-
Notifications
You must be signed in to change notification settings - Fork 566
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: add options for snyk sbom (#4877)
This adds more options for ecosystems yarn, python. * --yarn-workspaces * --command * --skip-unresolved * --package-manager
- Loading branch information
1 parent
79f125d
commit 102e77b
Showing
7 changed files
with
174 additions
and
8 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| some-package-that-only-exists-in-a-private-repository==0.0.1 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,102 @@ | ||
| import * as os from 'os'; | ||
|
|
||
| import { createProjectFromWorkspace } from '../../util/createProject'; | ||
| import { runSnykCLI } from '../../util/runSnykCLI'; | ||
| import { fakeServer } from '../../../acceptance/fake-server'; | ||
|
|
||
| jest.setTimeout(1000 * 60 * 5); | ||
|
|
||
| describe('snyk sbom --command (mocked server only)', () => { | ||
| let server; | ||
| let env: Record<string, string>; | ||
|
|
||
| beforeAll( | ||
| () => | ||
| new Promise((res) => { | ||
| const port = process.env.PORT || process.env.SNYK_PORT || '58588'; | ||
| const baseApi = '/api/v1'; | ||
| env = { | ||
| ...process.env, | ||
| SNYK_API: 'http://localhost:' + port + baseApi, | ||
| SNYK_HOST: 'http://localhost:' + port, | ||
| SNYK_TOKEN: '123456789', | ||
| SNYK_DISABLE_ANALYTICS: '1', | ||
| }; | ||
| server = fakeServer(baseApi, env.SNYK_TOKEN); | ||
| server.listen(port, res); | ||
| }), | ||
| ); | ||
|
|
||
| afterEach(() => { | ||
| jest.resetAllMocks(); | ||
| server.restore(); | ||
| }); | ||
|
|
||
| afterAll( | ||
| () => | ||
| new Promise((res) => { | ||
| server.close(res); | ||
| }), | ||
| ); | ||
|
|
||
| test('`sbom pip-app` generates an SBOM with a specified python command', async () => { | ||
| const project = await createProjectFromWorkspace('pip-app'); | ||
| const command = | ||
| os.platform().indexOf('win') === 0 ? 'python3.11.exe' : 'python3'; | ||
|
|
||
| const { code, stdout } = await runSnykCLI( | ||
| `sbom --org aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee --format cyclonedx1.4+json --debug --command=${command}`, | ||
| { | ||
| cwd: project.path(), | ||
| env, | ||
| }, | ||
| ); | ||
| let bom; | ||
|
|
||
| expect(code).toEqual(0); | ||
| expect(() => { | ||
| bom = JSON.parse(stdout); | ||
| }).not.toThrow(); | ||
| expect(bom.metadata.component.name).toEqual('pip-app'); | ||
| expect(bom.components).toHaveLength(3); | ||
| }); | ||
|
|
||
| test('`sbom pip-app-custom` generates an SBOM with pip for custom manifest names', async () => { | ||
| const project = await createProjectFromWorkspace('pip-app-custom'); | ||
|
|
||
| const { code, stdout } = await runSnykCLI( | ||
| `sbom --org aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee --format cyclonedx1.4+json --debug --package-manager=pip --file=base.txt`, | ||
| { | ||
| cwd: project.path(), | ||
| env, | ||
| }, | ||
| ); | ||
| let bom; | ||
|
|
||
| expect(code).toEqual(0); | ||
| expect(() => { | ||
| bom = JSON.parse(stdout); | ||
| }).not.toThrow(); | ||
| expect(bom.metadata.component.name).toEqual('pip-app-custom'); | ||
| expect(bom.components).toHaveLength(3); | ||
| }); | ||
|
|
||
| test('`sbom pip-app-private` generates an SBOM and skips unresolved packages', async () => { | ||
| const project = await createProjectFromWorkspace('pip-app-private'); | ||
|
|
||
| const { code, stdout } = await runSnykCLI( | ||
| `sbom --org aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee --format cyclonedx1.4+json --debug --skip-unresolved=true`, | ||
| { | ||
| cwd: project.path(), | ||
| env, | ||
| }, | ||
| ); | ||
| let bom; | ||
|
|
||
| expect(code).toEqual(0); | ||
| expect(() => { | ||
| bom = JSON.parse(stdout); | ||
| }).not.toThrow(); | ||
| expect(bom.metadata.component.name).toEqual('pip-app-private'); | ||
| }); | ||
| }); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| import { createProjectFromWorkspace } from '../../util/createProject'; | ||
| import { runSnykCLI } from '../../util/runSnykCLI'; | ||
| import { fakeServer } from '../../../acceptance/fake-server'; | ||
|
|
||
| jest.setTimeout(1000 * 60 * 5); | ||
|
|
||
| describe('snyk sbom --yarn-workspaces (mocked server only)', () => { | ||
| let server; | ||
| let env: Record<string, string>; | ||
|
|
||
| beforeAll( | ||
| () => | ||
| new Promise((res) => { | ||
| const port = process.env.PORT || process.env.SNYK_PORT || '58589'; | ||
| const baseApi = '/api/v1'; | ||
| env = { | ||
| ...process.env, | ||
| SNYK_API: 'http://localhost:' + port + baseApi, | ||
| SNYK_HOST: 'http://localhost:' + port, | ||
| SNYK_TOKEN: '123456789', | ||
| SNYK_DISABLE_ANALYTICS: '1', | ||
| }; | ||
| server = fakeServer(baseApi, env.SNYK_TOKEN); | ||
| server.listen(port, res); | ||
| }), | ||
| ); | ||
|
|
||
| afterEach(() => { | ||
| jest.resetAllMocks(); | ||
| server.restore(); | ||
| }); | ||
|
|
||
| afterAll( | ||
| () => | ||
| new Promise((res) => { | ||
| server.close(res); | ||
| }), | ||
| ); | ||
|
|
||
| test('`sbom yarn-workspaces` generates an SBOM for multiple yarn workspaces', async () => { | ||
| const project = await createProjectFromWorkspace('yarn-workspaces'); | ||
|
|
||
| const { code, stdout } = await runSnykCLI( | ||
| `sbom --org aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee --format cyclonedx1.4+json --debug --yarn-workspaces`, | ||
| { | ||
| cwd: project.path(), | ||
| env, | ||
| }, | ||
| ); | ||
| let bom; | ||
|
|
||
| expect(code).toEqual(0); | ||
| expect(() => { | ||
| bom = JSON.parse(stdout); | ||
| }).not.toThrow(); | ||
| expect(bom.metadata.component.name).toEqual('yarn-workspaces'); | ||
| expect(bom.components).toHaveLength(9); | ||
| }); | ||
| }); |