wn/dtrack-defectdojo-automation
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

code styling
Some checks failed
ci/woodpecker/push/woodpecker Pipeline failed
Details

Browse Source
This commit is contained in:
Wolfgang Hottgenroth
2025-07-30 09:08:33 +02:00
parent 98035fe59c
commit 955937dea7
3 changed files with 249 additions and 137 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/prepare-local-env.sh
View File

@@ -45,3 +45,5 @@ python3 -m venv .venv
pip install -r requirements.txt
pip install -r $LOCALLBIS/dependencytrack-client/requirements.txt
pip install -r $LOCALLBIS/defectdojo-client/requirements.txt

189
src/sbom_dt_dd.py
View File

@@ -1,5 +1,6 @@
import os
import sys
import subprocess
from loguru import logger
import json
@@ -7,8 +8,8 @@ import json
import datetime
from dateutil.relativedelta import relativedelta
sys.path.insert(0, os.path.join(os.path.dirname(__file__), 'defectdojo-client'))
sys.path.insert(0, os.path.join(os.path.dirname(__file__), 'dependencytrack-client'))
sys.path.insert(0, os.path.join(os.path.dirname(__file__), "defectdojo-client"))
sys.path.insert(0, os.path.join(os.path.dirname(__file__), "dependencytrack-client"))
import defectdojo_api
from defectdojo_api.rest import ApiException as DefectDojoApiException
@@ -16,6 +17,7 @@ from defectdojo_api.rest import ApiException as DefectDojoApiException
import dependencytrack_api
from dependencytrack_api.rest import ApiException as DependencyTrackApiException
class ApiException(Exception):
def __init__(self, cause):
self.cause = cause
@@ -25,11 +27,14 @@ class ApiException(Exception):
self.data = cause.data
self.headers = cause.headers
class ApiCallExecutor:
def __init__(self, verbose):
self.verbose = verbose
def innerExecuteApiCall(self, ApiClass, EndpointMethod, RequestClass, requestParams, additionalParams):
def innerExecuteApiCall(
self, ApiClass, EndpointMethod, RequestClass, requestParams, additionalParams
):
logger.info(f"Calling {ApiClass=}.{EndpointMethod=} with {RequestClass=})")
if self.verbose:
logger.debug(f"{additionalParams=}, {requestParams=}")
@@ -42,38 +47,57 @@ class ApiCallExecutor:
logger.info(f"Response is {response}")
return response
class DefectDojoApiClient(defectdojo_api.ApiClient, ApiCallExecutor):
def __init__(self, config, verbose):
defectdojo_api.ApiClient.__init__(self, config)
ApiCallExecutor.__init__(self, verbose)
def executeApiCall(self, ApiClass, EndpointMethod, RequestClass, requestParams, additionalParams):
def executeApiCall(
self, ApiClass, EndpointMethod, RequestClass, requestParams, additionalParams
):
try:
return self.innerExecuteApiCall(ApiClass, EndpointMethod, RequestClass, requestParams, additionalParams)
return self.innerExecuteApiCall(
ApiClass, EndpointMethod, RequestClass, requestParams, additionalParams
)
except defectdojo_api.exceptions.ApiException as e:
raise ApiException(e)
class DependencyTrackApiClient(dependencytrack_api.ApiClient, ApiCallExecutor):
def __init__(self, config, verbose):
dependencytrack_api.ApiClient.__init__(self, config)
ApiCallExecutor.__init__(self, verbose)
def executeApiCall(self, ApiClass, EndpointMethod, RequestClass, requestParams, additionalParams):
def executeApiCall(
self, ApiClass, EndpointMethod, RequestClass, requestParams, additionalParams
):
try:
return self.innerExecuteApiCall(ApiClass, EndpointMethod, RequestClass, requestParams, additionalParams)
return self.innerExecuteApiCall(
ApiClass, EndpointMethod, RequestClass, requestParams, additionalParams
)
except dependencytrack_api.exceptions.ApiException as e:
raise ApiException(e)
def generateSBOM(target='.', name='dummyName', version='0.0.0'):
def generateSBOM(target=".", name="dummyName", version="0.0.0"):
try:
result = subprocess.run(
["syft", "scan", target, "-o", "cyclonedx-json", "--source-name", name, "--source-version", version],
[
"syft",
"scan",
target,
"-o",
"cyclonedx-json@1.5",
"--source-name",
name,
"--source-version",
version,
],
check=True,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
text=True
text=True,
)
sbom = json.loads(result.stdout)
return sbom
@@ -82,28 +106,39 @@ def generateSBOM(target='.', name='dummyName', version='0.0.0'):
raise MyLocalException(e)
def loadToDTrackAndDefectDojo(config, projectName, projectVersion, projectClassifier, projectDescription, productType, sbom, reImport):
def loadToDTrackAndDefectDojo(
config,
projectName,
projectVersion,
projectClassifier,
projectDescription,
productType,
sbom,
reImport,
):
# ------- create product and engagement in DefectDojo -------
if not reImport:
# in case of a reimport no modification on DefectDojo are required
defectdojo_configuration = defectdojo_api.Configuration(
host = config['DEFECTDOJO_URL']
host=config["DEFECTDOJO_URL"]
)
defectdojo_configuration.api_key['tokenAuth'] = config['DEFECTDOJO_TOKEN']
defectdojo_configuration.api_key_prefix['tokenAuth'] = 'Token'
defectdojo_configuration.api_key["tokenAuth"] = config["DEFECTDOJO_TOKEN"]
defectdojo_configuration.api_key_prefix["tokenAuth"] = "Token"
with DefectDojoApiClient(defectdojo_configuration, config['VERBOSE']) as client:
with DefectDojoApiClient(defectdojo_configuration, config["VERBOSE"]) as client:
print("Create product in DefectDojo")
productName = f"{projectName}:{projectVersion}"
product_response = \
client.executeApiCall(
defectdojo_api.ProductsApi,
defectdojo_api.ProductsApi.products_create,
defectdojo_api.ProductRequest,
{ 'name': productName, 'description': projectDescription, 'prod_type': productType },
[]
)
product_response = client.executeApiCall(
defectdojo_api.ProductsApi,
defectdojo_api.ProductsApi.products_create,
defectdojo_api.ProductRequest,
{
"name": productName,
"description": projectDescription,
"prod_type": productType,
},
[],
)
product_id = product_response.id
print(f"{product_id=}")
@@ -112,48 +147,71 @@ def loadToDTrackAndDefectDojo(config, projectName, projectVersion, projectClassi
start_time = datetime.date.today()
end_time = start_time + relativedelta(years=10)
engagementName = f"{productName} DTrack Link"
engagement_response = \
client.executeApiCall(
defectdojo_api.EngagementsApi,
defectdojo_api.EngagementsApi.engagements_create,
defectdojo_api.EngagementRequest,
{ 'name': engagementName, 'target_start': start_time, 'target_end': end_time, 'status': 'In Progress', 'product': product_id },
[]
)
engagement_response = client.executeApiCall(
defectdojo_api.EngagementsApi,
defectdojo_api.EngagementsApi.engagements_create,
defectdojo_api.EngagementRequest,
{
"name": engagementName,
"target_start": start_time,
"target_end": end_time,
"status": "In Progress",
"product": product_id,
},
[],
)
engagement_id = engagement_response.id
print(f"{engagement_id=}")
# ------- create project in DependencyTrack, connect project to engagement in DefectDojo, upload SBOM --------
# ------- create project in DependencyTrack, connect project to engagement in DefectDojo, upload SBOM --------
dependencytrack_configuration = dependencytrack_api.Configuration(
host = f"{config['DTRACK_API_URL']}/api"
host=f"{config['DTRACK_API_URL']}/api"
)
dependencytrack_configuration.debug = False
dependencytrack_configuration.api_key['ApiKeyAuth'] = config['DTRACK_TOKEN']
dependencytrack_configuration.api_key["ApiKeyAuth"] = config["DTRACK_TOKEN"]
with DependencyTrackApiClient(dependencytrack_configuration, config['VERBOSE']) as client:
with DependencyTrackApiClient(
dependencytrack_configuration, config["VERBOSE"]
) as client:
if not reImport:
# in case of a reimport it is not necessary to create the project
project_response = \
client.executeApiCall(
dependencytrack_api.ProjectApi,
dependencytrack_api.ProjectApi.create_project,
dependencytrack_api.Project,
{ 'name': projectName, 'version': projectVersion, 'classifier': projectClassifier, 'uuid': "", 'last_bom_import': 0 },
[]
)
project_response = client.executeApiCall(
dependencytrack_api.ProjectApi,
dependencytrack_api.ProjectApi.create_project,
dependencytrack_api.Project,
{
"name": projectName,
"version": projectVersion,
"classifier": projectClassifier,
"uuid": "",
"last_bom_import": 0,
},
[],
)
project_uuid = project_response.uuid
print(f"{project_uuid=}")
properties = [
{ 'group_name': "integrations", 'property_name': "defectdojo.engagementId",
'property_value': str(engagement_id), 'property_type': "STRING" },
{ 'group_name': "integrations", 'property_name': "defectdojo.doNotReactivate",
'property_value': "true", 'property_type': "BOOLEAN" },
{ 'group_name': "integrations", 'property_name': "defectdojo.reimport",
'property_value': "true", 'property_type': "BOOLEAN" }
{
"group_name": "integrations",
"property_name": "defectdojo.engagementId",
"property_value": str(engagement_id),
"property_type": "STRING",
},
{
"group_name": "integrations",
"property_name": "defectdojo.doNotReactivate",
"property_value": "true",
"property_type": "BOOLEAN",
},
{
"group_name": "integrations",
"property_name": "defectdojo.reimport",
"property_value": "true",
"property_type": "BOOLEAN",
},
]
for property in properties:
client.executeApiCall(
@@ -161,15 +219,24 @@ def loadToDTrackAndDefectDojo(config, projectName, projectVersion, projectClassi
dependencytrack_api.ProjectPropertyApi.create_property1,
dependencytrack_api.ProjectProperty,
property,
[ project_uuid ]
[project_uuid],
)
bom_response = \
client.executeApiCall(
dependencytrack_api.BomApi,
dependencytrack_api.BomApi.upload_bom,
bom_response = client.executeApiCall(
dependencytrack_api.BomApi,
dependencytrack_api.BomApi.upload_bom,
None,
None,
[
None,
False,
projectName,
projectVersion,
None,
None,
[ None, False, projectName, projectVersion, None, None, None, None, True, sbom ]
)
None,
None,
True,
sbom,
],
)

195
src/sbom_dt_dd_cli.py
View File

@@ -2,72 +2,102 @@ import os
import sys
from loguru import logger
import argparse
import subprocess
import json
from converter import minimalSbomFormatConverter
from sbom_dt_dd import generateSBOM, loadToDTrackAndDefectDojo
class CliException(Exception):
pass
# ---- main starts here with preparation of config -----------------------------------------------------------------------
parser = argparse.ArgumentParser(description='sbom-dt-dd glue logic')
parser.add_argument('--name', '-n',
help='Project Name',
required=False,
default=''),
parser.add_argument('--version', '-v',
help='Project Version',
required=False,
default='')
parser.add_argument('--description', '-d',
help='Project Description',
required=False,
default='')
parser.add_argument('--type', '-t',
help='Product Type from DefectDojo',
type=int,
required=True)
parser.add_argument('--classifier', '-c',
help='Project Classifier from DependencyTrack',
choices=['APPLICATION', 'FRAMEWORK', 'LIBRARY', 'CONTAINER', 'OPERATING_SYSTEM', 'DEVICE',
'FIRMWARE', 'FILE', 'PLATFORM', 'DEVICE_DRIVER', 'MACHINE_LEARNING_MODEL', 'DATA'],
required=False,
default='')
parser.add_argument('--uploadsbom', '-U',
help='Upload a already existing SBOM instead of generating it. Give the SBOM file at -F instead of a target',
required=False,
action='store_true',
default=False)
parser.add_argument('--sbomfile', '-F',
help='Filename of existing SBOM file to upload, use together with -U, do not use together with -T',
required=False)
parser.add_argument('--minimalsbomformat', '-K',
help='SBOM file comes in dedicated minimal format and will be converted into cyclonedx before uploading',
action='store_true',
default=False)
parser.add_argument('--overwritemetadata', '-O',
help='Overwrite name, version, description and classifier with data from minimal SBOM',
action='store_true',
default=False)
parser.add_argument('--target', '-T',
help='Target to scan, either path name for sources or docker image tag',
required=False)
parser.add_argument('--reimport', '-R',
help='Import the SBOM for an existing project/product once again',
required=False,
action='store_true',
default=False)
parser.add_argument('--verbose', '-V',
help='A lot of debug output',
required=False,
action='store_true',
default=False)
parser = argparse.ArgumentParser(description="sbom-dt-dd glue logic")
parser.add_argument("--name", "-n", help="Project Name", required=False, default="")
parser.add_argument(
"--version", "-v", help="Project Version", required=False, default=""
)
parser.add_argument(
"--description", "-d", help="Project Description", required=False, default=""
)
parser.add_argument(
"--type", "-t", help="Product Type from DefectDojo", type=int, required=True
)
parser.add_argument(
"--classifier",
"-c",
help="Project Classifier from DependencyTrack",
choices=[
"APPLICATION",
"FRAMEWORK",
"LIBRARY",
"CONTAINER",
"OPERATING_SYSTEM",
"DEVICE",
"FIRMWARE",
"FILE",
"PLATFORM",
"DEVICE_DRIVER",
"MACHINE_LEARNING_MODEL",
"DATA",
],
required=False,
default="",
)
parser.add_argument(
"--uploadsbom",
"-U",
help="Upload a already existing SBOM instead of generating it. Give the SBOM file at -F instead of a target",
required=False,
action="store_true",
default=False,
)
parser.add_argument(
"--sbomfile",
"-F",
help="Filename of existing SBOM file to upload, use together with -U, do not use together with -T",
required=False,
)
parser.add_argument(
"--minimalsbomformat",
"-K",
help="SBOM file comes in dedicated minimal format and will be converted into cyclonedx before uploading",
action="store_true",
default=False,
)
parser.add_argument(
"--overwritemetadata",
"-O",
help="Overwrite name, version, description and classifier with data from minimal SBOM",
action="store_true",
default=False,
)
parser.add_argument(
"--target",
"-T",
help="Target to scan, either path name for sources or docker image tag",
required=False,
)
parser.add_argument(
"--reimport",
"-R",
help="Import the SBOM for an existing project/product once again",
required=False,
action="store_true",
default=False,
)
parser.add_argument(
"--verbose",
"-V",
help="A lot of debug output",
required=False,
action="store_true",
default=False,
)
args = parser.parse_args()
projectName = args.name
projectVersion = args.version
@@ -77,41 +107,48 @@ projectClassifier = args.classifier
reImport = args.reimport
uploadSbomFlag = args.uploadsbom
if uploadSbomFlag:
sbomFileName = args.sbomfile
minimalSbomFormat = args.minimalsbomformat
else:
target = args.target
sbomFileName = args.sbomfile
minimalSbomFormat = args.minimalsbomformat
target = args.target
if minimalSbomFormat:
overwriteMetadata = args.overwritemetadata
overwriteMetadata = args.overwritemetadata
if not overwriteMetadata and not (projectName and projectVersion and projectClassifier and projectDescription):
raise MyLocalException("If overwriteMetadata is not selected, projectName, projectVersion, projectClassifier and projectDescription must be set.")
if not overwriteMetadata and not (
projectName and projectVersion and projectClassifier and projectDescription
):
raise CliException(
"If overwriteMetadata is not selected, projectName, projectVersion, projectClassifier and projectDescription must be set."
)
CONFIG = {}
try:
CONFIG['DTRACK_API_URL'] = os.environ["DTRACK_API_URL"]
CONFIG['DTRACK_TOKEN'] = os.environ["DTRACK_TOKEN"]
CONFIG['DEFECTDOJO_URL'] = os.environ["DEFECTDOJO_URL"]
CONFIG['DEFECTDOJO_TOKEN'] = os.environ["DEFECTDOJO_TOKEN"]
CONFIG["DTRACK_API_URL"] = os.environ["DTRACK_API_URL"]
CONFIG["DTRACK_TOKEN"] = os.environ["DTRACK_TOKEN"]
CONFIG["DEFECTDOJO_URL"] = os.environ["DEFECTDOJO_URL"]
CONFIG["DEFECTDOJO_TOKEN"] = os.environ["DEFECTDOJO_TOKEN"]
except KeyError as e:
raise Exception(f"Env variable {e} is shall be set")
raise CliException(f"Env variable {e} is shall be set") from e
CONFIG['VERBOSE'] = args.verbose
CONFIG["VERBOSE"] = args.verbose
# ---- main starts here --------------------------------------------------------------------------------------------------
if uploadSbomFlag:
# ------- read uploaded SBOM -------------
logger.info(f"Reading SBOM from file {sbomFileName}")
with open(sbomFileName, 'r') as sbomFile:
with open(sbomFileName, "r") as sbomFile:
sbom = sbomFile.read()
logger.info("SBOM file read.")
if minimalSbomFormat:
logger.info("Start converting from minimal format into cyclonedx")
(sbom, nameFromMinimalSbom, versionFromMinimalSbom, classifierFromMinimalSbom, descriptionFromMinimalSbom) = minimalSbomFormatConverter(sbom)
(
sbom,
nameFromMinimalSbom,
versionFromMinimalSbom,
classifierFromMinimalSbom,
descriptionFromMinimalSbom,
) = minimalSbomFormatConverter(sbom)
logger.info("Converted")
if overwriteMetadata:
projectName = nameFromMinimalSbom
@@ -127,7 +164,13 @@ else:
logger.info("Done.")
loadToDTrackAndDefectDojo(CONFIG, projectName, projectVersion, projectClassifier, projectDescription, productType, sbom, reImport)
loadToDTrackAndDefectDojo(
CONFIG,
projectName,
projectVersion,
projectClassifier,
projectDescription,
productType,
sbom,
reImport,
)