devsecops-engine-tools 1.98.0__tar.gz → 1.99.0__tar.gz

{devsecops_engine_tools-1.98.0 → devsecops_engine_tools-1.99.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: devsecops-engine-tools
-Version: 1.98.0
+Version: 1.99.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.98.0 → devsecops_engine_tools-1.99.0}/devsecops_engine_tools/engine_core/src/domain/usecases/handle_risk.py

@@ -88,7 +88,9 @@ class HandleRisk:
 
     def _exclude_services(self, dict_args, pipeline_name, service_list):
         risk_exclusions = self.remote_config_source_gateway.get_remote_config(
-            dict_args["remote_config_repo"], "engine_risk/Exclusions.json", dict_args["remote_config_branch"]
+            dict_args["remote_config_repo"],
+            "engine_risk/Exclusions.json",
+            dict_args["remote_config_branch"],
         )
         if (
             pipeline_name in risk_exclusions
@@ -131,10 +133,14 @@ class HandleRisk:
 
     def process(self, dict_args: any, remote_config: any):
         risk_config = self.remote_config_source_gateway.get_remote_config(
-            dict_args["remote_config_repo"], "engine_risk/ConfigTool.json", dict_args["remote_config_branch"]
+            dict_args["remote_config_repo"],
+            "engine_risk/ConfigTool.json",
+            dict_args["remote_config_branch"],
         )
         risk_exclusions = self.remote_config_source_gateway.get_remote_config(
-            dict_args["remote_config_repo"], "engine_risk/Exclusions.json", dict_args["remote_config_branch"]
+            dict_args["remote_config_repo"],
+            "engine_risk/Exclusions.json",
+            dict_args["remote_config_branch"],
         )
         pipeline_name = self.devops_platform_gateway.get_variable("pipeline_name")
         definition_name = self.devops_platform_gateway.get_variable("definition_name")
@@ -205,7 +211,9 @@ class HandleRisk:
                         service_list += [engagement]
                         break
 
-        if definition_name and definition_name.lower() != pipeline_name.lower():
+        if definition_name and definition_name.lower() not in [
+            service.name.lower() for service in service_list
+        ]:
             build_engagements = self.vulnerability_management.get_active_engagements(
                 definition_name, dict_args, secret_tool, remote_config
             )

{devsecops_engine_tools-1.98.0 → devsecops_engine_tools-1.99.0}/devsecops_engine_tools/engine_integrations/src/applications/runner_engine_integrations.py

@@ -29,11 +29,33 @@ from devsecops_engine_tools.engine_utilities import settings
 
 logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 
+def validate_integration_requirements(args):
+    integration = args.get("integration")
+    missing_args = []
+    
+    if integration == "report_sonar":
+        if not args.get("sonar_url"):
+            missing_args.append("--sonar_url")
+            
+    elif integration == "copacetic":
+        if not args.get("image"):
+            missing_args.append("--image")
+            
+        if not args.get("vulnerability_report") and not args.get("platform"):
+            missing_args.append("--vulnerability_report or --platform")
+            
+    if missing_args:
+        error_msg = f"Missing required arguments for {integration} integration: {', '.join(missing_args)}"
+        return False, error_msg
+        
+    return True, None
+
 def get_inputs_from_cli(args):
     parser = argparse.ArgumentParser()
+    # General flags
     parser.add_argument(
         "--integration",
-        choices=["report_sonar"],
+        choices=["report_sonar", "copacetic"],
         type=str,
         required=True,
         help="Name of the integration to run",
@@ -109,6 +131,35 @@ def get_inputs_from_cli(args):
         required=False,
         help="Token to access sonar server",
     )
+    # copacetic flags
+    parser.add_argument(
+        "--image",
+        required=False,
+        help="Container image to patch with Copacetic",
+    )
+    parser.add_argument(
+        "--vulnerability_report",
+        required=False,
+        help="Path to vulnerability report file for Copacetic",
+    )
+    parser.add_argument(
+        "--patch_format",
+        choices=["trivy", "grype"],
+        type=str,
+        required=False,
+        default="trivy",
+        help="Vulnerability report format for Copacetic (default: trivy)",
+    )
+    parser.add_argument(
+        "--output_image",
+        required=False,
+        help="Output tag name for patched image",
+    )
+    parser.add_argument(
+        "--platform",
+        required=False,
+        help="Target(s) platform(s) for multi-arch images when no report directory is provided",
+    )
 
     args = parser.parse_args()
     return {
@@ -124,6 +175,11 @@ def get_inputs_from_cli(args):
         "token_cmdb": args.token_cmdb,
         "token_vulnerability_management": args.token_vulnerability_management,
         "token_sonar": args.token_sonar,
+        "image": args.image,
+        "vulnerability_report": args.vulnerability_report,
+        "patch_format": args.patch_format,
+        "output_image": args.output_image,
+        "platform": args.platform
     }
 
 def runner_engine_integrations():
@@ -132,6 +188,11 @@ def runner_engine_integrations():
         if not args["remote_config_source"]: 
             args["remote_config_source"] = args["platform_devops"]
 
+        is_valid, error_message = validate_integration_requirements(args)
+        if not is_valid:
+            logger.error(f"Error: {error_message}")
+            sys.exit(1)
+
         vulnerability_management_gateway = DefectDojoPlatform()
         secrets_manager_gateway = SecretsManager()
         devops_platform_gateway = {

{devsecops_engine_tools-1.98.0 → devsecops_engine_tools-1.99.0}/devsecops_engine_tools/engine_integrations/src/domain/usecases/handle_integrations.py

@@ -13,6 +13,9 @@ from devsecops_engine_tools.engine_core.src.domain.model.gateway.metrics_manager
 from devsecops_engine_tools.engine_utilities.sonarqube.src.applications.runner_report_sonar import (
     runner_report_sonar
 )
+from devsecops_engine_tools.engine_utilities.copacetic.src.applications.runner_copacetic import (
+    runner_copacetic
+)
 
 class Integrations():
     def __init__(
@@ -40,3 +43,12 @@ class Integrations():
                 metrics_manager_gateway=self.metrics_manager_gateway,
                 args=args,
             )
+        elif integration == "copacetic":
+            return runner_copacetic(
+                vulnerability_management_gateway=self.vulnerability_management_gateway,
+                secrets_manager_gateway=self.secrets_manager_gateway,
+                devops_platform_gateway=self.devops_platform_gateway,
+                remote_config_source_gateway=self.remote_config_source_gateway,
+                metrics_manager_gateway=self.metrics_manager_gateway,
+                args=args,
+            )

{devsecops_engine_tools-1.98.0 → devsecops_engine_tools-1.99.0}/devsecops_engine_tools/engine_sca/engine_container/src/infrastructure/driven_adapters/trivy_tool/trivy_manager_scan.py

@@ -16,7 +16,7 @@ logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 
 class TrivyScan(ToolGateway):
 
-    def scan_image(self, prefix, image_name, result_file, base_image, is_compressed_file=False):
+    def scan_image(self, prefix, image_name, result_file, base_image, vuln_type, ignore_unfixed=False, is_compressed_file=False):
         command = [
             prefix,
             "--scanners",
@@ -25,7 +25,12 @@ class TrivyScan(ToolGateway):
             "json",
             "-o",
             result_file,
+            "--pkg-types",
+            vuln_type
         ]
+
+        if ignore_unfixed:
+            command.append("--ignore-unfixed")
         
         if is_compressed_file:
             command.extend(["--quiet", "image", "--input", image_name])
@@ -47,7 +52,7 @@ class TrivyScan(ToolGateway):
         except Exception as e:
             logger.error(f"Error during image scan of {image_name}: {e}")
 
-    def _generate_sbom(self, prefix, image_name, remoteconfig, is_compressed_file=False):
+    def _generate_sbom(self, prefix, image_name, remoteconfig, vuln_type, ignore_unfixed=False, is_compressed_file=False):
         result_sbom = f"{image_name.replace('/', '_')}_SBOM.json"
         command = [
             prefix,
@@ -55,8 +60,12 @@ class TrivyScan(ToolGateway):
             "--format",
             remoteconfig["TRIVY"]["SBOM_FORMAT"],
             "--output",
-            result_sbom
+            result_sbom,
+            "--pkg-types",
+            vuln_type
         ]
+        if ignore_unfixed:
+            command.append("--ignore-unfixed")
         if is_compressed_file:
             command.extend(["--quiet", "--input", image_name])
         else:
@@ -77,7 +86,10 @@ class TrivyScan(ToolGateway):
             logger.error(f"Error generating SBOM: {e}")
 
     def run_tool_container_sca(self, remoteconfig, secret_tool, token_engine_container, image_name, result_file, base_image, exclusions, generate_sbom, is_compressed_file=False):
-        trivy_version = remoteconfig["TRIVY"]["TRIVY_VERSION"]        
+        trivy_version = remoteconfig["TRIVY"]["TRIVY_VERSION"]
+        vuln_type = remoteconfig["TRIVY"].get("VULN_TYPE", "all").lower()
+        vuln_type = vuln_type if vuln_type in ["os", "library"] else "os,library"
+        ignore_unfixed = remoteconfig["TRIVY"].get("IGNORE_UNFIXED", False)      
         command_prefix = TrivyManagerScanUtils().identify_os_and_install(trivy_version)
         sbom_components = None
         
@@ -85,9 +97,9 @@ class TrivyScan(ToolGateway):
             return None
 
         image_scanned = (
-            self.scan_image(command_prefix, image_name, result_file, base_image, is_compressed_file)
+            self.scan_image(command_prefix, image_name, result_file, base_image, vuln_type, ignore_unfixed, is_compressed_file)
         )
         if generate_sbom:
-            sbom_components = self._generate_sbom(command_prefix, image_name, remoteconfig, is_compressed_file)
+            sbom_components = self._generate_sbom(command_prefix, image_name, remoteconfig, vuln_type, ignore_unfixed, is_compressed_file)
 
         return image_scanned, sbom_components

devsecops_engine_tools-1.99.0/devsecops_engine_tools/engine_utilities/copacetic/src/applications/runner_copacetic.py

@@ -0,0 +1,40 @@
+from devsecops_engine_tools.engine_utilities.copacetic.src.infrastructure.driven_adapters.copacetic.copacetic_adapter import(
+    CopaceticAdapter
+)
+from devsecops_engine_tools.engine_utilities.copacetic.src.infrastructure.entry_points.entry_point_copacetic import (
+    init_copacetic
+)
+from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
+from devsecops_engine_tools.engine_utilities import settings
+
+logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
+
+def runner_copacetic(
+    vulnerability_management_gateway,
+    secrets_manager_gateway,
+    devops_platform_gateway,
+    remote_config_source_gateway,
+    metrics_manager_gateway,
+    args
+):
+    try:
+        copacetic_gateway = CopaceticAdapter()
+
+        init_copacetic(
+            vulnerability_management_gateway=vulnerability_management_gateway,
+            secrets_manager_gateway=secrets_manager_gateway,
+            devops_platform_gateway=devops_platform_gateway,
+            remote_config_source_gateway=remote_config_source_gateway,
+            copacetic_gateway=copacetic_gateway,
+            metrics_manager_gateway=metrics_manager_gateway,
+            args=args,
+        )
+
+    except Exception as e:
+        logger.error("Error copacetic: {0} ".format(str(e)))
+        print(
+            devops_platform_gateway.message(
+                "error", "Error copacetic: {0} ".format(str(e))
+            )
+        )
+        print(devops_platform_gateway.result_pipeline("failed"))

devsecops_engine_tools-1.99.0/devsecops_engine_tools/engine_utilities/copacetic/src/domain/usecases/copacetic.py

@@ -0,0 +1,190 @@
+from devsecops_engine_tools.engine_core.src.domain.model.gateway.vulnerability_management_gateway import (
+    VulnerabilityManagementGateway
+)
+from devsecops_engine_tools.engine_core.src.domain.model.gateway.secrets_manager_gateway import (
+    SecretsManagerGateway
+)
+from devsecops_engine_tools.engine_core.src.domain.model.gateway.devops_platform_gateway import (
+    DevopsPlatformGateway
+)
+from devsecops_engine_tools.engine_core.src.domain.model.input_core import InputCore
+from devsecops_engine_tools.engine_utilities.utils.logger_info import MyLogger
+from devsecops_engine_tools.engine_utilities import settings
+import shutil
+
+logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
+
+
+class Copacetic:
+    def __init__(
+        self,
+        vulnerability_management_gateway: VulnerabilityManagementGateway,
+        secrets_manager_gateway: SecretsManagerGateway,
+        devops_platform_gateway: DevopsPlatformGateway,
+        remote_config_source_gateway: DevopsPlatformGateway,
+        copacetic_gateway,
+    ):
+        self.vulnerability_management_gateway = vulnerability_management_gateway
+        self.secrets_manager_gateway = secrets_manager_gateway
+        self.devops_platform_gateway = devops_platform_gateway
+        self.remote_config_source_gateway = remote_config_source_gateway
+        self.copacetic_gateway = copacetic_gateway
+
+    def process(self, args):
+        try:
+            copacetic_config = self.remote_config_source_gateway.get_remote_config(
+                args["remote_config_repo"], "/engine_integrations/copacetic/ConfigTool.json", args["remote_config_branch"]
+            )
+
+            image = args.get("image")
+            vulnerability_report = args.get("vulnerability_report")
+            patch_format = args.get("patch_format", "trivy")
+            
+            if not image:
+                raise ValueError("Image is required for Copacetic patching")
+
+            logger.info(f"Starting Copacetic patching for image: {image}")
+
+            image_info = {}
+            if hasattr(self.copacetic_gateway, 'get_image_info'):
+                image_info = self.copacetic_gateway.get_image_info(image)
+                if not image_info.get("exists", False):
+                    logger.info(f"Image {image} may not exist locally. Copacetic will attempt to pull it.")
+
+            patch_result = self.copacetic_gateway.patch_image(
+                image=image,
+                vulnerability_report=vulnerability_report,
+                output_image=args.get("output_image"),
+                patch_format=patch_format,
+                config=copacetic_config,
+                work_folder=self.devops_platform_gateway.get_variable("path_directory"),
+                platform=args.get("platform")
+            )
+
+            if patch_result["success"]:
+                logger.info("Copacetic patching completed successfully")
+
+                if image_info.get("exists", False):
+                    patch_result["original_image_info"] = {
+                        "architecture": image_info.get("architecture"),
+                        "os": image_info.get("os"),
+                        "size": image_info.get("size"),
+                        "layers": image_info.get("layers")
+                    }
+
+                self._print_results_table(patch_result)
+            else:
+                detailed_error = f"Copacetic patching failed for {image}: {patch_result.get('error', 'Unknown error')}"
+                if patch_result.get("copa_error"):
+                    detailed_error += f"\nCopa stderr: {patch_result['copa_error']}"
+                
+                print(
+                    self.devops_platform_gateway.message("error", detailed_error)
+                )
+
+            return InputCore(
+                totalized_exclusions=[],
+                threshold_defined=None,
+                path_file_results=patch_result.get("output_file", ""),
+                custom_message_break_build=f"Copacetic patching completed for {image}",
+                scope_pipeline="",
+                scope_service="",
+                stage_pipeline=self.devops_platform_gateway.get_variable("stage")
+            )
+
+        except Exception as e:
+            logger.error(f"Error in Copacetic process: {str(e)}")
+            print(
+                self.devops_platform_gateway.message(
+                    "error",
+                    f"Error in Copacetic process: {str(e)}"
+                )
+            )
+
+    def _print_results_table(self, summary):
+        try:
+            terminal_width = min(shutil.get_terminal_size().columns, 100)
+        except:
+            terminal_width = 100
+        
+        logger.info(f"\n{'='*terminal_width}")
+        title = " COPACETIC PATCHING RESULTS "
+        padding = (terminal_width - len(title)) // 2
+        logger.info(f"{' '*padding}{title}{' '*padding}")
+        logger.info(f"{'='*terminal_width}")
+        
+        logger.info("\n IMAGE INFORMATION:")
+        logger.info(f"   Original Image: {summary['original_image']}")
+        logger.info(f"   Patched Image:  {summary['patched_image']}")
+
+        logger.info("\n PATCHING STATISTICS:")
+        vuln_count = summary.get('vulnerabilities_patched', 0)
+        pkg_count = summary.get('packages_updated', 0)
+        vex_generated = summary.get('vex_file_generated', False)
+        
+        logger.info(f"   Vulnerabilities Patched: {vuln_count}")
+        logger.info(f"   Packages Updated:        {pkg_count}")
+        logger.info(f"   VEX Report Generated:    {'Yes' if vex_generated else 'No'}")
+        
+        if not vex_generated:
+            logger.info("   Note: VEX report not generated (no vulnerability report provided)")
+
+        platforms = summary.get('platforms_processed', [])
+        if platforms:
+            logger.info(f"   Platforms Processed:     {', '.join(platforms)}")
+        
+        if summary.get('original_image_info'):
+            info = summary['original_image_info']
+            logger.info("\n  IMAGE DETAILS:")
+            logger.info(f"   Architecture: {info.get('architecture', 'N/A')}")
+            logger.info(f"   OS:           {info.get('os', 'N/A')}")
+            logger.info(f"   Size:         {info.get('size', 'N/A')}")
+            logger.info(f"   Layers:       {info.get('layers', 'N/A')}")
+
+        patch_details = summary.get('patch_details', [])
+        if patch_details:
+            logger.info("\n PATCH DETAILS:")
+
+            for i, detail in enumerate(patch_details, 1):
+                if isinstance(detail, dict):
+                    cve = detail.get('vulnerability', detail.get('id', f'PATCH-{i}'))
+                    logger.info(f"   {cve}")
+
+                    packages = detail.get('packages', [])
+                    if not packages:
+                        single_package = detail.get('package', detail.get('component'))
+                        if single_package:
+                            packages = [single_package]
+
+                    for pkg in packages:
+                        if isinstance(pkg, dict):
+                            pkg_name = pkg.get('name', pkg.get('package', 'Unknown'))
+                            version = pkg.get('version', pkg.get('fixed_version', ''))
+                            if version:
+                                logger.info(f"       {pkg_name} (v{version})")
+                            else:
+                                logger.info(f"       {pkg_name}")
+                        else:
+                            logger.info(f"       {pkg}")
+
+                    if not packages:
+                        logger.info("       No package information available")
+
+                else:
+                    logger.info(f"   {detail}")
+
+                if i < len(patch_details):
+                    logger.info("")
+
+        logger.info("\n SUMMARY:")
+        vex_generated = summary.get('vex_file_generated', False)
+        
+        if vuln_count > 0:
+            logger.info(f"   Status: SUCCESS - {vuln_count} vulnerabilities were patched")
+        elif vex_generated:
+            logger.info("   Status: COMPLETED - No vulnerabilities found to patch")
+        else:
+            logger.info("   Status: COMPLETED - Image patched successfully without vulnerability report")
+            logger.info("           Use --vulnerability_report to generate detailed VEX output")
+        
+        logger.info(f"{'='*terminal_width}\n")