opencra-cli 0.1.0__tar.gz → 0.1.4__tar.gz

{opencra_cli-0.1.0 → opencra_cli-0.1.4}/PKG-INFO

@@ -1,12 +1,12 @@
 Metadata-Version: 2.5
 Name: opencra-cli
-Version: 0.1.0
+Version: 0.1.4
 Summary: OpenCRA command-line scanner — Syft wrapper, OSV + CISA KEV matching.
 License: Apache-2.0
 Requires-Python: >=3.12
 Requires-Dist: httpx>=0.27
 Requires-Dist: jinja2>=3.1
-Requires-Dist: opencra-shared
+Requires-Dist: opencra-shared>=0.1.4
 Requires-Dist: rich>=13.9
 Requires-Dist: typer>=0.15
 Provides-Extra: pdf

{opencra_cli-0.1.0 → opencra_cli-0.1.4}/opencra_cli/__init__.py

@@ -1,3 +1,3 @@
 """OpenCRA CLI — Syft wrapper, OSV + CISA KEV matching."""
 
-__version__ = "0.1.0"
+__version__ = "0.1.4"

{opencra_cli-0.1.0 → opencra_cli-0.1.4}/opencra_cli/app.py

@@ -202,7 +202,11 @@ def doctor(
 
     console.print(f"OSV: {'reachable' if osv_ping() else 'unreachable (offline scans still work)'}")
     pdf_ok, pdf_reason = weasyprint_status()
-    console.print(f"PDF engine: {'ok' if pdf_ok else 'fallback'} — {pdf_reason}")
+    # markup=False: Rich treats [pdf] in opencra-cli[pdf] as a style tag.
+    console.print(
+        f"PDF engine: {'ok' if pdf_ok else 'fallback'} — {pdf_reason}",
+        markup=False,
+    )
     console.print(
         "[dim]A KEV match is a CRA candidate. Clocks start only after human awareness.[/dim]"
     )

{opencra_cli-0.1.0 → opencra_cli-0.1.4}/opencra_cli/db.py

@@ -51,6 +51,11 @@ class Cache:
                 fetched_at TEXT NOT NULL,
                 vulns_json TEXT NOT NULL
             );
+            CREATE TABLE IF NOT EXISTS osv_vulns (
+                vuln_id TEXT PRIMARY KEY,
+                fetched_at TEXT NOT NULL,
+                vuln_json TEXT NOT NULL
+            );
             CREATE TABLE IF NOT EXISTS scans (
                 id INTEGER PRIMARY KEY AUTOINCREMENT,
                 target TEXT NOT NULL,
@@ -119,6 +124,32 @@ class Cache:
             return None
         return json.loads(row["vulns_json"])
 
+    def get_osv_vuln(self, vuln_id: str) -> dict[str, Any] | None:
+        row = self.conn.execute(
+            "SELECT fetched_at, vuln_json FROM osv_vulns WHERE vuln_id = ?",
+            (vuln_id,),
+        ).fetchone()
+        if not row:
+            return None
+        fetched = datetime.fromisoformat(row["fetched_at"])
+        if datetime.now(timezone.utc) - fetched > OSV_TTL:
+            return None
+        payload = json.loads(row["vuln_json"])
+        return payload if isinstance(payload, dict) else None
+
+    def save_osv_vuln(self, vuln_id: str, vuln: dict[str, Any]) -> None:
+        now = datetime.now(timezone.utc).isoformat()
+        self.conn.execute(
+            """
+            INSERT INTO osv_vulns (vuln_id, fetched_at, vuln_json)
+            VALUES (?, ?, ?)
+            ON CONFLICT(vuln_id) DO UPDATE SET fetched_at = excluded.fetched_at,
+                                               vuln_json = excluded.vuln_json
+            """,
+            (vuln_id, now, json.dumps(vuln)),
+        )
+        self.conn.commit()
+
     def save_osv(self, purl: str, vulns: list[dict[str, Any]]) -> None:
         now = datetime.now(timezone.utc).isoformat()
         self.conn.execute(

opencra_cli-0.1.4/opencra_cli/osv.py

@@ -0,0 +1,153 @@
+"""OSV Query Batch client with 100-item chunks and SQLite cache."""
+
+from __future__ import annotations
+
+import logging
+from typing import Any
+
+import httpx
+from opencra_shared.kev import extract_cves
+
+from opencra_cli.db import Cache
+from opencra_cli.httputil import USER_AGENT, client
+
+logger = logging.getLogger("opencra.osv")
+
+OSV_QUERYBATCH = "https://api.osv.dev/v1/querybatch"
+OSV_VULN = "https://api.osv.dev/v1/vulns"
+BATCH_SIZE = 100
+_HYDRATE_KEYS = ("aliases", "summary", "severity", "database_specific")
+
+
+def _chunks(items: list[str], size: int) -> list[list[str]]:
+    return [items[i : i + size] for i in range(0, len(items), size)]
+
+
+def _vuln_id(vuln: dict[str, Any]) -> str:
+    return str(vuln.get("id") or "")
+
+
+def _has_cve(vuln: dict[str, Any]) -> bool:
+    aliases = [str(a) for a in (vuln.get("aliases") or [])]
+    return bool(extract_cves(aliases, _vuln_id(vuln)))
+
+
+def _merge_detail(vuln: dict[str, Any], detail: dict[str, Any]) -> dict[str, Any]:
+    merged = dict(vuln)
+    for key in _HYDRATE_KEYS:
+        if key in detail and not merged.get(key):
+            merged[key] = detail[key]
+    return merged
+
+
+def hydrate_vulns(
+    vulns: list[dict[str, Any]],
+    cache: Cache,
+    *,
+    offline: bool = False,
+) -> list[dict[str, Any]]:
+    """Fill aliases (and related fields) so KEV can match CVE-IDs.
+
+    OSV ``querybatch`` returns ``{id, modified}`` stubs. Full records come from
+    ``GET /v1/vulns/{id}``. Offline mode never opens HTTP.
+    """
+    if offline or not vulns:
+        return vulns
+
+    to_fetch: list[str] = []
+    for vuln in vulns:
+        if not isinstance(vuln, dict) or _has_cve(vuln):
+            continue
+        vid = _vuln_id(vuln)
+        if vid and cache.get_osv_vuln(vid) is None:
+            to_fetch.append(vid)
+
+    if to_fetch:
+        with client() as http:
+            for vid in dict.fromkeys(to_fetch):
+                try:
+                    response = http.get(f"{OSV_VULN}/{vid}")
+                    response.raise_for_status()
+                    body = response.json()
+                except httpx.HTTPError as exc:
+                    logger.warning("OSV vuln %s fetch failed: %s", vid, exc)
+                    continue
+                if isinstance(body, dict):
+                    cache.save_osv_vuln(vid, body)
+
+    hydrated: list[dict[str, Any]] = []
+    for vuln in vulns:
+        if not isinstance(vuln, dict):
+            continue
+        if _has_cve(vuln):
+            hydrated.append(vuln)
+            continue
+        vid = _vuln_id(vuln)
+        detail = cache.get_osv_vuln(vid) if vid else None
+        hydrated.append(_merge_detail(vuln, detail) if detail else vuln)
+    return hydrated
+
+
+def query_batch(
+    purls: list[str],
+    cache: Cache,
+    *,
+    offline: bool = False,
+) -> dict[str, list[dict[str, Any]]]:
+    """Return {purl: [osv vuln dicts]} for validated PURLs only."""
+    results: dict[str, list[dict[str, Any]]] = {}
+    missing: list[str] = []
+    persist: set[str] = set()
+    for purl in purls:
+        cached = cache.get_osv(purl)
+        if cached is not None:
+            results[purl] = cached
+            persist.add(purl)
+        else:
+            missing.append(purl)
+
+    if offline:
+        if missing:
+            logger.warning("Offline mode: %s PURLs have no cached OSV data", len(missing))
+            for purl in missing:
+                results[purl] = []
+        return results
+
+    for chunk in _chunks(missing, BATCH_SIZE):
+        payload = {"queries": [{"package": {"purl": purl}} for purl in chunk]}
+        try:
+            with client() as http:
+                response = http.post(OSV_QUERYBATCH, json=payload)
+                response.raise_for_status()
+                body = response.json()
+        except httpx.HTTPError as exc:
+            logger.warning("OSV querybatch failed for %s items: %s", len(chunk), exc)
+            for purl in chunk:
+                results.setdefault(purl, [])
+            continue
+
+        results_list = body.get("results") or []
+        for purl, item in zip(chunk, results_list, strict=False):
+            vulns = item.get("vulns") or [] if isinstance(item, dict) else []
+            results[purl] = vulns if isinstance(vulns, list) else []
+            persist.add(purl)
+        if len(results_list) < len(chunk):
+            for purl in chunk[len(results_list) :]:
+                results[purl] = []
+                persist.add(purl)
+
+    for purl, vulns in list(results.items()):
+        hydrated = hydrate_vulns(vulns, cache, offline=False)
+        results[purl] = hydrated
+        if purl in persist:
+            cache.save_osv(purl, hydrated)
+    return results
+
+
+def ping() -> bool:
+    try:
+        with client() as http:
+            response = http.get("https://api.osv.dev/v1/querybatch", headers={"User-Agent": USER_AGENT})
+            return response.status_code in {200, 405, 415}
+    except httpx.HTTPError:
+        return False

{opencra_cli-0.1.0 → opencra_cli-0.1.4}/opencra_cli/syft.py

@@ -43,16 +43,44 @@ def resolve_syft(syft_bin: str | None = None) -> str:
     return found
 
 
-def parse_syft_version(text: str) -> tuple[int, int, int] | None:
-    # Typical: "syft 1.18.1"
+def _parse_version_token(text: str) -> tuple[int, int, int] | None:
     for token in text.replace(",", " ").split():
-        parts = token.strip().split(".")
+        token = token.strip().lstrip("vV")
+        parts = token.split(".")
         if len(parts) >= 2 and parts[0].isdigit() and parts[1].isdigit():
             patch = int(parts[2]) if len(parts) > 2 and parts[2].isdigit() else 0
             return int(parts[0]), int(parts[1]), patch
     return None
 
 
+def parse_syft_version(text: str) -> tuple[int, int, int] | None:
+    """Parse a Syft version from `syft version` or `syft --version` text.
+
+    Prefer the ``Version:`` line so SchemaVersion (e.g. 16.1.10) is not used.
+    """
+    for line in text.splitlines():
+        if line.strip().lower().startswith("version:"):
+            parsed = _parse_version_token(line.split(":", 1)[1])
+            if parsed:
+                return parsed
+    return _parse_version_token(text)
+
+
+def format_syft_label(output: str, parsed: tuple[int, int, int] | None, fallback: str = "syft") -> str:
+    """Human-readable Syft version for `opencra doctor` (not the first metadata line)."""
+    if parsed:
+        return f"syft {parsed[0]}.{parsed[1]}.{parsed[2]}"
+    for line in output.splitlines():
+        if line.strip().lower().startswith("version:"):
+            value = line.split(":", 1)[1].strip()
+            if value:
+                return f"syft {value.lstrip('vV')}"
+    stripped = output.strip()
+    if stripped:
+        return stripped.splitlines()[0]
+    return fallback
+
+
 def syft_version(syft_bin: str | None = None) -> tuple[str, tuple[int, int, int] | None]:
     binary = resolve_syft(syft_bin)
     result = subprocess.run(
@@ -72,7 +100,7 @@ def syft_version(syft_bin: str | None = None) -> tuple[str, tuple[int, int, int]
         )
         output = (result.stdout or "") + (result.stderr or "")
     parsed = parse_syft_version(output)
-    return output.strip().splitlines()[0] if output.strip() else binary, parsed
+    return format_syft_label(output, parsed, fallback=binary), parsed
 
 
 def version_ok(version: tuple[int, int, int] | None) -> bool:

{opencra_cli-0.1.0 → opencra_cli-0.1.4}/pyproject.toml

@@ -1,11 +1,11 @@
 [project]
 name = "opencra-cli"
-version = "0.1.0"
+version = "0.1.4"
 description = "OpenCRA command-line scanner — Syft wrapper, OSV + CISA KEV matching."
 requires-python = ">=3.12"
 license = { text = "Apache-2.0" }
 dependencies = [
-  "opencra-shared",
+  "opencra-shared>=0.1.4",
   "typer>=0.15",
   "rich>=13.9",
   "httpx>=0.27",

opencra_cli-0.1.0/opencra_cli/osv.py

@@ -1,79 +0,0 @@
-"""OSV Query Batch client with 100-item chunks and SQLite cache."""
-
-from __future__ import annotations
-
-import logging
-from typing import Any
-
-import httpx
-
-from opencra_cli.db import Cache
-from opencra_cli.httputil import USER_AGENT, client
-
-logger = logging.getLogger("opencra.osv")
-
-OSV_QUERYBATCH = "https://api.osv.dev/v1/querybatch"
-BATCH_SIZE = 100
-
-
-def _chunks(items: list[str], size: int) -> list[list[str]]:
-    return [items[i : i + size] for i in range(0, len(items), size)]
-
-
-def query_batch(
-    purls: list[str],
-    cache: Cache,
-    *,
-    offline: bool = False,
-) -> dict[str, list[dict[str, Any]]]:
-    """Return {purl: [osv vuln dicts]} for validated PURLs only."""
-    results: dict[str, list[dict[str, Any]]] = {}
-    missing: list[str] = []
-    for purl in purls:
-        cached = cache.get_osv(purl)
-        if cached is not None:
-            results[purl] = cached
-        else:
-            missing.append(purl)
-
-    if not missing:
-        return results
-    if offline:
-        logger.warning("Offline mode: %s PURLs have no cached OSV data", len(missing))
-        for purl in missing:
-            results[purl] = []
-        return results
-
-    for chunk in _chunks(missing, BATCH_SIZE):
-        payload = {"queries": [{"package": {"purl": purl}} for purl in chunk]}
-        try:
-            with client() as http:
-                response = http.post(OSV_QUERYBATCH, json=payload)
-                response.raise_for_status()
-                body = response.json()
-        except httpx.HTTPError as exc:
-            logger.warning("OSV querybatch failed for %s items: %s", len(chunk), exc)
-            for purl in chunk:
-                results.setdefault(purl, [])
-            continue
-
-        results_list = body.get("results") or []
-        for purl, item in zip(chunk, results_list, strict=False):
-            vulns = item.get("vulns") or [] if isinstance(item, dict) else []
-            cache.save_osv(purl, vulns)
-            results[purl] = vulns
-        # If OSV returned fewer results than queries, mark leftovers empty.
-        if len(results_list) < len(chunk):
-            for purl in chunk[len(results_list) :]:
-                cache.save_osv(purl, [])
-                results[purl] = []
-    return results
-
-
-def ping() -> bool:
-    try:
-        with client() as http:
-            response = http.get("https://api.osv.dev/v1/querybatch", headers={"User-Agent": USER_AGENT})
-            return response.status_code in {200, 405, 415}
-    except httpx.HTTPError:
-        return False