devsecops-engine-tools 1.83.0__tar.gz → 1.85.0__tar.gz

{devsecops_engine_tools-1.83.0 → devsecops_engine_tools-1.85.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.83.0
+Version: 1.85.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.83.0 → devsecops_engine_tools-1.85.0}/devsecops_engine_tools/engine_sca/engine_container/src/domain/model/gateways/images_gateway.py

@@ -7,11 +7,11 @@ class ImagesGateway(metaclass=ABCMeta):
         "get image to scan"
 
     @abstractmethod
-    def get_base_image(self, image_to_scan) -> str:
+    def get_base_image(self, image_to_scan, base_image_labels: list, label_keys: dict = None) -> str:
         "get base image"
 
     @abstractmethod
-    def validate_base_image_date(self, image_to_scan, referenced_date) -> str:
+    def validate_base_image_date(self, image_to_scan, referenced_date, base_image_labels: list, label_keys: dict = None) -> str:
         "validate base image date"
     
     @abstractmethod

{devsecops_engine_tools-1.83.0 → devsecops_engine_tools-1.85.0}/devsecops_engine_tools/engine_sca/engine_container/src/domain/usecases/container_sca_scan.py

@@ -48,7 +48,7 @@ class ContainerScaScan:
         base_image = None
         image_scanned = None
         matching_image = self._get_image(self.image_to_scan)
-        if self.remote_config["GET_IMAGE_BASE"]:
+        if self.remote_config["GET_IMAGE_BASE"]["ENABLED"]:
             base_image = self._get_base_image(matching_image)
         if self.remote_config["VALIDATE_BASE_IMAGE_DATE"][
             "ENABLED"
@@ -123,7 +123,7 @@ class ContainerScaScan:
         Returns:
             String: base image.
         """
-        return self.tool_images.get_base_image(matching_image)
+        return self.tool_images.get_base_image(matching_image, self.remote_config["GET_IMAGE_BASE"]["BASE_IMAGE_LABELS"]), self.remote_config["GET_IMAGE_BASE"].get("LABEL_KEYS", None)
 
     def _validate_base_image_date(self, matching_image, referenced_date):
         """
@@ -133,7 +133,10 @@ class ContainerScaScan:
             string: base image date.
         """
         return self.tool_images.validate_base_image_date(
-            matching_image, referenced_date
+            matching_image, 
+            referenced_date, 
+            self.remote_config["GET_IMAGE_BASE"]["BASE_IMAGE_LABELS"],
+            self.remote_config["GET_IMAGE_BASE"].get("LABEL_KEYS")
         )
 
     def _validate_black_list_base_image(self, base_image, black_list):
@@ -143,7 +146,9 @@ class ContainerScaScan:
         Returns:
             string: blacklist.
         """
-        return self.tool_images.validate_black_list_base_image(base_image, black_list)
+        if not base_image or not base_image[0]:
+            return True
+        return self.tool_images.validate_black_list_base_image(base_image[0][0], black_list)
 
     def _get_images_already_scanned(self):
         """

{devsecops_engine_tools-1.83.0 → devsecops_engine_tools-1.85.0}/devsecops_engine_tools/engine_sca/engine_container/src/domain/usecases/set_input_core.py

@@ -14,17 +14,19 @@ class SetInputCore:
 
     def get_exclusions(self, exclusions_data, pipeline_name, tool, base_image):
         list_exclusions = []
-        print("The base image used is:", base_image)
+        base_image_list = base_image[0][0] if base_image else None
+        print("The base image used is:", base_image_list)
         for key, value in exclusions_data.items():
             if key not in {"All", pipeline_name} or not value.get(tool):
                 continue
 
             for item in value[tool]:
                 if key == "All":
-                    source_images = item.get("x86.image.name", [])
-                    if source_images and base_image is None:
+                    key_image_exception = self.remote_config.get("GET_IMAGE_BASE", {}).get("LABEL_KEYS", {}).get("key_image_exception", None)
+                    source_images = item.get(key_image_exception, [])
+                    if source_images and not base_image_list:
                         continue
-                    if source_images and not any(base_image in source for source in source_images):
+                    if source_images and not any(img in source for img in base_image_list for source in source_images):
                         continue
                     
                 list_exclusions.append(

{devsecops_engine_tools-1.83.0 → devsecops_engine_tools-1.85.0}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/docker/docker_images.py

@@ -33,19 +33,19 @@ class DockerImages(ImagesGateway):
                 f"Error listing images, docker must be running and added to PATH: {e}"
             )
 
-    def get_base_image(self, matching_image):
+    def get_base_image(self, matching_image, base_image_labels: list, label_keys: dict = None):
         try:
             image_details = self.get_image_details(matching_image.id)
             if not image_details:
                 return None
 
             labels = image_details.get("Config", {}).get("Labels", {})
-            return self.extract_base_image_from_labels(labels, matching_image)[0]
+            return self.extract_base_image_from_labels(labels, base_image_labels, matching_image, label_keys)
         except Exception as e:
             logger.warning(f"Error obtaining base image: {e}")
-            return None
+            return None, False
 
-    def validate_base_image_date(self, matching_image, referenced_date):
+    def validate_base_image_date(self, matching_image, referenced_date, base_image_labels: list, label_keys: dict = None):
         if matching_image is None or matching_image.id is None:
             logger.error("Error: matching_image ID is None")
             return False
@@ -54,13 +54,17 @@ class DockerImages(ImagesGateway):
             return False
 
         labels = image_details.get("Config", {}).get("Labels", {})
-        baseline_date = labels.get("x86.baseline.date")
+
+        baseline_date = None
+        if label_keys and "baseline_date" in label_keys:
+            baseline_date_key = label_keys["baseline_date"]
+            baseline_date = labels.get(baseline_date_key)
         date_image = None
         if baseline_date:
             date_image = self.parse_date(baseline_date)
         else:
-            base_image = self.extract_base_image_from_labels(labels)
-            if not base_image[1]:
+            base_image, is_uso_especifico = self.extract_base_image_from_labels(labels, base_image_labels, None, label_keys)
+            if not is_uso_especifico and base_image:
                 date_image = self.extract_date_from_image(base_image[0])
 
         return self.validate_date(date_image, referenced_date)
@@ -73,13 +77,20 @@ class DockerImages(ImagesGateway):
             logger.error(f"Error obtaining image details for '{image_id}': {e}")
             return None
 
-    def extract_base_image_from_labels(self, labels, matching_image=None):
+    def extract_base_image_from_labels(self, labels, base_image_labels: list, matching_image=None, label_keys: dict = None):
         try:
             if labels:
-                source_image = labels.get("x86.image.name") or labels.get("image.base.ref.name")
-                if not source_image:
-                    source_image = labels.get("source_images") or labels.get("source-image")
-                is_uso_especifico = labels.get("repository") == 'evc/uso_especifico'
+                source_image = []
+                for label in base_image_labels:
+                    value = labels.get(label)
+                    if value:
+                        source_image.append(value)
+                
+                # Only check for specific_use if it's configured in remote config
+                is_uso_especifico = False
+                if label_keys and "specific_use" in label_keys:
+                    specific_use_value = label_keys["specific_use"]
+                    is_uso_especifico = labels.get("repository") == specific_use_value
                 if source_image and matching_image:
                     logger.info(f"Base image for '{matching_image}' found: {source_image}")
                 elif matching_image:
@@ -126,12 +137,18 @@ class DockerImages(ImagesGateway):
         return True
 
     def validate_black_list_base_image(self, base_image, black_list):
-        if not isinstance(base_image, str) or not isinstance(black_list, list):
-            logger.error("Invalid input types: expected a string and a list of strings.")
+        if not isinstance(base_image, list) or not isinstance(black_list, list):
+            logger.error("Invalid input types: expected a list of images and a list of strings.")
             return False
-        for black in black_list:
-            if black in base_image:
-                raise ValueError(
-                f"Compliance issue: the image: {base_image} is blacklisted for {black}"
-            )
+        
+        for image in base_image:
+            if not isinstance(image, str):
+                logger.warning(f"Skipping non-string image: {image}")
+                continue
+                
+            for black in black_list:
+                if black in image:
+                    raise ValueError(
+                        f"Compliance issue: the image: {image} is blacklisted for {black}"
+                    )
         return True

{devsecops_engine_tools-1.83.0 → devsecops_engine_tools-1.85.0}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/prisma_cloud/prisma_cloud_manager_scan.py

@@ -97,21 +97,26 @@ class PrismaCloudManagerScan(ToolGateway):
         except subprocess.CalledProcessError as e:
             logger.error(f"Error during image scan of {image_name}: {e.stderr}")
 
-    def _write_image_base(self, result_file, base_image, exclusions_data):
+    def _write_image_base(self, result_file, base_image, exclusions_data, remoteconfig):
         try:
             with open(result_file, "r") as file:
                 data = json.load(file)
 
             prisma_exclusions = exclusions_data.get("All", {}).get("PRISMA", [])
             modified = False
+            base_image_list = base_image[0][0] if base_image and base_image[0][0] else []
+            
+            
+            key_image_exception = remoteconfig.get("GET_IMAGE_BASE", {}).get("LABEL_KEYS", {}).get("key_image_exception", None)
+            
             for result in data.get("results", []):
                 for vulnerability in result.get("vulnerabilities", []):
                     for exclusion in prisma_exclusions:
                         if (
                             vulnerability.get("id") == exclusion.get("id") and
-                            any(image.startswith(base_image) for image in exclusion.get("x86.image.name", []))
+                            any(b_image.startswith(ex_image) for b_image in base_image_list for ex_image in exclusion.get(key_image_exception, []))
                         ):
-                            vulnerability["baseImage"] = base_image
+                            vulnerability["baseImage"] = str(base_image_list) if base_image_list else ""
                             modified = True
 
             if modified:
@@ -191,7 +196,7 @@ class PrismaCloudManagerScan(ToolGateway):
             prisma_key
         )
         if base_image:
-            self._write_image_base(result_file, base_image, exclusions)
+            self._write_image_base(result_file, base_image, exclusions, remoteconfig)
         if generate_sbom:
             sbom_components = self._generate_sbom(
                 image_scanned,

devsecops_engine_tools-1.85.0/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.85.0'

{devsecops_engine_tools-1.83.0 → devsecops_engine_tools-1.85.0}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.83.0
+Version: 1.85.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

devsecops_engine_tools-1.83.0/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.83.0'