opencra-cli 0.1.0__tar.gz

opencra_cli-0.1.0/.gitignore

@@ -0,0 +1,249 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[codz]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+#   Usually these files are written by a python script from a template
+#   before PyInstaller builds the exe, so as to inject date/other infos into it.
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py.cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+#   For a library or package, you might want to ignore these files since the code is
+#   intended to run in multiple environments; otherwise, check them in:
+# .python-version
+
+# pipenv
+#   According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
+#   However, in case of collaboration, if having platform-specific dependencies or dependencies
+#   having no cross-platform support, pipenv may install dependencies that don't work, or not
+#   install all needed dependencies.
+# Pipfile.lock
+
+# UV
+#   Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+# uv.lock
+
+# poetry
+#   Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
+#   This is especially recommended for binary packages to ensure reproducibility, and is more
+#   commonly ignored for libraries.
+#   https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
+# poetry.lock
+# poetry.toml
+
+# pdm
+#   Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
+#   pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
+#   https://pdm-project.org/en/latest/usage/project/#working-with-version-control
+# pdm.lock
+# pdm.toml
+.pdm-python
+.pdm-build/
+
+# pixi
+#   Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
+# pixi.lock
+#   Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
+#   in the .venv directory. It is recommended not to include this directory in version control.
+.pixi
+
+# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# Redis
+*.rdb
+*.aof
+*.pid
+
+# RabbitMQ
+mnesia/
+rabbitmq/
+rabbitmq-data/
+
+# ActiveMQ
+activemq-data/
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.envrc
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+#   JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#   be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#   and can be added to the global gitignore or merged into this file.  For a more nuclear
+#   option (not recommended) you can uncomment the following to ignore the entire idea folder.
+# .idea/
+
+# Abstra
+#   Abstra is an AI-powered process automation framework.
+#   Ignore directories containing user credentials, local state, and settings.
+#   Learn more at https://abstra.io/docs
+.abstra/
+
+# Visual Studio Code
+#   Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore 
+#   that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
+#   and can be added to the global gitignore or merged into this file. However, if you prefer, 
+#   you could uncomment the following to ignore the entire vscode folder
+# .vscode/
+# Temporary file for partial code execution
+tempCodeRunnerFile.py
+
+# Ruff stuff:
+.ruff_cache/
+
+# PyPI configuration file
+.pypirc
+
+# Marimo
+marimo/_static/
+marimo/_lsp/
+__marimo__/
+
+# Streamlit
+.streamlit/secrets.toml
+
+# Environment variables & secrets (CRITICAL)
+.env
+.env.*
+!.env.example
+
+# IDEs & Editor settings
+.vscode/
+.idea/
+
+# Local OS metadata
+.DS_Store
+Thumbs.db
+
+# SQLite / Local Databases
+*.db
+*.sqlite3
+crashield.db
+
+# OpenCRA CLI output test files
+*.cyclonedx.json
+*.spdx.json
+cra-report.pdf
+*.pdf-fallback.txt
+
+# Node / frontend
+node_modules/
+apps/web/dist/
+
+# uv
+.python-version

opencra_cli-0.1.0/PKG-INFO

@@ -0,0 +1,13 @@
+Metadata-Version: 2.5
+Name: opencra-cli
+Version: 0.1.0
+Summary: OpenCRA command-line scanner — Syft wrapper, OSV + CISA KEV matching.
+License: Apache-2.0
+Requires-Python: >=3.12
+Requires-Dist: httpx>=0.27
+Requires-Dist: jinja2>=3.1
+Requires-Dist: opencra-shared
+Requires-Dist: rich>=13.9
+Requires-Dist: typer>=0.15
+Provides-Extra: pdf
+Requires-Dist: weasyprint>=63.0; extra == 'pdf'

opencra_cli-0.1.0/opencra_cli/__init__.py

@@ -0,0 +1,3 @@
+"""OpenCRA CLI — Syft wrapper, OSV + CISA KEV matching."""
+
+__version__ = "0.1.0"

opencra_cli-0.1.0/opencra_cli/app.py

@@ -0,0 +1,257 @@
+"""OpenCRA Typer CLI."""
+
+from __future__ import annotations
+
+import logging
+from datetime import datetime, timezone
+from enum import Enum
+from pathlib import Path
+
+import typer
+from opencra_shared.models import FailOn, OutputFormat, ScanResult
+from rich.console import Console
+
+from opencra_cli import __version__
+from opencra_cli.db import Cache, default_db_path
+from opencra_cli.kev import KevError, load_index, refresh
+from opencra_cli.match import merge_matches
+from opencra_cli.nvd import cvss_from_nvd, enrich_cve
+from opencra_cli.osv import ping as osv_ping
+from opencra_cli.osv import query_batch
+from opencra_cli.pdf import PDF_HINT, export_report, weasyprint_status
+from opencra_cli.render import format_payload, print_table, result_to_json, write_output
+from opencra_cli.syft import SyftError, resolve_syft, scan_to_document, syft_version, version_ok
+from opencra_cli.sync import ingest
+
+app = typer.Typer(
+    name="opencra",
+    help="CRA Article 14 reporting readiness for your SBOM. A KEV hit is a candidate, not awareness.",
+    no_args_is_help=True,
+)
+console = Console()
+err_console = Console(stderr=True)
+
+
+class FailOnOpt(str, Enum):
+    none = "none"
+    kev = "kev"
+    critical = "critical"
+    high = "high"
+
+
+class FormatOpt(str, Enum):
+    table = "table"
+    json = "json"
+    cyclonedx = "cyclonedx"
+    spdx = "spdx"
+
+
+class EnrichOpt(str, Enum):
+    none = "none"
+    nvd = "nvd"
+
+
+def _configure_logging(verbose: bool, quiet: bool) -> None:
+    level = logging.WARNING
+    if verbose:
+        level = logging.DEBUG
+    if quiet:
+        level = logging.ERROR
+    logging.basicConfig(level=level, format="%(levelname)s %(name)s: %(message)s")
+
+
+def _exit(code: int, message: str | None = None) -> None:
+    if message:
+        err_console.print(f"[red]{message}[/red]")
+    raise typer.Exit(code)
+
+
+def _run_scan(
+    target: str,
+    *,
+    offline: bool,
+    enrich: EnrichOpt,
+    syft_bin: str | None,
+    cache: Cache,
+) -> ScanResult:
+    document = scan_to_document(target, syft_bin=syft_bin)
+    skipped = [c for c in document.components if not c.purl]
+    valid_purls = sorted({c.purl for c in document.components if c.purl})
+    warnings: list[str] = []
+    if skipped:
+        warnings.append(
+            f"Skipped {len(skipped)} component(s) with invalid or missing PURLs "
+            "(they were not sent to OSV)."
+        )
+
+    kev_index = load_index(cache, offline=offline)
+    osv_by_purl = query_batch(valid_purls, cache, offline=offline)
+    matches = merge_matches(document.components, osv_by_purl, kev_index)
+
+    if enrich is EnrichOpt.nvd and not offline:
+        for match in matches:
+            if match.cve_id and match.cvss_v3 is None:
+                payload = enrich_cve(match.cve_id)
+                if payload:
+                    match.cvss_v3 = cvss_from_nvd(payload)
+
+    return ScanResult(
+        target=target,
+        scanned_at=datetime.now(timezone.utc),
+        sbom=document,
+        matches=matches,
+        skipped_components=skipped,
+        offline=offline,
+        warnings=warnings,
+    )
+
+
+@app.command()
+def scan(
+    target: str = typer.Argument(
+        ".", help="Path, image, Syft target, or CycloneDX JSON file."
+    ),
+    format: FormatOpt = typer.Option(FormatOpt.table, "--format", help="Output format."),
+    output: Path | None = typer.Option(None, "--output", help="Write formatted output to PATH."),
+    export_pdf: Path | None = typer.Option(
+        None, "--export-pdf", help="Write a community PDF (falls back to HTML/Markdown)."
+    ),
+    fail_on: FailOnOpt = typer.Option(
+        FailOnOpt.kev, "--fail-on", help="Exit 1 when threshold is met. Default: kev."
+    ),
+    offline: bool = typer.Option(False, "--offline", help="Use SQLite caches only. No network."),
+    enrich: EnrichOpt = typer.Option(EnrichOpt.none, "--enrich"),
+    sync_cloud: bool = typer.Option(False, "--sync-cloud", help="POST results to CRA-Shield."),
+    syft_bin: str | None = typer.Option(None, "--syft-bin", help="Path to the Syft binary."),
+    quiet: bool = typer.Option(False, "--quiet"),
+    verbose: bool = typer.Option(False, "--verbose"),
+) -> None:
+    """Generate or ingest an SBOM and match components against OSV + CISA KEV."""
+    _configure_logging(verbose, quiet)
+    try:
+        with Cache() as cache:
+            result = _run_scan(
+                target,
+                offline=offline,
+                enrich=enrich,
+                syft_bin=syft_bin,
+                cache=cache,
+            )
+            cache.save_scan(target, result_to_json(result), result.sbom.model_dump(mode="json"))
+    except SyftError as exc:
+        _exit(exc.exit_code, str(exc))
+    except KevError as exc:
+        _exit(2, str(exc))
+
+    fmt = OutputFormat(format.value)
+    if fmt is OutputFormat.TABLE and not quiet:
+        print_table(result, console)
+    elif fmt is not OutputFormat.TABLE:
+        payload = format_payload(result, fmt)
+        if output:
+            write_output(result, fmt, output)
+            if not quiet:
+                console.print(f"Wrote {fmt.value} to {output}")
+        else:
+            console.print(payload)
+    elif output:
+        write_output(result, OutputFormat.JSON, output)
+
+    if export_pdf:
+        written = export_report(result, export_pdf)
+        if not quiet:
+            if written.suffix == ".pdf":
+                console.print(f"Wrote PDF to {written}")
+            else:
+                console.print(
+                    f"[yellow]PDF engine unavailable.[/yellow] Wrote {written} instead.\n{PDF_HINT}"
+                )
+
+    if sync_cloud:
+        response = ingest(result)
+        if not quiet:
+            console.print(response.get("message") or response)
+
+    threshold = FailOn(fail_on.value)
+    if result.fails(threshold):
+        _exit(1, f"Scan failed --fail-on {threshold.value}.")
+
+
+@app.command()
+def doctor(
+    syft_bin: str | None = typer.Option(None, "--syft-bin"),
+) -> None:
+    """Check Syft, network, cache, and PDF engine. Friendly, not a stack trace."""
+    console.print(f"[bold]OpenCRA[/bold] {__version__}")
+    try:
+        path = resolve_syft(syft_bin)
+        label, parsed = syft_version(syft_bin)
+        ok = version_ok(parsed)
+        status = "[green]ok[/green]" if ok else "[yellow]old[/yellow]"
+        console.print(f"Syft: {status} {path} ({label})")
+        if not ok:
+            console.print("  Install Syft >= 1.0.0 for CycloneDX 1.6 output.")
+    except SyftError as exc:
+        console.print(f"Syft: [red]missing[/red]\n{exc}")
+
+    cache_path = default_db_path()
+    console.print(f"Cache: {cache_path} ({'exists' if cache_path.exists() else 'will be created'})")
+    with Cache() as cache:
+        fetched = cache.get_kev_fetched_at()
+        console.print(f"KEV cache: {fetched.isoformat() if fetched else 'empty'}")
+
+    console.print(f"OSV: {'reachable' if osv_ping() else 'unreachable (offline scans still work)'}")
+    pdf_ok, pdf_reason = weasyprint_status()
+    console.print(f"PDF engine: {'ok' if pdf_ok else 'fallback'} — {pdf_reason}")
+    console.print(
+        "[dim]A KEV match is a CRA candidate. Clocks start only after human awareness.[/dim]"
+    )
+
+
+@app.command("kev")
+def kev_cmd(
+    action: str = typer.Argument("refresh", help="Only 'refresh' is supported."),
+) -> None:
+    """Download or refresh the CISA KEV catalog into the local cache."""
+    if action != "refresh":
+        _exit(2, "Usage: opencra kev refresh")
+    try:
+        with Cache() as cache:
+            count, fetched = refresh(cache)
+    except KevError as exc:
+        _exit(2, str(exc))
+    console.print(f"Cached {count} CISA KEV entries ({fetched.isoformat()}).")
+
+
+@app.command()
+def report(
+    last: bool = typer.Option(False, "--last", help="Re-render the most recent local scan."),
+    export_pdf: Path | None = typer.Option(None, "--export-pdf"),
+    format: FormatOpt = typer.Option(FormatOpt.table, "--format"),
+) -> None:
+    """Show the last cached scan without invoking Syft."""
+    if not last:
+        _exit(2, "Pass --last to print the most recent scan.")
+    with Cache() as cache:
+        raw = cache.last_scan()
+    if raw is None:
+        _exit(2, "No cached scans. Run `opencra scan .` first.")
+    result = ScanResult.model_validate(raw)
+    fmt = OutputFormat(format.value)
+    if fmt is OutputFormat.TABLE:
+        print_table(result, console)
+    else:
+        console.print(format_payload(result, fmt))
+    if export_pdf:
+        written = export_report(result, export_pdf)
+        console.print(f"Wrote report to {written}")
+
+
+@app.callback()
+def main() -> None:
+    """OpenCRA CLI."""
+    return
+
+
+if __name__ == "__main__":
+    app()

opencra_cli-0.1.0/opencra_cli/db.py

@@ -0,0 +1,176 @@
+"""Local SQLite cache at ~/.opencra/cache.db with WAL mode."""
+
+from __future__ import annotations
+
+import json
+import os
+import sqlite3
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+from typing import Any
+
+OSV_TTL = timedelta(hours=12)
+
+
+def default_db_path() -> Path:
+    override = os.environ.get("OPENCRA_CACHE")
+    if override:
+        return Path(override).expanduser()
+    return Path.home() / ".opencra" / "cache.db"
+
+
+class Cache:
+    def __init__(self, path: Path | None = None) -> None:
+        self.path = path or default_db_path()
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self.conn = sqlite3.connect(self.path)
+        self.conn.row_factory = sqlite3.Row
+        self.conn.execute("PRAGMA journal_mode=WAL;")
+        self.conn.execute("PRAGMA foreign_keys=ON;")
+        self._init()
+
+    def close(self) -> None:
+        self.conn.close()
+
+    def __enter__(self) -> Cache:
+        return self
+
+    def __exit__(self, *args: object) -> None:
+        self.close()
+
+    def _init(self) -> None:
+        self.conn.executescript(
+            """
+            CREATE TABLE IF NOT EXISTS kev_meta (
+                id INTEGER PRIMARY KEY CHECK (id = 1),
+                fetched_at TEXT NOT NULL,
+                catalog_json TEXT NOT NULL
+            );
+            CREATE TABLE IF NOT EXISTS osv_cache (
+                purl TEXT PRIMARY KEY,
+                fetched_at TEXT NOT NULL,
+                vulns_json TEXT NOT NULL
+            );
+            CREATE TABLE IF NOT EXISTS scans (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                target TEXT NOT NULL,
+                scanned_at TEXT NOT NULL,
+                serial_number TEXT,
+                sbom_json TEXT NOT NULL,
+                result_json TEXT NOT NULL
+            );
+            CREATE TABLE IF NOT EXISTS components (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                scan_id INTEGER NOT NULL,
+                purl TEXT,
+                name TEXT NOT NULL,
+                version TEXT,
+                FOREIGN KEY (scan_id) REFERENCES scans(id)
+            );
+            CREATE TABLE IF NOT EXISTS matches (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                scan_id INTEGER NOT NULL,
+                purl TEXT NOT NULL,
+                osv_id TEXT,
+                cve_id TEXT,
+                severity TEXT,
+                in_kev INTEGER NOT NULL DEFAULT 0,
+                summary TEXT,
+                FOREIGN KEY (scan_id) REFERENCES scans(id)
+            );
+            """
+        )
+        self.conn.commit()
+
+    def get_kev_catalog(self) -> dict[str, Any] | None:
+        row = self.conn.execute("SELECT catalog_json FROM kev_meta WHERE id = 1").fetchone()
+        if not row:
+            return None
+        return json.loads(row["catalog_json"])
+
+    def get_kev_fetched_at(self) -> datetime | None:
+        row = self.conn.execute("SELECT fetched_at FROM kev_meta WHERE id = 1").fetchone()
+        if not row:
+            return None
+        return datetime.fromisoformat(row["fetched_at"])
+
+    def save_kev_catalog(self, payload: dict[str, Any]) -> None:
+        now = datetime.now(timezone.utc).isoformat()
+        self.conn.execute(
+            """
+            INSERT INTO kev_meta (id, fetched_at, catalog_json)
+            VALUES (1, ?, ?)
+            ON CONFLICT(id) DO UPDATE SET fetched_at = excluded.fetched_at,
+                                          catalog_json = excluded.catalog_json
+            """,
+            (now, json.dumps(payload)),
+        )
+        self.conn.commit()
+
+    def get_osv(self, purl: str) -> list[dict[str, Any]] | None:
+        row = self.conn.execute(
+            "SELECT fetched_at, vulns_json FROM osv_cache WHERE purl = ?",
+            (purl,),
+        ).fetchone()
+        if not row:
+            return None
+        fetched = datetime.fromisoformat(row["fetched_at"])
+        if datetime.now(timezone.utc) - fetched > OSV_TTL:
+            return None
+        return json.loads(row["vulns_json"])
+
+    def save_osv(self, purl: str, vulns: list[dict[str, Any]]) -> None:
+        now = datetime.now(timezone.utc).isoformat()
+        self.conn.execute(
+            """
+            INSERT INTO osv_cache (purl, fetched_at, vulns_json)
+            VALUES (?, ?, ?)
+            ON CONFLICT(purl) DO UPDATE SET fetched_at = excluded.fetched_at,
+                                            vulns_json = excluded.vulns_json
+            """,
+            (purl, now, json.dumps(vulns)),
+        )
+        self.conn.commit()
+
+    def save_scan(self, target: str, result_json: dict[str, Any], sbom_json: dict[str, Any]) -> int:
+        scanned_at = result_json.get("scanned_at") or datetime.now(timezone.utc).isoformat()
+        serial = (result_json.get("sbom") or {}).get("serial_number")
+        cur = self.conn.execute(
+            """
+            INSERT INTO scans (target, scanned_at, serial_number, sbom_json, result_json)
+            VALUES (?, ?, ?, ?, ?)
+            """,
+            (target, scanned_at, serial, json.dumps(sbom_json), json.dumps(result_json)),
+        )
+        scan_id = int(cur.lastrowid or 0)
+        for component in (result_json.get("sbom") or {}).get("components") or []:
+            self.conn.execute(
+                "INSERT INTO components (scan_id, purl, name, version) VALUES (?, ?, ?, ?)",
+                (scan_id, component.get("purl"), component.get("name"), component.get("version")),
+            )
+        for match in result_json.get("matches") or []:
+            self.conn.execute(
+                """
+                INSERT INTO matches (scan_id, purl, osv_id, cve_id, severity, in_kev, summary)
+                VALUES (?, ?, ?, ?, ?, ?, ?)
+                """,
+                (
+                    scan_id,
+                    match.get("purl"),
+                    match.get("osv_id"),
+                    match.get("cve_id"),
+                    match.get("severity"),
+                    1 if match.get("in_kev") else 0,
+                    match.get("summary"),
+                ),
+            )
+        self.conn.commit()
+        return scan_id
+
+    def last_scan(self) -> dict[str, Any] | None:
+        row = self.conn.execute(
+            "SELECT result_json FROM scans ORDER BY id DESC LIMIT 1"
+        ).fetchone()
+        if not row:
+            return None
+        return json.loads(row["result_json"])