socketsecurity 0.0.69__tar.gz → 0.0.71__tar.gz

{socketsecurity-0.0.69/socketsecurity.egg-info → socketsecurity-0.0.71}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: socketsecurity
-Version: 0.0.69
+Version: 0.0.71
 Summary: Socket Security CLI for CI/CD
 Author-email: Douglas Coburn <douglas@socket.dev>
 Maintainer-email: Douglas Coburn <douglas@socket.dev>

{socketsecurity-0.0.69 → socketsecurity-0.0.71}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "socketsecurity"
-version = "0.0.69"
+version = "0.0.71"
 requires-python = ">= 3.9"
 dependencies = [
     'requests',

{socketsecurity-0.0.69 → socketsecurity-0.0.71}/socketsecurity/core/__init__.py

@@ -25,7 +25,7 @@ import time
 
 
 __author__ = 'socket.dev'
-__version__ = '0.0.69'
+__version__ = '0.0.71'
 __all__ = [
     "Core",
     "log",
@@ -246,6 +246,55 @@ class Core:
                 }
         return org_rules
 
+    # @staticmethod
+    # def get_supported_file_types() -> dict:
+    #     path = "report/supported"
+
+    @staticmethod
+    def get_manifest_files(package: Package, packages: dict) -> str:
+        if package.direct:
+            manifests = []
+            for manifest_item in package.manifestFiles:
+                manifest = manifest_item["file"]
+                manifests.append(manifest)
+            manifest_files = ";".join(manifests)
+        else:
+            manifests = []
+            for top_id in package.topLevelAncestors:
+                top_package: Package
+                top_package = packages[top_id]
+                for manifest_item in top_package.manifestFiles:
+                    manifest = manifest_item["file"]
+                    new_string = f"{package.name}@{package.version}({manifest})"
+                    manifests.append(new_string)
+            manifest_files = ";".join(manifests)
+        return manifest_files
+
+    @staticmethod
+    def create_sbom_output(diff: Diff) -> list:
+        sbom = []
+        for package_id in diff.packages:
+            package: Package
+            package = diff.packages[package_id]
+            manifest_files = Core.get_manifest_files(package, diff.packages)
+            item = {
+                "id": package.id,
+                "license": package.license,
+                "license_text": package.license_text,
+                "manifestFiles": manifest_files,
+                "score": package.score,
+                "size": package.size,
+                "ecosystem": package.type,
+                "alerts": package.alerts,
+                "direct": package.direct,
+                "name": package.name,
+                "version": package.version,
+                "author": package.author,
+                "url": package.url
+            }
+            sbom.append(item)
+        return sbom
+
     @staticmethod
     def find_files(path: str) -> list:
         """
@@ -314,8 +363,8 @@ class Core:
                 "requirements.frozen": {
                     "pattern": "requirements.frozen"
                 },
-                "setup.py.old": {
-                    "pattern": "setup.py.old"
+                "setup.py": {
+                    "pattern": "setup.py"
                 }
             },
             "golang": {

{socketsecurity-0.0.69 → socketsecurity-0.0.71}/socketsecurity/core/github.py

@@ -163,19 +163,27 @@ class Github:
         return event_type
 
     @staticmethod
-    def add_socket_comments(security_comment: str, overview_comment: str, comments: dict) -> None:
+    def add_socket_comments(
+            security_comment: str,
+            overview_comment: str,
+            comments: dict,
+            new_security_comment: bool = True,
+            new_overview_comment: bool = True
+    ) -> None:
         existing_overview_comment = comments.get("overview")
         existing_security_comment = comments.get("security")
-        if existing_overview_comment is not None:
-            existing_overview_comment: GithubComment
-            Github.update_comment(overview_comment, str(existing_overview_comment.id))
-        else:
-            Github.post_comment(overview_comment)
-        if existing_security_comment is not None:
-            existing_security_comment: GithubComment
-            Github.update_comment(security_comment, str(existing_security_comment.id))
-        else:
-            Github.post_comment(security_comment)
+        if new_overview_comment:
+            if existing_overview_comment is not None:
+                existing_overview_comment: GithubComment
+                Github.update_comment(overview_comment, str(existing_overview_comment.id))
+            else:
+                Github.post_comment(overview_comment)
+        if new_security_comment:
+            if existing_security_comment is not None:
+                existing_security_comment: GithubComment
+                Github.update_comment(security_comment, str(existing_security_comment.id))
+            else:
+                Github.post_comment(security_comment)
 
     @staticmethod
     def post_comment(body: str) -> None:

{socketsecurity-0.0.69 → socketsecurity-0.0.71}/socketsecurity/core/gitlab.py

@@ -159,19 +159,27 @@ class Gitlab:
         return event_type
 
     @staticmethod
-    def add_socket_comments(security_comment: str, overview_comment: str, comments: dict) -> None:
+    def add_socket_comments(
+            security_comment: str,
+            overview_comment: str,
+            comments: dict,
+            new_security_comment: bool = True,
+            new_overview_comment: bool = True
+    ) -> None:
         existing_overview_comment = comments.get("overview")
         existing_security_comment = comments.get("security")
-        if existing_overview_comment is not None:
-            existing_overview_comment: GitlabComment
-            Gitlab.update_comment(overview_comment, str(existing_overview_comment.id))
-        else:
-            Gitlab.post_comment(overview_comment)
-        if existing_security_comment is not None:
-            existing_security_comment: GitlabComment
-            Gitlab.update_comment(security_comment, str(existing_security_comment.id))
-        else:
-            Gitlab.post_comment(security_comment)
+        if new_overview_comment:
+            if existing_overview_comment is not None:
+                existing_overview_comment: GitlabComment
+                Gitlab.update_comment(overview_comment, str(existing_overview_comment.id))
+            else:
+                Gitlab.post_comment(overview_comment)
+        if new_security_comment:
+            if existing_security_comment is not None:
+                existing_security_comment: GitlabComment
+                Gitlab.update_comment(security_comment, str(existing_security_comment.id))
+            else:
+                Gitlab.post_comment(security_comment)
 
     @staticmethod
     def post_comment(body: str) -> None:

{socketsecurity-0.0.69 → socketsecurity-0.0.71}/socketsecurity/socketcli.py

@@ -69,6 +69,20 @@ parser.add_argument(
     required=False
 )
 
+parser.add_argument(
+    '--sbom-file',
+    default=None,
+    help='If soecified save the SBOM details to the specified file',
+    required=False
+)
+
+parser.add_argument(
+    '--commit-sha',
+    default="",
+    help='Optional git commit sha',
+    required=False
+)
+
 parser.add_argument(
     '--generate-license',
     default=False,
@@ -115,6 +129,8 @@ def cli():
     pr_number = arguments.pr_number
     target_path = arguments.target_path
     scm_type = arguments.scm
+    commit_sha = arguments.commit_sha
+    sbom_file = arguments.sbom_file
     license_mode = arguments.generate_license
     license_file = f"{repo}"
     if branch is not None:
@@ -137,6 +153,7 @@ def cli():
         scm = Gitlab()
     if scm is not None:
         default_branch = scm.is_default_branch
+
     base_api_url = os.getenv("BASE_API_URL") or None
     core = Core(token=api_token, request_timeout=6000, base_api_url=base_api_url)
     set_as_pending_head = False
@@ -146,7 +163,7 @@ def cli():
         repo=repo,
         branch=branch,
         commit_message=commit_message,
-        commit_hash="",
+        commit_hash=commit_sha,
         pull_request=pr_number,
         committers=committer,
         make_default_branch=default_branch,
@@ -166,7 +183,19 @@ def cli():
             diff.new_alerts = scm.remove_alerts(comments, diff.new_alerts)
             overview_comment = Messages.dependency_overview_template(diff)
             security_comment = Messages.security_comment_template(diff)
-            scm.add_socket_comments(security_comment, overview_comment, comments)
+            new_security_comment = True
+            new_overview_comment = True
+            if len(diff.new_alerts) == 0:
+                new_security_comment = False
+            if len(diff.new_packages) == 0 and diff.removed_packages == 0:
+                new_overview_comment = False
+            scm.add_socket_comments(
+                security_comment,
+                overview_comment,
+                comments,
+                new_security_comment,
+                new_overview_comment
+            )
         output_console_comments(diff)
     else:
         log.info("API Mode")
@@ -190,6 +219,8 @@ def cli():
             }
             all_packages[package_id] = output
         core.save_file(license_file, json.dumps(all_packages))
+    if diff is not None and sbom_file is not None:
+        core.save_file(sbom_file, json.dumps(core.create_sbom_output(diff)))
 
 
 if __name__ == '__main__':

{socketsecurity-0.0.69 → socketsecurity-0.0.71/socketsecurity.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: socketsecurity
-Version: 0.0.69
+Version: 0.0.71
 Summary: Socket Security CLI for CI/CD
 Author-email: Douglas Coburn <douglas@socket.dev>
 Maintainer-email: Douglas Coburn <douglas@socket.dev>