github.com/vchain-us/vcn@v0.9.11-0.20210921212052-a2484d23c0b3/pkg/bom/python/python.go

/*
 * Copyright (c) 2021 CodeNotary, Inc. All Rights Reserved.
 * This software is released under GPL3.
 * The full license information can be found under:
 * https://www.gnu.org/licenses/gpl-3.0.en.html
 *
 */

package python

import (
	"encoding/hex"
	"encoding/json"
	"errors"
	"io/ioutil"
	"net/http"
	"os"
	"path/filepath"
	"strings"

	"github.com/vchain-us/vcn/pkg/bom/artifact"
)

const AssetType = "python"

// pythonArtifact implements Artifact interface
type pythonArtifact struct {
	artifact.GenericArtifact
	path string
}

type pypiResponse struct {
	Info  pypiInfo   `json:"info"`
	Files []pypiFile `json:"urls"`
}

type pypiInfo struct {
	License string `json:"license"`
}

type pypiFile struct {
	Digests pypiDigests `json:"digests"`
}

type pypiDigests struct {
	Md5    string `json:"md5,omitempty"`
	Sha256 string `json:"sha256,omitempty"`
}

const (
	pipenvFileName = "Pipfile.lock"
	poetryFileName = "poetry.lock"
	pipFileName    = "requirements.txt"
	pypiApiPrefix  = "https://pypi.org/pypi/"
)

// New returns new Artifact, or nil if the path doesn't point to directory with Python package
func New(path string) artifact.Artifact {
	fi, err := os.Stat(path)
	if err != nil {
		return nil
	}
	if fi.IsDir() {
		_, err := os.Stat(filepath.Join(path, pipenvFileName))
		if err == nil {
			return &pythonArtifactFromPipEnv{pythonArtifact: pythonArtifact{path: path}}
		}
		_, err = os.Stat(filepath.Join(path, poetryFileName))
		if err == nil {
			return &pythonArtifactFromPoetry{pythonArtifact: pythonArtifact{path: path}}
		}
		_, err = os.Stat(filepath.Join(path, pipFileName))
		if err == nil {
			return &pythonArtifactFromPip{pythonArtifact: pythonArtifact{path: path}}
		}
	} else {
		filename := filepath.Base(path)
		path = filepath.Dir(path)
		switch filename {
		case pipenvFileName:
			return &pythonArtifactFromPipEnv{pythonArtifact: pythonArtifact{path: path}}
		case poetryFileName:
			return &pythonArtifactFromPoetry{pythonArtifact: pythonArtifact{path: path}}
		case pipFileName:
			return &pythonArtifactFromPip{pythonArtifact: pythonArtifact{path: path}}
		}
	}

	return nil
}

func (p pythonArtifact) Type() string {
	return AssetType
}

func (p pythonArtifact) Path() string {
	return p.path
}

// combine multiple hashes into single hash by XORing them. Return Base16-encoded hash
// hash entry has a form of "<hash_type>:<base16-encoded hash>", where "<hash_type>:" is optional
func CombineHashes(hashes []string) (string, artifact.HashType, error) {
	if len(hashes) == 0 {
		return "", artifact.HashInvalid, nil
	}
	hashType := artifact.HashInvalid
	var res []byte
	for _, v := range hashes {
		fields := strings.SplitN(v, ":", 2)
		hash := fields[0]
		if len(fields) >= 2 {
			hash = fields[1]
			switch fields[0] {
			case "sha1":
				hashType = artifact.HashSHA1
			case "sha256":
				hashType = artifact.HashSHA256
			case "md5":
				hashType = artifact.HashMD5
			}
		}
		comp, err := hex.DecodeString(hash)
		if err != nil {
			return "", artifact.HashInvalid, errors.New("malformed hash value")
		}
		if res == nil {
			res = comp
		} else {
			if len(comp) != len(res) {
				// should never happen - all hashes must be of the same length
				return "", artifact.HashInvalid, errors.New("malformed hash value")
			}
			// XOR hash
			for i := 0; i < len(res); i++ {
				res[i] ^= comp[i]
			}
		}
	}

	return hex.EncodeToString(res), hashType, nil
}

// query PyPI.org for module license and hash, combine all available hashes using XOR
func QueryPkgDetails(name, version string) (string, artifact.HashType, string, error) {
	resp, err := http.Get(pypiApiPrefix + name + "/" + version + "/json")
	if err != nil {
		return "", artifact.HashInvalid, "", err
	}
	defer resp.Body.Close()
	if resp.StatusCode != http.StatusOK {
		return "", artifact.HashInvalid, "", errors.New("cannot query PyPI for package details")
	}
	body, err := ioutil.ReadAll(resp.Body)
	if err != nil {
		return "", artifact.HashInvalid, "", err
	}

	var rsp pypiResponse
	err = json.Unmarshal(body, &rsp)
	if err != nil {
		return "", artifact.HashInvalid, "", err
	}

	// assuming that all files have the same type of hash, with priority for SHA-256
	hashType := artifact.HashMD5
	if rsp.Files[0].Digests.Sha256 != "" {
		hashType = artifact.HashSHA256
	}
	hashes := make([]string, len(rsp.Files))
	for i, file := range rsp.Files {
		if hashType == artifact.HashSHA256 {
			hashes[i] = file.Digests.Sha256
		} else {
			hashes[i] = file.Digests.Md5
		}
	}

	hash, _, err := CombineHashes(hashes)
	if err != nil {
		return "", artifact.HashInvalid, "", errors.New("malformed hash value")
	}

	return rsp.Info.License, hashType, hash, nil
}