devsecops-engine-tools 1.87.0__tar.gz → 1.88.0__tar.gz

{devsecops_engine_tools-1.87.0 → devsecops_engine_tools-1.88.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.87.0
+Version: 1.88.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.87.0 → devsecops_engine_tools-1.88.0}/devsecops_engine_tools/engine_sca/engine_container/src/domain/model/gateways/tool_gateway.py

@@ -3,5 +3,5 @@ from abc import ABCMeta, abstractmethod
 
 class ToolGateway(metaclass=ABCMeta):
     @abstractmethod
-    def run_tool_container_sca(self, dict_args, secret_tool, token_engine_container, scan_image, release, base_image, exclusions, generate_sbom):
+    def run_tool_container_sca(self, dict_args, secret_tool, token_engine_container, scan_image, release, base_image, exclusions, generate_sbom, is_compressed_file=False):
         "run tool container sca"

{devsecops_engine_tools-1.87.0 → devsecops_engine_tools-1.88.0}/devsecops_engine_tools/engine_sca/engine_container/src/domain/usecases/container_sca_scan.py

@@ -38,6 +38,13 @@ class ContainerScaScan:
         self.pipeline_name = pipeline_name
         self.context = context
 
+    def _is_compressed_file(self, image_to_scan):
+        """Check if the input is a compressed file (tar, tar.gz, etc.)"""
+        return any(
+            image_to_scan.lower().endswith(ext) 
+            for ext in ['.tar', '.tar.gz', '.tgz', '.tar.bz2', '.tar.xz']
+        )
+
     def process(self):
         """
         Process SCA scanning.
@@ -47,51 +54,72 @@ class ContainerScaScan:
         """
         base_image = None
         image_scanned = None
-        matching_image = self._get_image(self.image_to_scan)
-        if self.remote_config["GET_IMAGE_BASE"]["ENABLED"]:
-            base_image = self._get_base_image(matching_image)
-        if self.remote_config["VALIDATE_BASE_IMAGE_DATE"][
-            "ENABLED"
-        ] and not self.exclusions.get(self.pipeline_name, {}).get(
-            "VALIDATE_BASE_IMAGE_DATE"
-        ):
-            self._validate_base_image_date(
-                matching_image,
-                self.remote_config["VALIDATE_BASE_IMAGE_DATE"]["REFERENCE_IMAGE_DATE"],
-            )
-        if self.remote_config["BLACK_LIST_BASE_IMAGE"][
-            "ENABLED"
-        ] and not self.exclusions.get(self.pipeline_name, {}).get(
-            "BLACK_LIST_BASE_IMAGE"
-        ):
-            self._validate_black_list_base_image(
-                base_image, self.remote_config["BLACK_LIST_BASE_IMAGE"]["BLACK_LIST"]
-            )
-
         sbom_components = None
+        
+        is_compressed_file = self._is_compressed_file(self.image_to_scan)
+        
+        if is_compressed_file:
+            if not os.path.exists(self.image_to_scan):
+                print(f"Compressed file not found: {self.image_to_scan}. Tool skipped.")
+                return image_scanned, base_image, sbom_components
+                
+            matching_image = None
+            image_name = self.image_to_scan
+            print(f"Processing compressed file: {image_name}")
+        else:
+            matching_image = self._get_image(self.image_to_scan)
+            if not matching_image:
+                print(f"'Not image found for {self.image_to_scan}'. Tool skipped.")
+                return image_scanned, base_image, sbom_components
+                
+            image_name = matching_image.tags[0]
+            
+            if self.remote_config["GET_IMAGE_BASE"]["ENABLED"]:
+                base_image = self._get_base_image(matching_image)
+            if self.remote_config["VALIDATE_BASE_IMAGE_DATE"][
+                "ENABLED"
+            ] and not self.exclusions.get(self.pipeline_name, {}).get(
+                "VALIDATE_BASE_IMAGE_DATE"
+            ):
+                self._validate_base_image_date(
+                    matching_image,
+                    self.remote_config["VALIDATE_BASE_IMAGE_DATE"]["REFERENCE_IMAGE_DATE"],
+                )
+            if self.remote_config["BLACK_LIST_BASE_IMAGE"][
+                "ENABLED"
+            ] and not self.exclusions.get(self.pipeline_name, {}).get(
+                "BLACK_LIST_BASE_IMAGE"
+            ):
+                self._validate_black_list_base_image(
+                    base_image, self.remote_config["BLACK_LIST_BASE_IMAGE"]["BLACK_LIST"]
+                )
+
         generate_sbom = self.remote_config["SBOM"]["ENABLED"] and any(
             branch in str(self.branch)
             for branch in self.remote_config["SBOM"]["BRANCH_FILTER"]
         )
-        if matching_image:
-            image_name = matching_image.tags[0]
-            result_file = image_name.replace("/", "_") + "_scan_result.json"
-            if image_name in self._get_images_already_scanned():
-                print(f"The image {image_name} has already been scanned previously.")
-                return image_scanned, base_image, sbom_components
-            image_scanned, sbom_components = self.tool_run.run_tool_container_sca(
-                self.remote_config,
-                self.secret_tool,
-                self.token_engine_container,
-                image_name,
-                result_file,
-                base_image,
-                self.exclusions,
-                generate_sbom,
-            )
+
+        result_file = image_name.replace("/", "_").replace(".", "_") + "_scan_result.json"
+        
+        if not is_compressed_file and image_name in self._get_images_already_scanned():
+            print(f"The image {image_name} has already been scanned previously.")
+            return image_scanned, base_image, sbom_components
+            
+        image_scanned, sbom_components = self.tool_run.run_tool_container_sca(
+            self.remote_config,
+            self.secret_tool,
+            self.token_engine_container,
+            image_name,
+            result_file,
+            base_image,
+            self.exclusions,
+            generate_sbom,
+            is_compressed_file,
+        )
+        
+        if not is_compressed_file:
             self._set_image_scanned(image_name)
-        else:
-            print(f"'Not image found for {self.image_to_scan}'. Tool skipped.")
+            
         return image_scanned, base_image, sbom_components
 
     def deseralizator(self, image_scanned):

{devsecops_engine_tools-1.87.0 → devsecops_engine_tools-1.88.0}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/prisma_cloud/prisma_cloud_manager_scan.py

@@ -171,8 +171,12 @@ class PrismaCloudManagerScan(ToolGateway):
             raise ValueError("The string is not properly formatted. Make sure it contains a ':'.")
         
     def run_tool_container_sca(
-        self, remoteconfig, secret_tool, token_engine_container, image_name, result_file, base_image, exclusions, generate_sbom
+        self, remoteconfig, secret_tool, token_engine_container, image_name, result_file, base_image, exclusions, generate_sbom, is_compressed_file=False
     ):
+        if is_compressed_file:
+            logger.warning("Prisma Cloud does not support compressed file scanning. Skipping.")
+            return "", None
+            
         prisma_key = (
             f"{secret_tool['access_prisma']}:{secret_tool['token_prisma']}" if secret_tool else token_engine_container
         )

{devsecops_engine_tools-1.87.0 → devsecops_engine_tools-1.88.0}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/trivy_tool/trivy_manager_scan.py

@@ -62,7 +62,7 @@ class TrivyScan(ToolGateway):
             except Exception as e:
                 logger.error(f"Error installing trivy: {e}")
 
-    def scan_image(self, prefix, image_name, result_file, base_image):
+    def scan_image(self, prefix, image_name, result_file, base_image, is_compressed_file=False):
         command = [
             prefix,
             "--scanners",
@@ -72,7 +72,12 @@ class TrivyScan(ToolGateway):
             "-o",
             result_file,
         ]
-        command.extend(["--quiet", "image", image_name])
+        
+        if is_compressed_file:
+            command.extend(["--quiet", "image", "--input", image_name])
+        else:
+            command.extend(["--quiet", "image", image_name])
+            
         try:
             subprocess.run(
                 command,
@@ -88,7 +93,7 @@ class TrivyScan(ToolGateway):
         except Exception as e:
             logger.error(f"Error during image scan of {image_name}: {e}")
 
-    def _generate_sbom(self, prefix, image_name, remoteconfig):
+    def _generate_sbom(self, prefix, image_name, remoteconfig, is_compressed_file=False):
         result_sbom = f"{image_name.replace('/', '_')}_SBOM.json"
         command = [
             prefix,
@@ -98,7 +103,10 @@ class TrivyScan(ToolGateway):
             "--output",
             result_sbom
         ]
-        command.extend(["--quiet", image_name])
+        if is_compressed_file:
+            command.extend(["--quiet", "--input", image_name])
+        else:
+            command.extend(["--quiet", image_name])
         try:
             subprocess.run(
                 command,
@@ -114,7 +122,7 @@ class TrivyScan(ToolGateway):
         except Exception as e:
             logger.error(f"Error generating SBOM: {e}")
 
-    def run_tool_container_sca(self, remoteconfig, secret_tool, token_engine_container, image_name, result_file, base_image, exclusions, generate_sbom):
+    def run_tool_container_sca(self, remoteconfig, secret_tool, token_engine_container, image_name, result_file, base_image, exclusions, generate_sbom, is_compressed_file=False):
         trivy_version = remoteconfig["TRIVY"]["TRIVY_VERSION"]
         os_platform = platform.system()
         arch_platform = platform.architecture()[0]
@@ -136,9 +144,9 @@ class TrivyScan(ToolGateway):
             return None
 
         image_scanned = (
-            self.scan_image(command_prefix, image_name, result_file, base_image)
+            self.scan_image(command_prefix, image_name, result_file, base_image, is_compressed_file)
         )
         if generate_sbom:
-            sbom_components = self._generate_sbom(command_prefix, image_name, remoteconfig)
+            sbom_components = self._generate_sbom(command_prefix, image_name, remoteconfig, is_compressed_file)
 
         return image_scanned, sbom_components

devsecops_engine_tools-1.88.0/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.88.0'

{devsecops_engine_tools-1.87.0 → devsecops_engine_tools-1.88.0}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.87.0
+Version: 1.88.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

devsecops_engine_tools-1.87.0/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.87.0'