devsecops-engine-tools 1.92.0__tar.gz → 1.93.0__tar.gz

{devsecops_engine_tools-1.92.0 → devsecops_engine_tools-1.93.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.92.0
+Version: 1.93.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.92.0 → devsecops_engine_tools-1.93.0}/devsecops_engine_tools/engine_core/src/applications/runner_engine_core.py

@@ -22,7 +22,13 @@ from devsecops_engine_tools.engine_core.src.infrastructure.driven_adapters.aws.s
 from devsecops_engine_tools.engine_core.src.infrastructure.driven_adapters.printer_pretty_table.printer_pretty_table import (
     PrinterPrettyTable,
 )
-from devsecops_engine_tools.engine_core.src.infrastructure.driven_adapters.syft.syft import Syft
+from devsecops_engine_tools.engine_core.src.infrastructure.driven_adapters.syft.syft import (
+    Syft
+)
+from devsecops_engine_tools.engine_core.src.infrastructure.driven_adapters.cdxgen.cdxgen import (
+    CdxGen
+)
+
 import sys
 import argparse
 from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
@@ -285,7 +291,10 @@ def application_core():
         }.get(args["remote_config_source"])
         metrics_manager_gateway = S3Manager()
         printer_table_gateway = PrinterPrettyTable()
-        sbom_tool_gateway = Syft()
+        sbom_tool_gateway = {
+            "syft": Syft(),
+            "cdxgen": CdxGen()
+        }
 
         init_engine_core(
             vulnerability_management_gateway,

devsecops_engine_tools-1.93.0/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/cdxgen/cdxgen.py

@@ -0,0 +1,123 @@
+from dataclasses import dataclass
+import requests
+import subprocess
+import platform
+
+from devsecops_engine_tools.engine_core.src.domain.model.gateway.sbom_manager import (
+    SbomManagerGateway,
+)
+from devsecops_engine_tools.engine_utilities.sbom.deserealizator import (
+    get_list_component,
+)
+from devsecops_engine_tools.engine_core.src.domain.model.component import (
+    Component,
+)
+
+from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
+from devsecops_engine_tools.engine_utilities import settings
+
+logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
+
+
+@dataclass
+class CdxGen(SbomManagerGateway):
+
+    def get_components(self, artifact, config, service_name) -> "list[Component]":
+        try:
+            cdxgen_version = config["CDXGEN"]["CDXGEN_VERSION"]
+            slim = "-slim" if config["CDXGEN"]["SLIM_BINARY"] else ""
+            os_platform = platform.system()
+            base_url = (
+                f"https://github.com/CycloneDX/cdxgen/releases/download/v{cdxgen_version}/"
+            )
+
+            command_prefix = "cdxgen"
+            if os_platform == "Linux":
+                file = f"cdxgen-linux-amd64{slim}"
+                command_prefix = self._install_tool_unix(
+                    file, base_url + file, command_prefix
+                )
+            elif os_platform == "Darwin":
+                file = f"cdxgen-darwin-amd64{slim}"
+                command_prefix = self._install_tool_unix(
+                    file, base_url + file, command_prefix
+                )
+            elif os_platform == "Windows":
+                file = f"cdxgen-windows-amd64{slim}.exe"
+                command_prefix = self._install_tool_windows(
+                    file, base_url + file, "cdxgen.exe"
+                )
+            else:
+                logger.warning(f"{os_platform} is not supported.")
+                return None
+
+            result_sbom = self._run_cdxgen(command_prefix, artifact, service_name)
+            return get_list_component(result_sbom, config["CDXGEN"]["OUTPUT_FORMAT"])
+        except Exception as e:
+            logger.error(f"Error generating SBOM: {e}")
+            return None
+
+    def _run_cdxgen(self, command_prefix, artifact, service_name):
+        result_file = f"{service_name}_SBOM.json"
+        command = [
+            command_prefix,
+            artifact,
+            "-o",
+            result_file,
+        ]
+
+        try:
+            subprocess.run(
+                command,
+                check=True,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                text=True,
+            )
+            print(f"SBOM generated and saved to: {result_file}")
+            return result_file
+        except Exception as e:
+            logger.error(f"Error running cdxgen: {e}")
+
+    def _install_tool_unix(self, file, url, command_prefix):
+        installed = subprocess.run(
+            ["which", command_prefix],
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+        )
+        if installed.returncode == 1:
+            try:
+                self._download_tool(file, url)
+                subprocess.run(
+                    ["chmod", "+x", f"./{file}"],
+                    stdout=subprocess.PIPE,
+                    stderr=subprocess.PIPE,
+                )
+                return f"./{file}"
+            except Exception as e:
+                logger.error(f"Error installing cdxgen: {e}")
+        else:
+            return installed.stdout.decode("utf-8").strip()
+
+    def _install_tool_windows(self, file, url, command_prefix):
+        try:
+            installed = subprocess.run(
+                [command_prefix, "--version"],
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+            )
+            return installed.stdout.decode("utf-8").strip()
+        except:
+            try:
+                self._download_tool(file, url)
+                return f"{file}"
+            except Exception as e:
+                logger.error(f"Error installing cdxgen: {e}")
+
+    def _download_tool(self, file, url):
+        try:
+            response = requests.get(url, allow_redirects=True)
+            with open(file, "wb") as compress_file:
+                compress_file.write(response.content)
+        except Exception as e:
+            logger.error(f"Error downloading cdxgen: {e}")

{devsecops_engine_tools-1.92.0 → devsecops_engine_tools-1.93.0}/devsecops_engine_tools/engine_core/src/infrastructure/entry_points/entry_point_core.py

@@ -14,7 +14,6 @@ from devsecops_engine_tools.engine_utilities.utils.printers import (
     Printers,
 )
 
-
 def init_engine_core(
     vulnerability_management_gateway: any,
     secrets_manager_gateway: any,
@@ -29,6 +28,7 @@ def init_engine_core(
         args["remote_config_repo"], "/engine_core/ConfigTool.json", args["remote_config_branch"]
     )
     Printers.print_logo_tool(config_tool["BANNER"])
+    sbom_tool_gateway = sbom_tool_gateway.get(config_tool["SBOM_MANAGER"]["TOOL"].lower())
 
     if config_tool[args["module"].upper()]["ENABLED"]:
         if args["module"] == "engine_risk":

devsecops_engine_tools-1.93.0/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.93.0'

{devsecops_engine_tools-1.92.0 → devsecops_engine_tools-1.93.0}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.92.0
+Version: 1.93.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.92.0 → devsecops_engine_tools-1.93.0}/devsecops_engine_tools.egg-info/SOURCES.txt

@@ -45,6 +45,8 @@ devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/aws/s3_man
 devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/aws/secrets_manager.py
 devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/azure/__init__.py
 devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/azure/azure_devops.py
+devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/cdxgen/__init__.py
+devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/cdxgen/cdxgen.py
 devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/defect_dojo/__init__.py
 devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/defect_dojo/defect_dojo.py
 devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/github/__init__.py

devsecops_engine_tools-1.92.0/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.92.0'