-
Notifications
You must be signed in to change notification settings - Fork 9
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Add sbom command * Add SBOM generation as flag to scan command * Add format flag * Put CLI binary in root as well on make install and correctly specify that enterprise is required for SBOM export * Update goreleaser to latest version * go mod tidying --------- Co-authored-by: Oscar Reimer <[email protected]>
- Loading branch information
1 parent
28d8144
commit 684f2eb
Showing
18 changed files
with
721 additions
and
38 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,94 @@ | ||
| package sbom | ||
|
|
||
| import ( | ||
| "fmt" | ||
|
|
||
| "github.com/debricked/cli/internal/report" | ||
| "github.com/debricked/cli/internal/report/sbom" | ||
| "github.com/fatih/color" | ||
| "github.com/spf13/cobra" | ||
| "github.com/spf13/viper" | ||
| ) | ||
|
|
||
| var commitId string | ||
| var repositoryId string | ||
| var branch string | ||
| var format string | ||
| var vulnerabilities bool | ||
| var licenses bool | ||
| var output string | ||
|
|
||
| const CommitFlag = "commit" | ||
| const RepositorylFlag = "repository" | ||
| const TokenFlag = "token" | ||
| const BranchFlag = "branch" | ||
| const VulnerabilitiesFlag = "vulnerabilities" | ||
| const LicensesFlag = "licenses" | ||
| const OutputFlag = "output" | ||
| const FormatFlag = "format" | ||
|
|
||
| func NewSBOMCmd(reporter report.IReporter) *cobra.Command { | ||
| cmd := &cobra.Command{ | ||
| Use: "sbom", | ||
| Short: "Generate SBOM report", | ||
| Long: `Generate SBOM report for chosen commit and repository. | ||
| For an example of the SBOM format see https://github.com/debricked/blog-snippets/blob/main/example-sbom-report/SBOM_2022-12-14.json. | ||
| This is an enterprise feature. Please visit https://debricked.com/pricing/ for more info.`, | ||
| PreRun: func(cmd *cobra.Command, _ []string) { | ||
| _ = viper.BindPFlags(cmd.Flags()) | ||
| }, | ||
| RunE: RunE(reporter), | ||
| } | ||
|
|
||
| cmd.Flags().StringVarP(&commitId, CommitFlag, "c", "", "The commit that you want an SBOM report for") | ||
| _ = cmd.MarkFlagRequired(CommitFlag) | ||
| viper.MustBindEnv(CommitFlag) | ||
|
|
||
| cmd.Flags().StringVarP(&repositoryId, RepositorylFlag, "r", "", "The repository that you want an SBOM report for") | ||
| _ = cmd.MarkFlagRequired(RepositorylFlag) | ||
| viper.MustBindEnv(RepositorylFlag) | ||
|
|
||
| cmd.Flags().StringVarP(&branch, BranchFlag, "b", "", "The branch that you want an SBOM report for") | ||
| viper.MustBindEnv(BranchFlag) | ||
|
|
||
| cmd.Flags().StringVarP(&format, FormatFlag, "f", "", `The format that you want the SBOM report in. | ||
| Supported options are: 'CycloneDX', 'SPDX'`, | ||
| ) | ||
| viper.MustBindEnv(FormatFlag) | ||
|
|
||
| cmd.Flags().BoolVar(&vulnerabilities, VulnerabilitiesFlag, true, "Toggle SBOM vulnerability data inclusion") | ||
| viper.MustBindEnv(VulnerabilitiesFlag) | ||
|
|
||
| cmd.Flags().BoolVar(&licenses, LicensesFlag, true, "Toggle SBOM license data inclusion") | ||
| viper.MustBindEnv(LicensesFlag) | ||
|
|
||
| cmd.Flags().StringVarP(&output, OutputFlag, "o", "", `Set output path for downloaded SBOM json file. | ||
| If no output path is set the file is created in the format <repository_id>-<commit_id>.sbom.json`, | ||
| ) | ||
| viper.MustBindEnv(OutputFlag) | ||
|
|
||
| return cmd | ||
| } | ||
|
|
||
| func RunE(r report.IReporter) func(_ *cobra.Command, args []string) error { | ||
| return func(_ *cobra.Command, _ []string) error { | ||
| orderArgs := sbom.OrderArgs{ | ||
| RepositoryID: viper.GetString(RepositorylFlag), | ||
| CommitID: viper.GetString(CommitFlag), | ||
| Branch: viper.GetString(BranchFlag), | ||
| Vulnerabilities: viper.GetBool(VulnerabilitiesFlag), | ||
| Licenses: viper.GetBool(LicensesFlag), | ||
| Output: viper.GetString(OutputFlag), | ||
| Format: viper.GetString(FormatFlag), | ||
| } | ||
|
|
||
| if err := r.Order(orderArgs); err != nil { | ||
| return fmt.Errorf("%s %s", color.RedString("⨯"), err.Error()) | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| package sbom | ||
|
|
||
| import ( | ||
| "errors" | ||
| "testing" | ||
|
|
||
| "github.com/debricked/cli/internal/cmd/report/testdata" | ||
| "github.com/debricked/cli/internal/report" | ||
| "github.com/spf13/viper" | ||
| "github.com/stretchr/testify/assert" | ||
| ) | ||
|
|
||
| func TestNewSBOMCmd(t *testing.T) { | ||
| var r report.IReporter | ||
| cmd := NewSBOMCmd(r) | ||
| commands := cmd.Commands() | ||
| nbrOfCommands := 0 | ||
| assert.Len(t, commands, nbrOfCommands) | ||
|
|
||
| viperKeys := viper.AllKeys() | ||
| flags := cmd.Flags() | ||
| flagAssertions := map[string]string{ | ||
| CommitFlag: "c", | ||
| RepositorylFlag: "r", | ||
| } | ||
| for name, shorthand := range flagAssertions { | ||
| flag := flags.Lookup(name) | ||
| assert.NotNil(t, flag) | ||
| assert.Equalf(t, shorthand, flag.Shorthand, "failed to assert that %s flag shorthand %s was set correctly", name, shorthand) | ||
|
|
||
| match := false | ||
| for _, key := range viperKeys { | ||
| if key == name { | ||
| match = true | ||
| } | ||
| } | ||
| assert.Truef(t, match, "failed to assert that %s was present", name) | ||
| } | ||
| } | ||
|
|
||
| func TestRunEError(t *testing.T) { | ||
| reporterMock := testdata.NewReporterMock() | ||
| reporterMock.SetError(errors.New("")) | ||
| runeE := RunE(reporterMock) | ||
|
|
||
| err := runeE(nil, nil) | ||
|
|
||
| assert.ErrorContains(t, err, "⨯") | ||
| } | ||
|
|
||
| func TestRunE(t *testing.T) { | ||
| reporterMock := testdata.NewReporterMock() | ||
| runeE := RunE(reporterMock) | ||
|
|
||
| err := runeE(nil, nil) | ||
|
|
||
| assert.NoError(t, err) | ||
| } | ||
|
|
||
| func TestPreRun(t *testing.T) { | ||
| cmd := NewSBOMCmd(nil) | ||
| cmd.PreRun(cmd, nil) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.