ozontech / dtrack-audit

OWASP Dependency Track API client for intergration into CI/CD pipeline

dtrack-audit

OWASP Dependency Track API client for your security CI/CD pipeline. See Dependency-Track docs: Continuous Integration & Delivery for use case.

Install

Local Installation

Go 1.16+

go install github.com/ozontech/dtrack-audit/cmd/dtrack-audit@latest

Go version < 1.16

go get github.com/ozontech/dtrack-audit/cmd/dtrack-audit

Features

• Fully configurable via environment variables
• Async and sync modes. In async mode dtrack-audit simply sends SBOM file to DTrack API (like cURL but in much more comfortable way). Sync mode means: upload SBOM file, wait for the scan result, show it and exit with non-zero code. So you can break corresponding CI/CD job to make developers pay attention to findings
• You can filter the results. With Sync mode enabled show result and fail an audit if the results include a vulnerability with a severity of specified level or higher. Severity levels are: critical, high, medium, low, info, unassigned
• Auto creation of projects. With this feautre you can configure SCA (with dtrack-audit) step globally for your CI/CD and it will create project, e.g. with name from environment variable like $CI_PROJECT_NAME. So you don't need to configure it manually for each project
• Support for TeamCity CI output. You can use -T flag to enable JSON output. After that, activate the Golang build feature.

Sample output

$ cyclonedx-bom -o bom.xml
$ dtrack-audit -s -g high

SBOM file is successfully uploaded to DTrack API. Result token is 12345f5e-4ccb-45fe-b8fd-1234a8bf0081

2 vulnerabilities found!

 > HIGH: Arbitrary File Write
   Component: adm-zip 0.4.7
   More info: https://dtrack/vulnerability/?source=NPM&vulnId=994

 > CRITICAL: Prototype Pollution
   Component: handlebars 4.0.11
   More info: https://dtrack/vulnerability/?source=NPM&vulnId=755

dtrack-audit's Issues

Add Development section into README

Implement filter by severity

It should be useful to have ability to filter result of dtrack-audit sync by severity of findings.

Add possibility to use policy violations instead of findings

It would be great to have an option to check for policy violations instead of findings.

Add env variable processing for sync mode option

Add normalization for input params

To decrease amount of errors with spaces, NL etc. in params

How do you run the program?

It's not obvious to me how to run the program locally:

$ git clone https://github.com/ozonru/dtrack-audit.git
Cloning into 'dtrack-audit'...
remote: Enumerating objects: 104, done.
remote: Counting objects: 100% (104/104), done.
remote: Compressing objects: 100% (49/49), done.
remote: Total 104 (delta 39), reused 79 (delta 24), pack-reused 0
Receiving objects: 100% (104/104), 29.85 KiB | 5.97 MiB/s, done.
Resolving deltas: 100% (39/39), done.

$ go run cmd/dtrack-audit/main.go
package command-line-arguments
	cmd/dtrack-audit/main.go:6:2: use of internal package github.com/ozonru/dtrack-audit/internal/dtrack not allowed

Maybe I don't know something, but it's the thing I want to understand. Maybe you changed your local $GOPATH and have a special directory structure for this project?

Make dtrack-audit exit with non-zero code only when there are security issues

In case of CI/CD and using of exit code to break current job it's important to consider that dtrack-audit use non-zero code only for reporting findings.

Add auto-registration of projects

Common case for microservices world is when you have tons of it and want to integrate SCA security control for all of them. You can add manually each or make single and mandatory CI/CD step/job for all services. To make it works we need to implement auto-registration of projects with algorithm like:

1. Search in DTrack for project with name PROJECT_NAME
2. If it is already exists then use it ID
3. If new one then register with PROJECT_NAME and optionally additional information (e.g. Slack channel for alerts)
4. Run Dtrack in the job in async mode by default and give developers opportunity to switch on sync mode with breaking pipeline exit code.

couldnt figure out the issue while running

command used:
Users/thinksabin/go/bin/dtrack-audit -a -i bom.xml -k PBohV8SZab8Rel5j1FEHZEI9wjDMdC1g -u http://192.168.43.221:8080

error:

Send SBOM file to Dependency Track for audit.

Usage of program: ...... 
Fields marked with (*) are required.

Environment variable DTRACK_AUTO_CREATE_PROJECT is already set.
Help required. thanks.

feature request: set project tags

I propose to add a new environment, DTRACK_PROJECT_TAGS.

Setting it to tag1 tag2 would call:

PATCH /api/v1/project/<UUID>
{"tags": [{"name": "tag1"}, {"name": "tag2"}]}

after creating or updating the project.

go install error

How to reproduce:

docker run -it --rm node:lts-alpine /bin/sh
apk add --no-cache git go
export GOROOT=/usr/lib/go
export GOPATH=/go
export PATH=/go/bin:$PATH
go install github.com/ozontech/dtrack-audit/cmd/dtrack-audit@latest

Go version: 1.17.4-r0

Error:

go: downloading github.com/ozontech/dtrack-audit v1.0.0
go install: github.com/ozontech/dtrack-audit/cmd/dtrack-audit@latest: github.com/ozontech/[email protected]: parsing go.mod:
	module declares its path as: github.com/ozonru/dtrack-audit
	        but was required as: github.com/ozontech/dtrack-audit

Following command works:

go install github.com/ozonru/dtrack-audit/cmd/dtrack-audit@latest

Project auto creation fails for PROJECT_CREATION_UPLOAD permission

Dependency Track v3.2.0 introduced the PROJECT_CREATION_UPLOAD permission that reduced the access that PORTFOLIO_MANAGEMENT gave. I get the following error upon upload of a BOM for a non-existing project:

$ dtrack-audit -a -n $PROJECT_NAME -k $DTRACK_KEY -u $DTRACK_URL -i bom.xml
[Dtrack Audit Error]: Permission error. Check that you have all required permissions

I am using dtrack-audit v1.0.0 and Dependency Track v4.3.4.

It looks like dtrack-audit is querying for a project, then trying to create a new one if it doesn't exist. This will fail if the key only had PROJECT_CREATION_UPLOAD permission.

Non-informative message of error for problems with permissions

Steps to reproduce:

1. Add new team into Dtrack with empty permissions
2. Try to upload via dtrack-audit bom file

Current result:
EOF error

Expected result:
Informative error message from Dtrack API

feature request: print project UUID

By including the project's UUID in the console output, a direct link to the project in Dependency Track can be easily constructed. This link can be, for example, added as a note to a merge request, where developers can triage issues found.

Add recommendations for CI Installation

Like for https://github.com/securego/gosec