owasp-dependency-track-cli 0.0.1__tar.gz

owasp_dependency_track_cli-0.0.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Mike Reiche
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

owasp_dependency_track_cli-0.0.1/PKG-INFO

@@ -0,0 +1,90 @@
+Metadata-Version: 2.4
+Name: owasp-dependency-track-cli
+Version: 0.0.1
+Summary: Inofficial OWASP Dependency Track CLI
+Home-page: https://github.com/mreiche/owasp-dependency-track-cli
+Author: Mike Reiche
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: owasp-dependency-track-client==0.0.3
+Requires-Dist: is_empty==1.0.1
+Requires-Dist: tabulate==0.9.0
+Requires-Dist: colorama==0.4.6
+Dynamic: author
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: license-file
+Dynamic: requires-dist
+Dynamic: summary
+
+# OWASP Dependency Tracker CLI
+
+A CLI client for usage in CI/CD pipelines.
+
+## Test for findings
+
+```shell
+OWASP_DT_URL="http://localhost:8081/api"
+OWASP_DT_VERIFY_SSL="False"
+OWASP_DT_API_KEY="xyz"
+SEVERITY_THRESHOLD_HIGH="3"
+
+python main.py test --project-name webapp --auto-create test/test.sbom.xml
+```
+
+As Container runtime:
+
+```shell
+podman|docker \
+ run --rm -v"$(pwd):$(pwd)" \
+ -eOWASP_DT_URL="http://192.168.1.100:8081/api" \
+ -eOWASP_DT_VERIFY_SSL="false" \
+ -eOWASP_DT_API_KEY="xyz" \
+ ghcr.io/mreiche/owasp-dependency-track-cli:main test --project-name webapp2 --auto-create "$(pwd)/test/test.sbom.xml"
+```
+
+## Environment variables
+```shell
+OWASP_DT_URL="http://localhost:8081/api"  # Base-URL to OWASP Dependency Track API (mind '/api' as base path)
+OWASP_DT_VERIFY_SSL="False"  # Do not verify SSL
+OWASP_DT_API_KEY="xyz"  # You OWASP DT API Key
+SEVERITY_THRESHOLD_HIGH="-1"  # Threshold for HIGH severity findings
+SEVERITY_THRESHOLD_MEDIUM="-1"  # Threshold for MEDIUM severity findings
+SEVERITY_THRESHOLD_LOW="-1"  # Threshold for LOW severity findings
+SEVERITY_THRESHOLD_UNASSIGNED="-1"  # Threshold for UNASSIGNED severity findings
+TEST_TIMEOUT_SEC="300"  # Timeout in seconds for waiting OWASP DT finished scanning
+HTTPS_PROXY=""  # URL for for HTTP(S) proxy
+```
+
+## API-Key
+
+Setup a user with API key and the following permissions:
+
+1. Goto *Teams* -> *Automation*
+1. Add *API-Key*
+1. Add *Permissions*
+   - VIEW_VULNERABILITY
+   - SBOM_UPLOAD
+   - PROJECT_CREATION_UPLOAD (for the auto-create feature)
+
+## Testing
+
+### Start the test environment
+```shell
+cd test
+podman|docker compose up
+```
+
+- Preconfigured user: `admin:admin2`
+- Preconfigured API key: see `test/test.env`
+
+
+### Update the test database
+```shell
+podman run -it --rm --network=test_default  -v "$(pwd)/test:/test" postgres:latest pg_dump -h postgres -d dtrack -U "dtrack" -p "5432" -f "/test/postgres-init/init.sql"
+```
+
+## References
+
+- This CLI is using the Python API client: https://github.com/mreiche/owasp-dependency-track-python-client

owasp_dependency_track_cli-0.0.1/README.md

@@ -0,0 +1,70 @@
+# OWASP Dependency Tracker CLI
+
+A CLI client for usage in CI/CD pipelines.
+
+## Test for findings
+
+```shell
+OWASP_DT_URL="http://localhost:8081/api"
+OWASP_DT_VERIFY_SSL="False"
+OWASP_DT_API_KEY="xyz"
+SEVERITY_THRESHOLD_HIGH="3"
+
+python main.py test --project-name webapp --auto-create test/test.sbom.xml
+```
+
+As Container runtime:
+
+```shell
+podman|docker \
+ run --rm -v"$(pwd):$(pwd)" \
+ -eOWASP_DT_URL="http://192.168.1.100:8081/api" \
+ -eOWASP_DT_VERIFY_SSL="false" \
+ -eOWASP_DT_API_KEY="xyz" \
+ ghcr.io/mreiche/owasp-dependency-track-cli:main test --project-name webapp2 --auto-create "$(pwd)/test/test.sbom.xml"
+```
+
+## Environment variables
+```shell
+OWASP_DT_URL="http://localhost:8081/api"  # Base-URL to OWASP Dependency Track API (mind '/api' as base path)
+OWASP_DT_VERIFY_SSL="False"  # Do not verify SSL
+OWASP_DT_API_KEY="xyz"  # You OWASP DT API Key
+SEVERITY_THRESHOLD_HIGH="-1"  # Threshold for HIGH severity findings
+SEVERITY_THRESHOLD_MEDIUM="-1"  # Threshold for MEDIUM severity findings
+SEVERITY_THRESHOLD_LOW="-1"  # Threshold for LOW severity findings
+SEVERITY_THRESHOLD_UNASSIGNED="-1"  # Threshold for UNASSIGNED severity findings
+TEST_TIMEOUT_SEC="300"  # Timeout in seconds for waiting OWASP DT finished scanning
+HTTPS_PROXY=""  # URL for for HTTP(S) proxy
+```
+
+## API-Key
+
+Setup a user with API key and the following permissions:
+
+1. Goto *Teams* -> *Automation*
+1. Add *API-Key*
+1. Add *Permissions*
+   - VIEW_VULNERABILITY
+   - SBOM_UPLOAD
+   - PROJECT_CREATION_UPLOAD (for the auto-create feature)
+
+## Testing
+
+### Start the test environment
+```shell
+cd test
+podman|docker compose up
+```
+
+- Preconfigured user: `admin:admin2`
+- Preconfigured API key: see `test/test.env`
+
+
+### Update the test database
+```shell
+podman run -it --rm --network=test_default  -v "$(pwd)/test:/test" postgres:latest pg_dump -h postgres -d dtrack -U "dtrack" -p "5432" -f "/test/postgres-init/init.sql"
+```
+
+## References
+
+- This CLI is using the Python API client: https://github.com/mreiche/owasp-dependency-track-python-client

owasp_dependency_track_cli-0.0.1/owasp_dependency_track_cli.egg-info/PKG-INFO

@@ -0,0 +1,90 @@
+Metadata-Version: 2.4
+Name: owasp-dependency-track-cli
+Version: 0.0.1
+Summary: Inofficial OWASP Dependency Track CLI
+Home-page: https://github.com/mreiche/owasp-dependency-track-cli
+Author: Mike Reiche
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: owasp-dependency-track-client==0.0.3
+Requires-Dist: is_empty==1.0.1
+Requires-Dist: tabulate==0.9.0
+Requires-Dist: colorama==0.4.6
+Dynamic: author
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: license-file
+Dynamic: requires-dist
+Dynamic: summary
+
+# OWASP Dependency Tracker CLI
+
+A CLI client for usage in CI/CD pipelines.
+
+## Test for findings
+
+```shell
+OWASP_DT_URL="http://localhost:8081/api"
+OWASP_DT_VERIFY_SSL="False"
+OWASP_DT_API_KEY="xyz"
+SEVERITY_THRESHOLD_HIGH="3"
+
+python main.py test --project-name webapp --auto-create test/test.sbom.xml
+```
+
+As Container runtime:
+
+```shell
+podman|docker \
+ run --rm -v"$(pwd):$(pwd)" \
+ -eOWASP_DT_URL="http://192.168.1.100:8081/api" \
+ -eOWASP_DT_VERIFY_SSL="false" \
+ -eOWASP_DT_API_KEY="xyz" \
+ ghcr.io/mreiche/owasp-dependency-track-cli:main test --project-name webapp2 --auto-create "$(pwd)/test/test.sbom.xml"
+```
+
+## Environment variables
+```shell
+OWASP_DT_URL="http://localhost:8081/api"  # Base-URL to OWASP Dependency Track API (mind '/api' as base path)
+OWASP_DT_VERIFY_SSL="False"  # Do not verify SSL
+OWASP_DT_API_KEY="xyz"  # You OWASP DT API Key
+SEVERITY_THRESHOLD_HIGH="-1"  # Threshold for HIGH severity findings
+SEVERITY_THRESHOLD_MEDIUM="-1"  # Threshold for MEDIUM severity findings
+SEVERITY_THRESHOLD_LOW="-1"  # Threshold for LOW severity findings
+SEVERITY_THRESHOLD_UNASSIGNED="-1"  # Threshold for UNASSIGNED severity findings
+TEST_TIMEOUT_SEC="300"  # Timeout in seconds for waiting OWASP DT finished scanning
+HTTPS_PROXY=""  # URL for for HTTP(S) proxy
+```
+
+## API-Key
+
+Setup a user with API key and the following permissions:
+
+1. Goto *Teams* -> *Automation*
+1. Add *API-Key*
+1. Add *Permissions*
+   - VIEW_VULNERABILITY
+   - SBOM_UPLOAD
+   - PROJECT_CREATION_UPLOAD (for the auto-create feature)
+
+## Testing
+
+### Start the test environment
+```shell
+cd test
+podman|docker compose up
+```
+
+- Preconfigured user: `admin:admin2`
+- Preconfigured API key: see `test/test.env`
+
+
+### Update the test database
+```shell
+podman run -it --rm --network=test_default  -v "$(pwd)/test:/test" postgres:latest pg_dump -h postgres -d dtrack -U "dtrack" -p "5432" -f "/test/postgres-init/init.sql"
+```
+
+## References
+
+- This CLI is using the Python API client: https://github.com/mreiche/owasp-dependency-track-python-client

owasp_dependency_track_cli-0.0.1/owasp_dependency_track_cli.egg-info/SOURCES.txt

@@ -0,0 +1,12 @@
+LICENSE
+README.md
+setup.py
+owasp_dependency_track_cli.egg-info/PKG-INFO
+owasp_dependency_track_cli.egg-info/SOURCES.txt
+owasp_dependency_track_cli.egg-info/dependency_links.txt
+owasp_dependency_track_cli.egg-info/entry_points.txt
+owasp_dependency_track_cli.egg-info/requires.txt
+owasp_dependency_track_cli.egg-info/top_level.txt
+test/test_api.py
+test/test_convert.py
+test/test_test.py

owasp_dependency_track_cli-0.0.1/owasp_dependency_track_cli.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

owasp_dependency_track_cli-0.0.1/owasp_dependency_track_cli.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+owasp-dt = main

owasp_dependency_track_cli-0.0.1/owasp_dependency_track_cli.egg-info/requires.txt

@@ -0,0 +1,4 @@
+owasp-dependency-track-client==0.0.3
+is_empty==1.0.1
+tabulate==0.9.0
+colorama==0.4.6

owasp_dependency_track_cli-0.0.1/owasp_dependency_track_cli.egg-info/top_level.txt

@@ -0,0 +1 @@
+

owasp_dependency_track_cli-0.0.1/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

owasp_dependency_track_cli-0.0.1/setup.py

@@ -0,0 +1,34 @@
+from pathlib import Path
+
+from setuptools import setup, find_packages
+import os
+
+this_directory = Path(__file__).parent
+long_description = (this_directory / "README.md").read_text()
+
+VERSION = os.environ.get("PACKAGE_VERSION", "0.0.1")
+
+def read_requirements(filename):
+    with open(filename) as f:
+        return [
+            line.strip() for line in f
+            if line.strip() and not line.startswith('#')
+        ]
+
+
+setup(
+    name="owasp-dependency-track-cli",
+    description="Inofficial OWASP Dependency Track CLI",
+    long_description=long_description,
+    long_description_content_type="text/markdown",
+    version=VERSION,
+    url="https://github.com/mreiche/owasp-dependency-track-cli",
+    author="Mike Reiche",
+    packages=find_packages(),
+    install_requires=read_requirements('requirements.txt'),
+    entry_points={
+        'console_scripts': [
+            'owasp-dt = main',
+        ],
+    },
+)

owasp_dependency_track_cli-0.0.1/test/test_api.py

@@ -0,0 +1,66 @@
+from pathlib import Path
+from time import sleep
+
+import pytest
+
+import owasp_dt
+from common import load_env
+from lib.api import create_client_from_env, get_findings_by_project_uuid
+from owasp_dt.api.bom import upload_bom
+from owasp_dt.api.project import get_projects
+from owasp_dt.models import UploadBomBody, IsTokenBeingProcessedResponse
+from owasp_dt.api.event import is_token_being_processed_1
+
+__base_dir = Path(__file__).parent
+
+def setup_module():
+    load_env()
+
+__upload_token = None
+__project_id = None
+
+@pytest.fixture
+def client():
+    yield create_client_from_env()
+
+def test_upload_sbom(client: owasp_dt.Client):
+    global __upload_token
+    with open(__base_dir / "test.sbom.xml") as sbom_file:
+        resp = upload_bom.sync_detailed(client=client, body=UploadBomBody(
+            project_name="test-project",
+            auto_create=True,
+            bom=sbom_file.read()
+        ))
+        upload = resp.parsed
+        assert upload is not None, "API call failed. Check client permissions."
+        assert upload.token is not None
+        __upload_token = upload.token
+
+@pytest.mark.depends(on=['test_upload_sbom'])
+def test_get_scan_status(client: owasp_dt.Client):
+    max_tries = 10
+    i = 0
+    for i in range(max_tries):
+        resp = is_token_being_processed_1.sync_detailed(client=client, uuid=__upload_token)
+        status = resp.parsed
+        assert isinstance(status, IsTokenBeingProcessedResponse)
+        if not status.processing:
+            break
+        sleep(1)
+
+    assert i < max_tries, f"Scan not finished within {max_tries} seconds"
+
+
+@pytest.mark.depends(on=['test_upload_sbom'])
+def test_search_project_by_name(client: owasp_dt.Client):
+    global __project_id
+    resp = get_projects.sync_detailed(client=client, name="test-project")
+    projects = resp.parsed
+    assert len(projects) > 0
+    assert projects[0].uuid is not None
+    __project_id = projects[0].uuid
+
+@pytest.mark.depends(on=['test_search_project_by_name','test_get_scan_status'])
+def test_get_project_findings(client: owasp_dt.Client):
+    findings = get_findings_by_project_uuid(client=client, uuid=__project_id)
+    assert len(findings) > 0

owasp_dependency_track_cli-0.0.1/test/test_convert.py

@@ -0,0 +1,21 @@
+import subprocess
+from pathlib import Path
+import os
+
+import pytest
+
+__base_dir = Path(__file__).parent
+
+@pytest.mark.xfail(reason="Feature not implemented")
+def test_convert():
+    test_env = os.environ.copy()
+    file = __base_dir / "test.sbom.json"
+    ret = subprocess.run(
+        ["python", __base_dir / "../main.py", "convert", file],
+        capture_output=True,
+        text=True,
+        env=test_env
+    )
+    assert ret.returncode == 0
+    xml_file = file.parent / f"{file.stem}.xml"
+    assert xml_file.exists()

owasp_dependency_track_cli-0.0.1/test/test_test.py

@@ -0,0 +1,30 @@
+from pathlib import Path
+
+import httpx
+import pytest
+
+from common import load_env
+from lib.args import create_parser
+
+__base_dir = Path(__file__).parent
+
+def setup_module():
+    load_env()
+
+def test_test():
+    parser = create_parser()
+    args = parser.parse_args([
+        "test",
+        "--project-name",
+        "test-project",
+        "--auto-create",
+        "--latest",
+        str(__base_dir / "test.sbom.xml"),
+    ])
+
+    args.func(args)
+
+def test_proxy_fails(monkeypatch):
+    monkeypatch.setenv("HTTP_PROXY", "http://localhost:3128")
+    with pytest.raises(expected_exception=httpx.ConnectError):
+        test_test()