|
| 1 | +''' |
| 2 | +Created on October 12, 2023 |
| 3 | +@author: kumykov |
| 4 | +
|
| 5 | +Copyright (C) 2023 Synopsys, Inc. |
| 6 | +http://www.synopsys.com/ |
| 7 | +
|
| 8 | +Licensed to the Apache Software Foundation (ASF) under one |
| 9 | +or more contributor license agreements. See the NOTICE file |
| 10 | +distributed with this work for additional information |
| 11 | +regarding copyright ownership. The ASF licenses this file |
| 12 | +to you under the Apache License, Version 2.0 (the |
| 13 | +"License"); you may not use this file except in compliance |
| 14 | +with the License. You may obtain a copy of the License at |
| 15 | +
|
| 16 | +http://www.apache.org/licenses/LICENSE-2.0 |
| 17 | +
|
| 18 | +Unless required by applicable law or agreed to in writing, |
| 19 | +software distributed under the License is distributed on an |
| 20 | +"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| 21 | +KIND, either express or implied. See the License for the |
| 22 | +specific language governing permissions and limitations |
| 23 | +under the License. |
| 24 | +
|
| 25 | +This script is provided as an example of populating custom field data |
| 26 | +based on BOM components crypto information. |
| 27 | +The goal is to enable policy functionality that would be triggered by |
| 28 | +cryptographic features of a component. |
| 29 | +
|
| 30 | +The script will analyze ciphers included in a component and will set |
| 31 | +a BOM Component custom field value to reflect that a known weakness is present. |
| 32 | +
|
| 33 | +Requirements |
| 34 | +
|
| 35 | +- python3 version 3.8 or newer recommended |
| 36 | +- the following packages are used by the script and should be installed |
| 37 | + prior to use: |
| 38 | + argparse |
| 39 | + blackduck |
| 40 | + logging |
| 41 | + sys |
| 42 | + json |
| 43 | + pprint |
| 44 | +- Blackduck instance |
| 45 | +- API token with sufficient privileges to perform project version phase |
| 46 | + change. |
| 47 | +
|
| 48 | +Install python packages with the following command: |
| 49 | +
|
| 50 | + pip3 install argparse blackduck logging sys json pprint |
| 51 | +
|
| 52 | +Using |
| 53 | +
|
| 54 | +Script expects a boolean custom field labeled "BadCrypto" on a BOM Component. |
| 55 | +A policy that is triggered by BadCrypto custom field value used to visualize |
| 56 | +results. |
| 57 | +
|
| 58 | +usage: crypto-to-custom.py [-h] -u BASE_URL -t TOKEN_FILE -pn PROJECT_NAME -vn VERSION_NAME [-nv] [--reset] |
| 59 | +
|
| 60 | +options: |
| 61 | + -h, --help show this help message and exit |
| 62 | + -u BASE_URL, --base-url BASE_URL |
| 63 | + Hub server URL e.g. https://your.blackduck.url |
| 64 | + -t TOKEN_FILE, --token-file TOKEN_FILE |
| 65 | + File containing access token |
| 66 | + -pn PROJECT_NAME, --project-name PROJECT_NAME |
| 67 | + Project Name |
| 68 | + -vn VERSION_NAME, --version-name VERSION_NAME |
| 69 | + Version Name |
| 70 | + -nv, --no-verify Disable TLS certificate verification |
| 71 | + --reset Undo the changes made by this script |
| 72 | +
|
| 73 | +
|
| 74 | +''' |
| 75 | + |
| 76 | +import argparse |
| 77 | +from blackduck import Client |
| 78 | +from pprint import pprint |
| 79 | +import logging |
| 80 | +import sys |
| 81 | +import json |
| 82 | + |
| 83 | +logging.basicConfig(format='%(asctime)s:%(levelname)s:%(message)s', stream=sys.stderr, level=logging.DEBUG) |
| 84 | +logging.getLogger("requests").setLevel(logging.INFO) |
| 85 | +logging.getLogger("urllib3").setLevel(logging.INFO) |
| 86 | +logging.getLogger("blackduck").setLevel(logging.INFO) |
| 87 | + |
| 88 | +def find_project_by_name(project_name): |
| 89 | + params = { |
| 90 | + 'q': [f"name:{project_name}"] |
| 91 | + } |
| 92 | + projects = [p for p in bd.get_resource('projects', params=params) if p['name'] == project_name] |
| 93 | + if len(projects) == 1: |
| 94 | + return projects[0] |
| 95 | + else: |
| 96 | + return None |
| 97 | + |
| 98 | +def find_project_version_by_name(project, version_name): |
| 99 | + params = { |
| 100 | + 'q': [f"versionName:{version_name}"] |
| 101 | + } |
| 102 | + versions = [v for v in bd.get_resource('versions', project, params=params) if v['versionName'] == version_name] |
| 103 | + if len(versions) == 1: |
| 104 | + return versions[0] |
| 105 | + else: |
| 106 | + return None |
| 107 | + |
| 108 | +def parse_command_args(): |
| 109 | + |
| 110 | + parser = argparse.ArgumentParser("crypto-to-custom.py") |
| 111 | + parser.add_argument("-u", "--base-url", required=True, help="Hub server URL e.g. https://your.blackduck.url") |
| 112 | + parser.add_argument("-t", "--token-file", required=True, help="File containing access token") |
| 113 | + parser.add_argument("-pn", "--project-name", required=True, help="Project Name") |
| 114 | + parser.add_argument("-vn", "--version-name", required=True, help="Version Name") |
| 115 | + parser.add_argument("-nv", "--no-verify", action='store_false', help="Disable TLS certificate verification") |
| 116 | + parser.add_argument("--reset", action='store_true', help="Undo the changes made by this script") |
| 117 | + return parser.parse_args() |
| 118 | + |
| 119 | +def set_custom_field(field, url, value): |
| 120 | + payload = {"fields": [{"customField": field['_meta']['href'],"values": value}]} |
| 121 | + headers = {"Accept": "application/vnd.blackducksoftware.bill-of-materials-6+json", |
| 122 | + "Content-Type": "application/vnd.blackducksoftware.bill-of-materials-6+json"} |
| 123 | + response = bd.session.put(url, data=json.dumps(payload), headers=headers) |
| 124 | + print(response) |
| 125 | + |
| 126 | +def process_project_version(args): |
| 127 | + project = find_project_by_name(args.project_name) |
| 128 | + version = find_project_version_by_name(project, args.version_name) |
| 129 | + |
| 130 | + components = bd.get_resource('components',version) |
| 131 | + for component in components: |
| 132 | + print (component['componentName'], component['componentVersionName']) |
| 133 | + custom_fields = bd.get_resource('custom-fields',component, items=False) |
| 134 | + custom_fields_url = custom_fields['_meta']['href'] |
| 135 | + c = [x for x in custom_fields['items'] if x['label'] == 'BadCrypto'][0] |
| 136 | + resources = bd.list_resources(component) |
| 137 | + if 'crypto-algorithms' in resources.keys(): |
| 138 | + crypto_algorithms = bd.get_resource('crypto-algorithms', component) |
| 139 | + for crypto in crypto_algorithms: |
| 140 | + if crypto['knownWeaknesses']: |
| 141 | + pprint('Has Weakness') |
| 142 | + value = ['true'] |
| 143 | + if args.reset: |
| 144 | + value = [] |
| 145 | + set_custom_field(c, custom_fields_url, value=value) |
| 146 | + break |
| 147 | + |
| 148 | +def main(): |
| 149 | + args = parse_command_args() |
| 150 | + with open(args.token_file, 'r') as tf: |
| 151 | + access_token = tf.readline().strip() |
| 152 | + global bd |
| 153 | + bd = Client(base_url=args.base_url, token=access_token, verify=args.no_verify, timeout=60.0, retries=4) |
| 154 | + |
| 155 | + process_project_version(args) |
| 156 | + |
| 157 | +if __name__ == "__main__": |
| 158 | + sys.exit(main()) |
| 159 | + |
0 commit comments