github.com/vchain-us/vcn@v0.9.11-0.20210921212052-a2484d23c0b3/pkg/cmd/verify/bom.go

/*
 * Copyright (c) 2018-2020 vChain, Inc. All Rights Reserved.
 * This software is released under GPL3.
 * The full license information can be found under:
 * https://www.gnu.org/licenses/gpl-3.0.en.html
 *
 */

package verify

import (
	"context"
	"encoding/json"
	"fmt"
	"path/filepath"
	"strconv"
	"strings"

	"github.com/schollz/progressbar/v3"
	"github.com/spf13/viper"
	"google.golang.org/grpc/metadata"

	immuschema "github.com/codenotary/immudb/pkg/api/schema"
	"github.com/vchain-us/vcn/pkg/api"
	"github.com/vchain-us/vcn/pkg/bom"
	"github.com/vchain-us/vcn/pkg/bom/artifact"
	"github.com/vchain-us/vcn/pkg/bom/docker"
	"github.com/vchain-us/vcn/pkg/meta"
	"github.com/vchain-us/vcn/pkg/uri"
)

var trustLevelMap = map[string]artifact.TrustLevel{
	"trusted":     artifact.Trusted,
	"t":           artifact.Trusted,
	"unknown":     artifact.Unknown,
	"unk":         artifact.Unknown,
	"uk":          artifact.Unknown,
	"unsupported": artifact.Unsupported,
	"uns":         artifact.Unsupported,
	"us":          artifact.Unsupported,
	"untrusted":   artifact.Untrusted,
	"unt":         artifact.Untrusted,
	"ut":          artifact.Untrusted,
}

var bomTrustLevelToMeta = map[artifact.TrustLevel]meta.Status{
	artifact.Untrusted:   meta.StatusUntrusted,
	artifact.Unsupported: meta.StatusUnsupported,
	artifact.Unknown:     meta.StatusUnknown,
	artifact.Trusted:     meta.StatusTrusted,
}

func processBOM(lcUser *api.LcUser, signerID, output, hash, path string) (artifact.Artifact, error) {
	trustLevel, ok := trustLevelMap[viper.GetString("bom-trust-level")]
	if !ok {
		return nil, fmt.Errorf("invalid BoM trust level, supported values are trusted/unknown/unsupported/untrusted")
	}

	outputOpts := artifact.Progress
	if viper.GetBool("silent") || output != "" {
		outputOpts = artifact.Silent
	} else if viper.GetBool("bom-debug") {
		outputOpts = artifact.Debug
	}

	var bomArtifact artifact.Artifact
	var deps []artifact.Dependency
	var err error
	if hash != "" {
		// hash specified or found by name/version - resolve dependencies from DB
		bomArtifact, err = loadBomFromDb(hash, signerID, lcUser)
		if err != nil {
			return nil, err
		}
		deps = bomArtifact.Dependencies()
	} else {
		// resolve dependencies from the asset
		u, err := uri.Parse(path)
		if err != nil {
			return nil, err
		}
		if _, ok := bom.BomSchemes[u.Scheme]; !ok {
			return nil, fmt.Errorf("unsupported URI %s for --bom option", path)
		}
		if u.Scheme != "" {
			path = strings.TrimPrefix(u.Opaque, "//")
		}
		if u.Scheme == "docker" {
			bomArtifact, err = docker.New(path, viper.GetStringSlice("bom-container-binary"))
			if err != nil {
				return nil, err
			}
		} else {
			path, err = filepath.Abs(path)
			if err != nil {
				return nil, err
			}
			bomArtifact = bom.New(path)
		}
		if bomArtifact == nil {
			return nil, fmt.Errorf("unsupported artifact format/language")
		}
		if signerID == "" {
			signerID = api.GetSignerIDByApiKey(lcUser.Client.ApiKey)
		}

		if outputOpts != artifact.Silent {
			fmt.Printf("Resolving dependencies...\n")
		}
		deps, err = bomArtifact.ResolveDependencies(outputOpts)
		if err != nil {
			return nil, fmt.Errorf("cannot get dependencies: %w", err)
		}
	}

	if outputOpts != artifact.Silent {
		fmt.Printf("Authenticating dependencies...\n")
	}
	threshold := viper.GetFloat64("bom-max-unsupported")
	unsupportedCount := 0
	failed := false

	var bar *progressbar.ProgressBar
	if len(deps) > 1 && output == "" && outputOpts == artifact.Progress {
		bar = progressbar.Default(int64(len(deps)))
	}

	progressCallback := func(processedDeps []artifact.Dependency) {
		switch outputOpts {
		case artifact.Progress:
			if bar != nil {
				bar.Add(len(processedDeps))
			}
		case artifact.Debug:
			for _, d := range processedDeps {
				fmt.Printf("%s@%s (%s) - %s\n", d.Name, d.Version, d.Hash, artifact.TrustLevelName(d.TrustLevel))
			}
		}
	}

	bomBatchSize := int(viper.GetUint("bom-batch-size"))

	errs, err := artifact.AuthenticateDependencies(lcUser, signerID, deps, bomBatchSize, progressCallback)
	if err != nil {
		return nil, fmt.Errorf("error authenticating dependencies: %w", err)
	}

	lowestLevel := artifact.Trusted
	for i := range deps { // Authenticate mutates the dependency, so use the index
		if errs[i] != nil {
			fmt.Printf("cannot authenticate %s@%s dependency: %v\n",
				deps[i].SignerID, deps[i].Version, errs[i])
			continue
		}
		if deps[i].TrustLevel < trustLevel {
			if deps[i].TrustLevel < lowestLevel {
				lowestLevel = deps[i].TrustLevel
			}
			if deps[i].TrustLevel == artifact.Unsupported || deps[i].TrustLevel == artifact.Unknown {
				unsupportedCount++
			} else {
				failed = true // keep going - process all
			}
		}
	}
	if outputOpts != artifact.Silent {
		artifact.Display(bomArtifact, artifact.ColNameVersion|artifact.ColHash|artifact.ColTrustLevel)
	}
	if threshold < 100 && unsupportedCount > int(float64(len(deps))*threshold/100) {
		failed = true // keep going - user still may need output files
	}

	// store deps in bom file for further processing
	if bomFile := viper.GetString("bom-file"); bomFile != "" {
		err = artifact.Store(bomArtifact, bomFile)
		if err != nil {
			// show warning, but not error, because authentication finished
			fmt.Printf("Cannot store actual BoM: %v", err)
		}
	}

	err = bom.Output(bomArtifact)
	if err != nil {
		// show warning, but not error, because authentication finished
		fmt.Println(err)
	}

	if failed {
		viper.Set("exit-code", strconv.Itoa(bomTrustLevelToMeta[lowestLevel].Int()))
		return nil, fmt.Errorf("some dependencies have insufficient trust level")
	}

	return bomArtifact, nil
}

func GetIncluded(hash string, signerID string, lcUser *api.LcUser) ([]api.PackageDetails, error) {
	md := metadata.Pairs(meta.VcnLCPluginTypeHeaderName, meta.VcnLCPluginTypeHeaderValue)
	ctx := metadata.NewOutgoingContext(context.Background(), md)
	if signerID == "" {
		signerID = api.GetSignerIDByApiKey(lcUser.Client.ApiKey)
	}

	zItems, err := lcUser.Client.ZScan(ctx, &immuschema.ZScanRequest{
		Set:    []byte("includes_vcn." + signerID + "." + hash),
		NoWait: true,
	})
	if err != nil {
		return nil, err
	}
	res := make([]api.PackageDetails, 0, len(zItems.Entries))
	for _, v := range zItems.Entries {
		var p pkg
		err := json.Unmarshal(v.Entry.Value, &p)
		if err != nil {
			fmt.Printf("cannot parse JSON: %v\n", err)
			continue
		}
		res = append(res, api.PackageDetails{
			Name:    p.Name,
			Version: p.Md.Version,
			Hash:    p.Hash,
			Status:  meta.Status(p.Status),
		})
	}
	return res, nil
}

func loadBomFromDb(hash string, signerID string, lcUser *api.LcUser) (artifact.Artifact, error) {
	md := metadata.Pairs(meta.VcnLCPluginTypeHeaderName, meta.VcnLCPluginTypeHeaderValue)
	ctx := metadata.NewOutgoingContext(context.Background(), md)
	if signerID == "" {
		signerID = api.GetSignerIDByApiKey(lcUser.Client.ApiKey)
	}

	ar, err := artifact.LoadFromDb(hash, signerID, lcUser)
	if err != nil {
		return nil, err
	}

	zItems, err := lcUser.Client.ZScan(ctx, &immuschema.ZScanRequest{
		Set:    []byte("included_by_vcn." + signerID + "." + hash),
		NoWait: true,
	})
	if err != nil {
		return nil, err
	}

	trustLevelMap := map[meta.Status]artifact.TrustLevel{
		meta.StatusUntrusted:   artifact.Untrusted,
		meta.StatusUnsupported: artifact.Unsupported,
		meta.StatusUnknown:     artifact.Unknown,
		meta.StatusTrusted:     artifact.Trusted,
	}

	deps := make([]artifact.Dependency, 0, len(zItems.Entries))
	for _, v := range zItems.Entries {
		var p pkg
		err := json.Unmarshal(v.Entry.Value, &p)
		if err != nil {
			fmt.Printf("cannot parse JSON: %v\n", err)
			continue
		}
		level, ok := trustLevelMap[meta.Status(p.Status)]
		if !ok {
			level = artifact.Unknown
		}
		deps = append(deps, artifact.Dependency{
			Name:       p.Name,
			Version:    p.Md.Version,
			SignerID:   signerID,
			HashType:   artifact.HashTypeByName(p.Md.HashType),
			Hash:       p.Hash,
			TrustLevel: level,
			Kind:       p.Kind,
		})
	}
	ar.Deps = deps

	return ar, nil
}

func DepsToPackageDetails(deps []artifact.Dependency) []api.PackageDetails {
	res := make([]api.PackageDetails, 0, len(deps))
	for _, deps := range deps {
		res = append(res, api.PackageDetails{
			Name:    deps.Name,
			Version: deps.Version,
			Hash:    deps.Hash,
			Status:  bomTrustLevelToMeta[deps.TrustLevel],
			License: deps.License,
		})
	}
	return res
}