS,
                 "temp_directory": AgentVariables.Agent_TempDirectory,
-                "agent_directory": AgentVariables.Agent_BuildDirectory,
                 "target_branch": SystemVariables.System_TargetBranchName,
                 "source_branch": SystemVariables.System_SourceBranch,
                 "repository_provider": BuildVariables.Build_Repository_Provider,

{devsecops_engine_tools-1.8.2 → devsecops_engine_tools-1.8.4}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/defect_dojo/defect_dojo.py

@@ -163,6 +163,11 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                 "tags": tool,
                 "limit": dd_limits_query,
             }
+            transfer_finding_query_params = {
+                "risk_status": "Transfer Accepted",
+                "tags": tool,
+                "limit": dd_limits_query,
+            }
 
             exclusions_risk_accepted = self._get_findings_with_exclusions(
                 session_manager,
@@ -184,7 +189,17 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                 "False Positive",
             )
 
-            return list(exclusions_risk_accepted) + list(exclusions_false_positive)
+            exclusions_transfer_finding = self._get_findings_with_exclusions(
+                session_manager,
+                service,
+                dd_max_retries,
+                transfer_finding_query_params,
+                tool,
+                self._format_date_to_dd_format,
+                "Transferred Finding",
+            )
+
+            return list(exclusions_risk_accepted) + list(exclusions_false_positive) + list(exclusions_transfer_finding)
         except Exception as ex:
             raise ExceptionFindingsExcepted(
                 "Error getting excepted findings with the following error: {0} ".format(
@@ -268,19 +283,22 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
                     raise e
 
     def _create_exclusion(self, finding, date_fn, tool, reason):
+        if reason == "False Positive":
+            create_date = date_fn(finding.last_status_update)
+            expired_date = date_fn(None)
+        elif reason == "Transferred Finding":
+            create_date = date_fn(finding.transfer_finding.date)
+            expired_date = date_fn(finding.transfer_finding.expiration_date)
+        else:
+            last_accepted_risk = finding.accepted_risks[-1]
+            create_date = date_fn(last_accepted_risk["created"])
+            expired_date = date_fn(last_accepted_risk["expiration_date"])
+        
         return Exclusions(
             id=finding.vuln_id_from_tool,
             where=self._get_where(finding, tool),
-            create_date=date_fn(
-                finding.last_status_update
-                if reason == "False Positive"
-                else finding.accepted_risks[-1]["created"]
-            ),
-            expired_date=date_fn(
-                None
-                if reason == "False Positive"
-                else finding.accepted_risks[-1]["expiration_date"]
-            ),
+            create_date=create_date,
+            expired_date=expired_date,
             reason=reason,
         )
 

{devsecops_engine_tools-1.8.2 → devsecops_engine_tools-1.8.4}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/github/github_actions.py

@@ -85,7 +85,6 @@ class GithubActions(DevopsPlatformGateway):
             "path_directory": SystemVariables.github_workspace,
             "os": AgentVariables.runner_os,
             "temp_directory": AgentVariables.runner_tool_cache,
-            "agent_directory": AgentVariables.runner_workspace,
             "target_branch": SystemVariables.github_event_base_ref,
             "source_branch": SystemVariables.github_ref,
             "repository_provider": BuildVariables.GitHub,

{devsecops_engine_tools-1.8.2 → devsecops_engine_tools-1.8.4}/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/runtime_local/runtime_local.py

@@ -62,7 +62,6 @@ class RuntimeLocal(DevopsPlatformGateway):
             "path_directory" : "DET_PATH_DIRECTORY",
             "os" : "DET_OS",
             "temp_directory" : "DET_TEMP_DIRECTORY",
-            "agent_directory" : "DET_AGENT_DIRECTORY",
             "target_branch" : "DET_TARGET_BRANCH",
             "source_branch" : "DET_SOURCE_BRANCH",
             "repository_provider" : "DET_REPOSITORY_PROVIDER"

{devsecops_engine_tools-1.8.2 → devsecops_engine_tools-1.8.4}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/docker/docker_images.py

@@ -17,7 +17,7 @@ class DockerImages(ImagesGateway):
 
             matching_image = None
             for image in images:
-                if image_to_scan in image.tags:
+                if any(image_to_scan in tag for tag in image.tags):
                     matching_image = image
                     break
 

{devsecops_engine_tools-1.8.2 → devsecops_engine_tools-1.8.4}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/trivy_tool/trivy_manager_scan.py

@@ -81,18 +81,19 @@ class TrivyScan(ToolGateway):
     def run_tool_container_sca(self, remoteconfig, token, image_name, result_file):
         trivy_version = remoteconfig["TRIVY"]["TRIVY_VERSION"]
         os_platform = platform.system()
+        arch_platform = platform.architecture()[0]
         base_url = f"https://github.com/aquasecurity/trivy/releases/download/v{trivy_version}/"
 
         if os_platform == "Linux":
-            file=f"trivy_{trivy_version}_Linux-64bit.tar.gz"
+            file=f"trivy_{trivy_version}_Linux-{arch_platform}.tar.gz"
             self.install_tool(file, base_url+file)
             command_prefix = "./trivy"
         elif os_platform == "Darwin":
-            file=f"trivy_{trivy_version}_macOS-64bit.tar.gz"
+            file=f"trivy_{trivy_version}_macOS-{arch_platform}.tar.gz"
             self.install_tool(file, base_url+file)
             command_prefix = "./trivy"
         elif os_platform == "Windows":
-            file=f"trivy_{trivy_version}_windows-64bit.zip"
+            file=f"trivy_{trivy_version}_windows-{arch_platform}.zip"
             self.install_tool_windows(file, base_url+file)
             command_prefix = "./trivy.exe"
         else:

{devsecops_engine_tools-1.8.2 → devsecops_engine_tools-1.8.4}/devsecops_engine_tools/engine_utilities/defect_dojo/domain/models/finding.py

@@ -2,6 +2,11 @@ import dataclasses
 from typing import List
 from devsecops_engine_tools.engine_utilities.utils.dataclass_classmethod import FromDictMixin
 
+@dataclasses.dataclass
+class TransferFinding(FromDictMixin):
+    id: int = 0
+    date : str = ""
+    expiration_date: str = ""
 
 @dataclasses.dataclass
 class Finding(FromDictMixin):
@@ -10,6 +15,7 @@ class Finding(FromDictMixin):
     request_response = None
     req_resp: List[None] = dataclasses.field(default_factory=list)
     accepted_risks: List[None] = dataclasses.field(default_factory=list)
+    transfer_finding: TransferFinding = None
     push_to_jira: bool = False
     age: int = 0
     sla_days_remaining: int = 0

{devsecops_engine_tools-1.8.2 → devsecops_engine_tools-1.8.4}/devsecops_engine_tools/engine_utilities/defect_dojo/domain/serializers/finding.py

@@ -61,7 +61,7 @@ class FindingSerializer(Schema):
     reviewers = fields.List(fields.Int, requerided=False)
     risk_accetance = fields.Int(requerided=False)
     risk_status = fields.Str(
-        required=False, validate=validate.OneOf(["Risk Pending", "Risk Rejected", "Risk Accepted", "Risk Active"])
+        required=False, validate=validate.OneOf(["Risk Pending", "Risk Rejected", "Risk Expired", "Risk Accepted", "Risk Active", "Transfer Pending", "Transfer Rejected", "Transfer Expired", "Transfer Accepted"])
     )
     risk_accepted = fields.Bool(requerided=False)
     sast_sink_object = fields.Str(requeride=False)

devsecops_engine_tools-1.8.4/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.8.4'

{devsecops_engine_tools-1.8.2 → devsecops_engine_tools-1.8.4}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.8.2
+Version: 1.8.4
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team
@@ -33,6 +33,8 @@ Requires-Dist: setuptools==72.1.0
 [![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=bancolombia_devsecops-engine-tools&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=bancolombia_devsecops-engine-tools)
 [![Coverage](https://sonarcloud.io/api/project_badges/measure?project=bancolombia_devsecops-engine-tools&metric=coverage)](https://sonarcloud.io/summary/new_code?id=bancolombia_devsecops-engine-tools)
 [![Python Version](https://img.shields.io/badge/python%20-%203.8%20%7C%203.9%20%7C%203.10%20%7C%203.11%20%7C%203.12%20-blue)](#)
+[![Docker Pulls](https://img.shields.io/docker/pulls/bancolombia/devsecops-engine-tools
+)](https://hub.docker.com/r/bancolombia/devsecops-engine-tools)
 
 # Objective
 
@@ -65,7 +67,7 @@ pip3 install devsecops-engine-tools
 ### Scan running - flags (CLI)
 
 ```bash
-devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_config_repo ["remote_config_repo"] --tool ["engine_iac", "engine_dast", "engine_secret", "engine_dependencies", "engine_container"] --folder_path ["Folder path scan engine_iac"] --platform ["k8s","cloudformation","docker", "openapi"] --use_secrets_manager ["false", "true"] --use_vulnerability_management ["false", "true"] --send_metrics ["false", "true"] --token_cmdb ["token_cmdb"] --token_vulnerability_management ["token_vulnerability_management"] --token_engine_container ["token_engine_container"] --token_engine_dependencies ["token_engine_dependencies"] --xray_mode ["scan", "audit"] --image_to_scan ["image_to_scan"]
+devsecops-engine-tools --platform_devops ["local","azure","github"] --remote_config_repo ["remote_config_repo"] --tool ["engine_iac", "engine_dast", "engine_secret", "engine_dependencies", "engine_container"] --folder_path ["Folder path scan engine_iac"] --platform ["k8s","cloudformation","docker", "openapi"] --use_secrets_manager ["false", "true"] --use_vulnerability_management ["false", "true"] --send_metrics ["false", "true"] --token_cmdb ["token_cmdb"] --token_vulnerability_management ["token_vulnerability_management"] --token_engine_container ["token_engine_container"] --token_engine_dependencies ["token_engine_dependencies"] --token_external_checks ["token_external_checks"] --xray_mode ["scan", "audit"] --image_to_scan ["image_to_scan"]
 ```
 
 ### Structure Remote Config
@@ -154,6 +156,23 @@ devsecops-engine-tools --platform_devops local --remote_config_repo DevSecOps_Re
 
 ![Demo CLI Local](docs/demo_session.svg)
 
+### Scan running sample (Docker)
+
+> Installation
+
+```bash
+docker pull bancolombia/devsecops-engine-tools
+```
+```bash
+docker run --rm -v ./folder_to_analyze:/folder_to_analyze bancolombia/devsecops-engine-tools:latest devsecops-engine-tools --platform_devops local --remote_config_repo docker_default_remote_config --tool engine_iac --folder_path /folder_to_analyze
+```
+
+The docker image have it own default remote config with basic configuration called docker_default_remote_config, but you can define your own config and pass it as volume
+
+```bash
+docker run --rm -v ./folder_to_analyze:/folder_to_analyze -v ./custom_remote_config:/custom_remote_config bancolombia/devsecops-engine-tools:latest devsecops-engine-tools --platform_devops local --remote_config_repo custom_remote_config --tool engine_iac --folder_path /folder_to_analyze
+```
+
 
 ### Scan running sample - Azure Pipelines
 

devsecops_engine_tools-1.8.2/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.8.2'