thinksabin / DTrackAuditor

DTrackAuditor is the python script to faciliate usage of DependencyTrack in the CI.
Apache License 2.0
10 stars 11 forks source link

Fix `read_upload_bom()` for empty-string `old_project_version_uuid` (meaning it was not found) #81

Open jimklimov opened 1 month ago

jimklimov commented 1 month ago

Logical problem detailed at https://github.com/thinksabin/DTrackAuditor/issues/79#issuecomment-2416941912

Closes: #79

Local testing of uploads into currently missing project name/version:

Provided project name and version: New-Test-Project 1.0.0 Auto mode ON Reading bom.json ... Uploading bom.json ... Cannot get project 'New-Test-Project' '1.0.0' id: 404 Not Found Waiting for bom to be processed on dt server ... Waiting for project uuid 87d0551e-f8ca-4213-94c9-9974c1886260 to be reported by dt server ... Uploaded BOM 'bom.json' into project '87d0551e-f8ca-4213-94c9-9974c1886260' (for 'New-Test-Project' '1.0.0'), it reports lastBomImport: 1729086325061 (old one was None) and token '9a889b5d-d374-4370-aaba-6aba1b50f963' Project UUID: 87d0551e-f8ca-4213-94c9-9974c1886260 No policy violations found. severity_scores, {'CRITICAL': 1, 'HIGH': 12, 'MEDIUM': 6, 'LOW': 0, 'UNASSIGNED': 25} AuditorException.INSTANT_EXIT: Threshold for CRITICAL severity issues exceeded. Failing as per instructed rules (-r)

:; echo $? 1


* Passing the alerts:

:; $PYTHON3 ./dtrackauditor/dtrackauditor.py -u "${DTRACK_SERVER}" -k "${DTRACK_API_KEY}" -p New-Test-Project-HighThreshold -f bom.json -a --wait -r critical:100:true,high:200:true,medium:100:true,low:100:false

Provided project name and version: New-Test-Project-HighThreshold 1.0.0 Auto mode ON Reading bom.json ... Uploading bom.json ... Cannot get project 'New-Test-Project-HighThreshold' '1.0.0' id: 404 Not Found Waiting for bom to be processed on dt server ... Waiting for project uuid c7cc4694-8d6d-42ef-9efa-31307b76479c to be reported by dt server ... Uploaded BOM 'bom.json' into project 'c7cc4694-8d6d-42ef-9efa-31307b76479c' (for 'New-Test-Project-HighThreshold' '1.0.0'), it reports lastBomImport: 1729086374144 (old one was None) and token '5a351238-909c-4b00-bb00-e86653d38323' Project UUID: c7cc4694-8d6d-42ef-9efa-31307b76479c No policy violations found. severity_scores, {'CRITICAL': 1, 'HIGH': 12, 'MEDIUM': 6, 'LOW': 0, 'UNASSIGNED': 25} Vulnerability audit resulted in no violations.

:; echo $? 0

jimklimov commented 1 month ago

@thinksabin : I guess as a bug fix, this is eligible for a new release (e.g. 1.4.1)?