PATCH: updating API env vars to match veracode api signing module. @mastermargie

Author: chuckorde

.gitlab-ci.yml

@@ -73,11 +73,6 @@ SCA Test: # run SCA on any branch
 
     script:
         - curl -sSL https://download.sourceclear.com/ci.sh | bash
-    #       | tee sca_results.txt
-    #
-    # artifacts:
-    #     paths:
-    #         - sca_results.txt
 
     only:
         - dev

veracode/API/core.py

@@ -21,17 +21,19 @@ def __init__(self, status_code, data, res):
             self.res = res
 
     def __init__(self, end_point, api_version, server=None):
-        self.__api_id = os.environ.get('VERACODE_API_ID', None)
-        self.__api_secret = os.environ.get('VERACODE_API_SECRET', None)
-    
+        self.__api_id = os.environ.get('VERACODE_API_KEY_ID', None)
+        self.__api_secret = os.environ.get('VERACODE_API_KEY_SECRET', None)
+
         if not (self.__api_id and self.__api_secret):
             self.profile = os.environ.get('VERACODE_API_PROFILE', 'DEFAULT')
             conf = configparser.ConfigParser()
             conf.read(os.path.expanduser('~/.veracode/credentials'))
-            self.__api_id = conf.get(self.profile, 'VERACODE_API_ID')
-            self.__api_secret = conf.get(self.profile, 'VERACODE_API_SECRET')
+            self.__api_id = conf.get(self.profile, 'VERACODE_API_KEY_ID')
+            self.__api_secret = conf.get(self.profile,
+                    'VERACODE_API_KEY_SECRET')
 
-        self.__api_server = server or 'https://analysiscenter.veracode.com/api/'
+        self.__api_server = server or \
+                'https://analysiscenter.veracode.com/api/'
         self.__end_point = end_point
         if api_version:
             self.__server = '/'.join(map(lambda x: str(x).rstrip('/'),
@@ -53,7 +55,8 @@ def __veracode_hmac(self, host, url, method):
             codecs.decode(self.__api_secret, 'hex_codec'),
             codecs.decode(nonce, 'hex_codec'), sha256).digest()
 
-        key_date = hmac.new(key_nonce, str(timestamp).encode(), sha256).digest()
+        key_date = hmac.new(
+                key_nonce, str(timestamp).encode(), sha256).digest()
         signature_key = hmac.new(
                 key_date, 'vcode_request_version_1'.encode(), sha256).digest()
         signature = hmac.new(
@@ -75,7 +78,8 @@ def __prepared_request(self, method, query, file=None):
                 files=file)
         prepared_request = request.prepare()
         prepared_request.headers['Authorization'] = self.__veracode_hmac(
-            urlparse(self.__server).hostname, prepared_request.path_url, method)
+            urlparse(self.__server).hostname,
+            prepared_request.path_url, method)
         res = session.send(prepared_request)
 
         logger.debug('{}, {}, COMPLETED'.format(self.__end_point, query))

veracode/SDK/__init__.py

@@ -1,4 +1 @@
-# from veracode import log
-# logger = log.veracode_logger('veracode')
-
 from veracode.SDK import core, admin, flawreport, mitigation, results, sandbox, upload, exceptions

veracode/build.py

@@ -52,7 +52,6 @@ def __init__(self, obj=None, app=None):
         self._modules = []
 
         if obj:
-            self.obj = obj
             if hasattr(obj, 'build'):
                 self.version = obj.build.version
 

veracode/log.py

@@ -2,7 +2,8 @@
 import os
 
 def veracode_logger(name):
-    formatter = logging.Formatter(fmt='%(asctime)s, %(levelname)s, %(message)s')
+    formatter = logging.Formatter(
+            fmt='%(asctime)s, %(levelname)s, %(message)s')
     handler = logging.StreamHandler()
     handler.setFormatter(formatter)
     logger = logging.getLogger(name)

veracode/sandbox.py

@@ -76,7 +76,8 @@ def __init__(self, obj=None):
             self.customfield = obj.customfield
 
     def __repr__(self):
-        return "<Veracode Sandbox: name='{}', id={}>".format(self.name, self.id)
+        return "<Veracode Sandbox: name='{}', id={}>".format(
+                self.name, self.id)
 
     def __bool__(self):
         return self.name is not None

veracode/utils/app/commands.py

@@ -6,12 +6,12 @@
 from veracode.build import Build
 from veracode.utils.report import display
 
-@click.group()
+@click.group(help='Perform actions on an application.')
 def app():
     pass
 
 
-@app.command()
+@app.command(help='List applications.')
 @click.option('--format', '-f',
         help='Output format.')
 def list(format='simple'):
@@ -20,10 +20,12 @@ def list(format='simple'):
     display(data=data, headers=headers, format=format)
 
 
-@app.command()
-@click.option('--name', '-n', required=True)
-@click.option('--criticality', '-c', required=True, type=click.Choice(
-    [ 'Very High', 'High', 'Medium', 'Low', 'Very Low' ]))
+@app.command(help='Create a new Application.')
+@click.option('--name', '-n', required=True,
+        help='Name of application to create.')
+@click.option('--criticality', '-c', required=True,
+        type=click.Choice(['Very High', 'High', 'Medium', 'Low', 'Very Low']),
+        help='Business criticality of new application.')
 
 @click.option('--sandbox', '-s')
 def create(name, criticality, sandbox=None):
@@ -37,9 +39,9 @@ def create(name, criticality, sandbox=None):
         app.sandbox = sbx
 
 
-@app.command()
+@app.command(help='Delete an existing application.')
 @click.option('--name', '-n', required=True,
-        help='Name of application to update')
+        help='Name of application to update.')
 @click.confirmation_option('--force', '-f',
         help='Suppress prompt before removal.',
         prompt='Are you sure you want to delete this application')
@@ -48,7 +50,7 @@ def delete(name):
     return app.delete()
 
 
-@app.command()
+@app.command(help='Update an existing application.')
 @click.option('--name', '-n', required=True,
         help='Name of application to update.')
 @click.option('--rename', '-r',
@@ -57,7 +59,6 @@ def delete(name):
         [ 'Very High', 'High', 'Medium', 'Low', 'Very Low' ],
         case_sensitive=True), # update app to snake case so we can go -i
         help='New criticality for the application.')
-
 def update(name, rename=None, criticality=None):
     # this isn't the right way to do this, google more
     if not (rename or criticality):
@@ -71,7 +72,7 @@ def update(name, rename=None, criticality=None):
     app.save()
 
 
-@app.command()
+@app.command(help='Launch a new SAST scan.')
 @click.option('--app', '-a', required=True,
         help='Name of the application.')
 @click.option('--files', '-f', required=True,

veracode/utils/cli.py

@@ -3,8 +3,9 @@
 from .sandbox import commands as sandbox
 from .user import commands as user
 from .report import commands as report
-from veracode.log import veracode_logger
-logger = veracode_logger('veracode')
+
+# import logging
+# logger = logging.getLogger('veracode')
 
 @click.group()
 def main():

veracode/utils/report/__init__.py

@@ -16,6 +16,9 @@ def display(data, headers, format):
                 user_data[header] = d
             json_data.append(user_data)
         click.echo(json.dumps(json_data, indent=4))
+    elif format == 'list':
+        for idx, header in enumerate(headers):
+            click.echo('{0:20} {1}'.format(header, data[0][idx]))
     else:
         click.echo(tabulate(data, headers=headers, tablefmt=format))
 

veracode/utils/report/commands.py

@@ -2,20 +2,41 @@
 from veracode.application import Application
 from veracode.utils.report import display
 
-@click.group()
+@click.group(help='View application policy report(s).')
 def report():
     pass
 
-@report.command()
+@report.command(help='Print policy summary.')
 @click.option('--app', '-a', required=True,
         help='Name of the application.')
 @click.option('--sandbox', '-s',
         help='Name of the application sandbox.')
 @click.option('--build', '-b',
         help='Name of the application build.')
-def summary(app, sandbox=None, build=None):
+@click.option('--format', '-f', default='list',
+        help='Output format.')
+def summary(app, sandbox=None, build=None, format=None):
     app = Application(name=app, sandbox=sandbox, build=build)
-    print(app.build.report)
+    report = app.build.report
+    headers = ['Policy Name',
+	       'Policy Status',
+	       'Score',
+	       'Total Flaws',
+	       'Very High',
+	       'High',
+	       'Medium',
+	       'Low']
+    data = [[
+	report.policy_name,
+	report.policy_compliance_status,
+	report.static_analysis.score,
+	report.flaw_status.total,
+	report.flaw_status.sev_5_change,
+	report.flaw_status.sev_4_change,
+	report.flaw_status.sev_3_change,
+	report.flaw_status.sev_2_change,
+    ]]
+    display(data=data, headers=headers, format=format)
 
 @report.command()
 def create():