socketsecurity 0.0.48__tar.gz → 0.0.56__tar.gz

socketsecurity-0.0.56/PKG-INFO

@@ -0,0 +1,22 @@
+Metadata-Version: 2.1
+Name: socketsecurity
+Version: 0.0.56
+Summary: Socket Security CLI for CI/CD
+Author-email: Douglas Coburn <douglas@socket.dev>
+Maintainer-email: Douglas Coburn <douglas@socket.dev>
+Project-URL: Homepage, https://socket.dev
+Keywords: socketsecurity,socket.dev,sca,oss,security
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Requires-Dist: requests
+Requires-Dist: mdutils
+Requires-Dist: prettytable
+Requires-Dist: argparse
+
+# Socket Security CLI

socketsecurity-0.0.56/README.md

@@ -0,0 +1 @@
+# Socket Security CLI

socketsecurity-0.0.56/pyproject.toml

@@ -0,0 +1,43 @@
+[build-system]
+requires = ["setuptools >= 61.0"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "socketsecurity"
+version = "0.0.56"
+requires-python = ">= 3.9"
+dependencies = [
+    'requests',
+    'mdutils',
+    'prettytable',
+    'argparse'
+]
+readme = "README.md"
+description = "Socket Security CLI for CI/CD"
+keywords = ["socketsecurity", "socket.dev", "sca", "oss", "security"]
+authors = [
+    {name = "Douglas Coburn", email = "douglas@socket.dev"}
+]
+maintainers = [
+    {name = "Douglas Coburn", email = "douglas@socket.dev"}
+]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3.9",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+]
+
+[project.scripts]
+socketcli = "socketsecurity.socketcli:cli"
+
+[project.urls]
+Homepage = "https://socket.dev"
+
+[tool.setuptools.packages.find]
+include = [
+    "socketsecurity",
+    "socketsecurity.core"
+]

{socketsecurity-0.0.48 → socketsecurity-0.0.56}/socketsecurity/__init__.py

@@ -1,2 +1,2 @@
 __author__ = 'socket.dev'
-__version__ = '0.0.48'
+__version__ = '0.0.56'

{socketsecurity-0.0.48 → socketsecurity-0.0.56}/socketsecurity/core/__init__.py

@@ -3,10 +3,10 @@ import requests
 from urllib.parse import urlencode
 import base64
 import json
-from core.exceptions import APIFailure, APIKeyMissing, APIAccessDenied, APIInsufficientQuota, APIResourceNotFound
-from core.licenses import Licenses
-from core.issues import AllIssues
-from core.classes import (
+from socketsecurity.core.exceptions import APIFailure, APIKeyMissing, APIAccessDenied, APIInsufficientQuota, APIResourceNotFound
+from socketsecurity.core.licenses import Licenses
+from socketsecurity.core.issues import AllIssues
+from socketsecurity.core.classes import (
     Report,
     Issue,
     Package,
@@ -23,10 +23,11 @@ import time
 
 
 __author__ = 'socket.dev'
-__version__ = '0.0.48'
+__version__ = '0.0.56'
 __all__ = [
     "Core",
-    "log"
+    "log",
+    "__version__"
 ]
 
 
@@ -40,7 +41,6 @@ all_issues = AllIssues()
 org_id = None
 org_slug = None
 all_new_alerts = False
-issue_file = "core/issues.json"
 security_policy = {}
 log = logging.getLogger("socketdev")
 log.addHandler(logging.NullHandler())
@@ -309,8 +309,8 @@ class Core:
                 "requirements.frozen": {
                     "pattern": "requirements.frozen"
                 },
-                "setup.py": {
-                    "pattern": "setup.py"
+                "setup.py.old": {
+                    "pattern": "setup.py.old"
                 }
             },
             "golang": {
@@ -430,7 +430,7 @@ class Core:
                 head_full_scan = Core.get_sbom_data(head_full_scan_id)
                 head_end = time.time()
                 total_head_time = head_end - head_start
-                print(f"Total time to get head sbom {total_head_time: .2f}")
+                print(f"Total time to get head full-scan {total_head_time: .2f}")
         except APIResourceNotFound:
             head_full_scan = []
         if files is not None and len(files) > 0:
@@ -439,7 +439,7 @@ class Core:
             new_full_scan.packages = Core.create_sbom_dict(new_full_scan.sbom_artifacts)
             new_scan_end = time.time()
             total_new_time = new_scan_end - new_scan_start
-            print(f"Total time to get new sbom {total_new_time: .2f}")
+            print(f"Total time to get new full-scan {total_new_time: .2f}")
             diff_report = Core.compare_sboms(new_full_scan.sbom_artifacts, head_full_scan)
             diff_report.packages = new_full_scan.packages
         else:

{socketsecurity-0.0.48 → socketsecurity-0.0.56}/socketsecurity/core/classes.py

@@ -367,3 +367,35 @@ class GithubComment:
     def __str__(self):
         return json.dumps(self.__dict__)
 
+
+class GitlabComment:
+    id: int
+    type: str
+    body: str
+    attachment: str
+    author: dict
+    created_at: str
+    updated_at: str
+    system: bool
+    notable_id: int
+    noteable_type: str
+    project_id: int
+    resolvable: bool
+    confidential: bool
+    internal: bool
+    imported: bool
+    imported_from: str
+    noteable_iid: int
+    commands_changes: dict
+    body_list: list
+
+    def __init__(self, **kwargs):
+        if kwargs:
+            for key, value in kwargs.items():
+                setattr(self, key, value)
+        if not hasattr(self, "body_list"):
+            self.body_list = []
+
+    def __str__(self):
+        return json.dumps(self.__dict__)
+

{socketsecurity-0.0.48 → socketsecurity-0.0.56}/socketsecurity/core/github.py

@@ -1,9 +1,9 @@
 import json
 import os
-from core import log
+from socketsecurity.core import log
 import requests
-from core.exceptions import *
-from core.classes import GithubComment, Diff, Issue
+from socketsecurity.core.exceptions import *
+from socketsecurity.core.classes import GithubComment, Diff, Issue
 import sys
 
 
@@ -122,6 +122,7 @@ class Github:
     committer: str
     github_env: str
     api_token: str
+    project_id: int
 
     def __init__(self):
         self.commit_sha = github_sha
@@ -132,7 +133,7 @@ class Github:
         self.repository = github_repository
         if "/" in self.repository:
             self.repository = self.repository.rsplit("/")[1]
-        self.ref_name = github_ref_name
+        self.branch = github_ref_name
         self.default_branch = default_branch
         self.is_default_branch = is_default_branch
         self.pr_number = pr_number
@@ -141,6 +142,7 @@ class Github:
         self.committer = github_actor
         self.github_env = github_env
         self.api_token = gh_api_token
+        self.project_id = 0
         if self.api_token is None:
             print("Unable to get Github API Token from GH_API_TOKEN")
             sys.exit(2)

{socketsecurity-0.0.48 → socketsecurity-0.0.56}/socketsecurity/core/glitlab.py

@@ -1,58 +1,53 @@
 import json
 import os
-from core import log
+from socketsecurity.core import log
 import requests
-from core.exceptions import *
-from core.classes import GithubComment, Diff, Issue
+from socketsecurity.core.exceptions import *
+from socketsecurity.core.classes import GitlabComment, Diff, Issue
+import sys
 
 
-global github_sha
-global github_api_url
-global github_ref_type
-global github_event_name
-global github_workspace
-global github_repository
-global github_ref_name
-global github_actor
-global default_branch
-global github_env
-global pr_number
+global ci_commit_sha
+global ci_api_v4_url
+global ci_project_dir
+global ci_commit_branch
+global ci_merge_request_iid
+global ci_merge_request_project_id
+global ci_commit_message
+global ci_default_branch
+global ci_project_name
+global ci_pipeline_source
+global ci_commit_author
+global project_dir
 global pr_name
 global is_default_branch
-global commit_message
 global committer
-global gh_api_token
-global github_repository_owner
+global gitlab_token
 
 
-github_variables = [
+
+gitlab_variables = [
     "CI_COMMIT_SHA",
-    "GITHUB_API_URL",
-    "GITHUB_REF_TYPE",
-    "GITHUB_EVENT_NAME",
-    "GITHUB_WORKSPACE",
-    "GITHUB_REPOSITORY",
+    "CI_API_V4_URL",
+    "CI_PROJECT_DIR",
     "CI_COMMIT_BRANCH",
+    "CI_MERGE_REQUEST_IID",
+    "CI_MERGE_REQUEST_PROJECT_ID",
+    "CI_COMMIT_MESSAGE",
+    "CI_DEFAULT_BRANCH",
+    "CI_PROJECT_NAME",
+    "CI_PIPELINE_SOURCE",
+    "CI_COMMIT_AUTHOR",
+    "PROJECT_DIR",
     "DEFAULT_BRANCH",
-    "PR_NUMBER",
     "PR_NAME",
-    "COMMIT_MESSAGE",
-    "GITHUB_ACTOR",
-    "GITHUB_ENV",
-    "GH_API_TOKEN",
-    "GITHUB_REPOSITORY_OWNER"
+    "GITLAB_TOKEN",
 ]
 
 
-for env in github_variables:
+for env in gitlab_variables:
     var_name = env.lower()
     globals()[var_name] = os.getenv(env) or None
-    if var_name == "default_branch":
-        global is_default_branch
-        if default_branch is None or default_branch.lower() == "false":
-            is_default_branch = False
-        else:
-            is_default_branch = True
 
 
 def do_request(
@@ -72,16 +67,16 @@ def do_request(
     :param method: Optional method to use, defaults to GET
     :return:
     """
-    if gh_api_token is None or gh_api_token == "":
+    if gitlab_token is None or gitlab_token == "":
         raise APIKeyMissing
 
     if headers is None:
         headers = {
-            'Authorization': f"Bearer {gh_api_token}",
+            'Authorization': f"Bearer {gitlab_token}",
             'User-Agent': 'SocketPythonScript/0.0.1',
             "accept": "application/json"
         }
-    url = f"{github_api_url}/{path}"
+    url = f"{ci_api_v4_url}/{path}"
     response = requests.request(
         method.upper(),
         url,
@@ -114,49 +109,52 @@ class Gitlab:
     event_name: str
     workspace: str
     repository: str
-    ref_name: str
+    branch: str
     default_branch: str
     is_default_branch: bool
     pr_number: int
     pr_name: str
     commit_message: str
     committer: str
-    github_env: str
     api_token: str
+    project_id: int
 
     def __init__(self):
-        self.commit_sha = github_sha
-        self.api_url = github_api_url
-        self.ref_type = github_ref_type
-        self.event_name = github_event_name
-        self.workspace = github_workspace
-        self.repository = github_repository
+        self.commit_sha = ci_commit_sha
+        self.api_url = ci_api_v4_url
+        self.ref_type = ""
+        self.event_name = ci_pipeline_source
+        self.workspace = project_dir
+        self.repository = ci_project_name
         if "/" in self.repository:
             self.repository = self.repository.rsplit("/")[1]
-        self.ref_name = github_ref_name
-        self.default_branch = default_branch
-        self.is_default_branch = is_default_branch
-        self.pr_number = pr_number
+        self.branch = ci_commit_branch
+        self.default_branch = ci_default_branch
+        if self.branch == self.default_branch:
+            self.is_default_branch = True
+        else:
+            self.is_default_branch = False
+        self.pr_number = ci_merge_request_iid
         self.pr_name = pr_name
-        self.commit_message = commit_message
-        self.committer = github_actor
-        self.github_env = github_env
-        self.api_token = gh_api_token
+        self.commit_message = ci_commit_message
+        self.committer = ci_commit_author
+        self.api_token = gitlab_token
+        self.project_id = ci_merge_request_project_id
         if self.api_token is None:
-            print("Unable to get Github API Token from GH_API_TOKEN")
+            print("Unable to get gitlab API Token from GH_API_TOKEN")
             sys.exit(2)
 
     @staticmethod
     def check_event_type() -> str:
-        if github_event_name.lower() == "push":
-            if pr_number is None or pr_number == "":
+        if ci_pipeline_source.lower() == "push":
+            if ci_merge_request_iid is None or ci_merge_request_iid == "":
                 event_type = "main"
             else:
                 event_type = "diff"
-        elif github_event_name.lower() == "issue_comment":
+        elif ci_pipeline_source.lower() == "issue_comment":
             event_type = "comment"
         else:
-            log.error(f"Unknown event type {github_event_name}")
+            log.error(f"Unknown event type {ci_pipeline_source}")
             sys.exit(1)
         return event_type
 
@@ -165,20 +163,19 @@ class Gitlab:
         existing_overview_comment = comments.get("overview")
         existing_security_comment = comments.get("security")
         if existing_overview_comment is not None:
-            existing_overview_comment: GithubComment
-            Github.update_comment(overview_comment, str(existing_overview_comment.id))
+            existing_overview_comment: GitlabComment
+            Gitlab.update_comment(overview_comment, str(existing_overview_comment.id))
         else:
-            Github.post_comment(overview_comment)
+            Gitlab.post_comment(overview_comment)
         if existing_security_comment is not None:
-            existing_security_comment: GithubComment
-            Github.update_comment(security_comment, str(existing_security_comment.id))
+            existing_security_comment: GitlabComment
+            Gitlab.update_comment(security_comment, str(existing_security_comment.id))
         else:
-            Github.post_comment(security_comment)
+            Gitlab.post_comment(security_comment)
 
     @staticmethod
     def post_comment(body: str) -> None:
-        repo = github_repository.rsplit("/", 1)[1]
-        path = f"repos/{github_repository_owner}/{repo}/issues/{pr_number}/comments"
+        path = f"projects/{ci_merge_request_project_id}/merge_requests/{ci_merge_request_iid}/notes"
         payload = {
             "body": body
         }
@@ -187,8 +184,7 @@ class Gitlab:
 
     @staticmethod
     def update_comment(body: str, comment_id: str) -> None:
-        repo = github_repository.rsplit("/", 1)[1]
-        path = f"repos/{github_repository_owner}/{repo}/issues/comments/{comment_id}"
+        path = f"projects/{ci_merge_request_project_id}/merge_requests/{ci_merge_request_iid}/notes/{comment_id}"
         payload = {
             "body": body
         }
@@ -196,26 +192,19 @@ class Gitlab:
         do_request(path, payload=payload, method="PATCH")
 
     @staticmethod
-    def write_new_env(name: str, content: str) -> None:
-        file = open(github_env, "a")
-        new_content = content.replace("\n", "\\n")
-        env_output = f"{name}={new_content}"
-        file.write(env_output)
-
-    @staticmethod
-    def get_comments_for_pr(repo: str, pr: str) -> dict:
-        path = f"repos/{github_repository_owner}/{repo}/issues/{pr}/comments"
+    def get_comments_for_pr() -> dict:
+        path = f"projects/{ci_merge_request_project_id}/merge_requests/{ci_merge_request_iid}/notes"
         raw_comments = do_request(path)
         comments = {}
-        if "error" not in raw_comments:
+        if "message" not in raw_comments:
             for item in raw_comments:
-                comment = GithubComment(**item)
+                comment = GitlabComment(**item)
                 comments[comment.id] = comment
                 for line in comment.body.split("\n"):
                     comment.body_list.append(line)
         else:
             log.error(raw_comments)
-        socket_comments = Github.check_for_socket_comments(comments)
+        socket_comments = Gitlab.check_for_socket_comments(comments)
         return socket_comments
 
     @staticmethod
@@ -223,7 +212,7 @@ class Gitlab:
         socket_comments = {}
         for comment_id in comments:
             comment = comments[comment_id]
-            comment: GithubComment
+            comment: GitlabComment
             if "socket-security-comment-actions" in comment.body:
                 socket_comments["security"] = comment
             elif "socket-overview-comment-actions" in comment.body:
@@ -239,7 +228,7 @@ class Gitlab:
         alerts = []
         if "ignore" not in comments:
             return new_alerts
-        ignore_all, ignore_commands = Github.get_ignore_options(comments)
+        ignore_all, ignore_commands = Gitlab.get_ignore_options(comments)
         for alert in new_alerts:
             alert: Issue
             if ignore_all:
@@ -260,7 +249,7 @@ class Gitlab:
         ignore_all = False
 
         for comment in comments["ignore"]:
-            comment: GithubComment
+            comment: GitlabComment
             first_line = comment.body_list[0]
             if not ignore_all and "SocketSecurity ignore" in first_line:
                 first_line = first_line.lstrip("@")
@@ -286,9 +275,9 @@ class Gitlab:
     def remove_comment_alerts(comments: dict):
         security_alert = comments.get("security")
         if security_alert is not None:
-            security_alert: GithubComment
-            new_body = Github.process_security_comment(security_alert, comments)
-            Github.update_comment(new_body, str(security_alert.id))
+            security_alert: GitlabComment
+            new_body = Gitlab.process_security_comment(security_alert, comments)
+            Gitlab.update_comment(new_body, str(security_alert.id))
 
     @staticmethod
     def is_heading_line(line) -> bool:
@@ -298,22 +287,22 @@ class Gitlab:
         return is_heading_line
 
     @staticmethod
-    def process_security_comment(comment: GithubComment, comments) -> str:
+    def process_security_comment(comment: GitlabComment, comments) -> str:
         lines = []
         start = False
-        ignore_all, ignore_commands = Github.get_ignore_options(comments)
+        ignore_all, ignore_commands = Gitlab.get_ignore_options(comments)
         for line in comment.body_list:
             line = line.strip()
             if "start-socket-alerts-table" in line:
                 start = True
-            elif start and "end-socket-alerts-table" not in line and not Github.is_heading_line(line) and line != '':
+            elif start and "end-socket-alerts-table" not in line and not Gitlab.is_heading_line(line) and line != '':
                 title, package, introduced_by, manifest = line.lstrip("|").rstrip("|").split("|")
                 details, _ = package.split("](")
                 ecosystem, details = details.split("/", 1)
                 pkg_name, pkg_version = details.split("@")
                 ignore = False
                 for name, version in ignore_commands:
-                    if ignore_all or Github.is_ignore(pkg_name, pkg_version, name, version):
+                    if ignore_all or Gitlab.is_ignore(pkg_name, pkg_version, name, version):
                         ignore = True
                 if not ignore:
                     lines.append(line)

{socketsecurity-0.0.48 → socketsecurity-0.0.56}/socketsecurity/core/messages.py

@@ -1,5 +1,5 @@
 from mdutils import MdUtils
-from core.classes import Diff, Purl, Issue
+from socketsecurity.core.classes import Diff, Purl, Issue
 from prettytable import PrettyTable
 
 

{socketsecurity-0.0.48 → socketsecurity-0.0.56}/socketsecurity/socketcli.py

@@ -1,9 +1,8 @@
 import argparse
 import json
-
-from core import Core, version
-from core.classes import FullScanParams, Diff, Package
-from core.messages import Messages
+from socketsecurity.core import Core, __version__
+from socketsecurity.core.classes import FullScanParams, Diff, Package
+from socketsecurity.core.messages import Messages
 import os
 import sys
 
@@ -68,7 +67,7 @@ parser.add_argument(
     '--scm',
     default='api',
     help='Integration mode choices are api, github, gitlab, and bitbucket',
-    choices=["api", "github"],
+    choices=["api", "github", "gitlab"],
     required=False
 )
 
@@ -79,6 +78,14 @@ parser.add_argument(
     required=False
 )
 
+parser.add_argument(
+    '-v',
+    '--version',
+    action="version",
+    version=f'%(prog)s 0.0.55',
+    help='Display the version',
+)
+
 
 def output_console_comments(diff_report) -> None:
     console_security_comment = Messages.create_console_security_alert_table(diff_report)
@@ -116,11 +123,14 @@ def cli():
     if repo is None:
         print("Repo name needs to be set")
         sys.exit(2)
-    print(f"Starting Socket Security Scan version {version}")
+    print(f"Starting Socket Security Scan version {__version__}")
     scm = None
     if scm_type == "github":
-        from core.github import Github
+        from socketsecurity.core.github import Github
         scm = Github()
+    elif scm_type == 'gitlab':
+        from socketsecurity.core.glitlab import Gitlab
+        scm = Gitlab()
     base_api_url = os.getenv("BASE_API_URL") or None
     core = Core(token=api_token, request_timeout=6000, base_api_url=base_api_url)
     set_as_pending_head = False

socketsecurity-0.0.56/socketsecurity.egg-info/PKG-INFO

@@ -0,0 +1,22 @@
+Metadata-Version: 2.1
+Name: socketsecurity
+Version: 0.0.56
+Summary: Socket Security CLI for CI/CD
+Author-email: Douglas Coburn <douglas@socket.dev>
+Maintainer-email: Douglas Coburn <douglas@socket.dev>
+Project-URL: Homepage, https://socket.dev
+Keywords: socketsecurity,socket.dev,sca,oss,security
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Requires-Dist: requests
+Requires-Dist: mdutils
+Requires-Dist: prettytable
+Requires-Dist: argparse
+
+# Socket Security CLI

{socketsecurity-0.0.48 → socketsecurity-0.0.56}/socketsecurity.egg-info/SOURCES.txt

@@ -1,4 +1,5 @@
-setup.py
+README.md
+pyproject.toml
 socketsecurity/__init__.py
 socketsecurity/socketcli.py
 socketsecurity.egg-info/PKG-INFO

socketsecurity-0.0.48/PKG-INFO

@@ -1,8 +0,0 @@
-Metadata-Version: 2.1
-Name: socketsecurity
-Version: 0.0.48
-Requires-Python: >3.10.1
-Requires-Dist: requests
-Requires-Dist: mdutils
-Requires-Dist: prettytable
-Requires-Dist: argparse

socketsecurity-0.0.48/setup.py

@@ -1,18 +0,0 @@
-from setuptools import setup, find_packages
-
-setup(
-   name='socketsecurity',
-   version='0.0.48',
-   python_requires='>3.10.1',
-   packages=find_packages(),
-   install_requires=[
-      'requests',
-      'mdutils',
-      'prettytable',
-      'argparse'
-   ],
-   entry_points='''
-      [console_scripts]
-      socketcli=socketsecurity.socketcli:cli
-      ''',
-)

socketsecurity-0.0.48/socketsecurity.egg-info/PKG-INFO

@@ -1,8 +0,0 @@
-Metadata-Version: 2.1
-Name: socketsecurity
-Version: 0.0.48
-Requires-Python: >3.10.1
-Requires-Dist: requests
-Requires-Dist: mdutils
-Requires-Dist: prettytable
-Requires-Dist: argparse