|
| 1 | +from config_generator.components.funcs.setup import Setup |
| 2 | + |
| 3 | +from config_generator.etc.distros import find_small_distro |
| 4 | +from config_generator.etc.function import Function, merge_defns |
| 5 | +from config_generator.etc.utils import bash_exec |
| 6 | + |
| 7 | +from shrub.v3.evg_build_variant import BuildVariant |
| 8 | +from shrub.v3.evg_command import BuiltInCommand, EvgCommandType, expansions_update, s3_put |
| 9 | +from shrub.v3.evg_task import EvgTask, EvgTaskRef |
| 10 | + |
| 11 | +from pydantic import ConfigDict |
| 12 | +from typing import Optional |
| 13 | + |
| 14 | + |
| 15 | +TAG = 'sbom' |
| 16 | + |
| 17 | + |
| 18 | +class CustomCommand(BuiltInCommand): |
| 19 | + command: str |
| 20 | + model_config = ConfigDict(arbitrary_types_allowed=True) |
| 21 | + |
| 22 | + |
| 23 | +def ec2_assume_role( |
| 24 | + role_arn: Optional[str] = None, |
| 25 | + policy: Optional[str] = None, |
| 26 | + duration_seconds: Optional[int] = None, |
| 27 | + command_type: Optional[EvgCommandType] = None, |
| 28 | +) -> CustomCommand: |
| 29 | + return CustomCommand( |
| 30 | + command="ec2.assume_role", |
| 31 | + params={ |
| 32 | + "role_arn": role_arn, |
| 33 | + "policy": policy, |
| 34 | + "duration_seconds": duration_seconds, |
| 35 | + }, |
| 36 | + type=command_type, |
| 37 | + ) |
| 38 | + |
| 39 | + |
| 40 | +class CheckAugmentedSBOM(Function): |
| 41 | + name = 'check augmented sbom' |
| 42 | + commands = [ |
| 43 | + ec2_assume_role( |
| 44 | + command_type=EvgCommandType.SETUP, |
| 45 | + role_arn='${KONDUKTO_ROLE_ARN}', |
| 46 | + ), |
| 47 | + bash_exec( |
| 48 | + command_type=EvgCommandType.SETUP, |
| 49 | + include_expansions_in_env=['AWS_ACCESS_KEY_ID', 'AWS_SECRET_ACCESS_KEY', 'AWS_SESSION_TOKEN'], |
| 50 | + script='''\ |
| 51 | + set -o errexit |
| 52 | + set -o pipefail |
| 53 | + kondukto_token="$(aws secretsmanager get-secret-value --secret-id "kondukto-token" --region "us-east-1" --query 'SecretString' --output text)" |
| 54 | + printf "KONDUKTO_TOKEN: %s\\n" "$kondukto_token" >|expansions.kondukto.yml |
| 55 | + ''', |
| 56 | + ), |
| 57 | + expansions_update( |
| 58 | + command_type=EvgCommandType.SETUP, |
| 59 | + file='expansions.kondukto.yml', |
| 60 | + ), |
| 61 | + bash_exec( |
| 62 | + command_type=EvgCommandType.TEST, |
| 63 | + working_dir='mongo-cxx-driver', |
| 64 | + include_expansions_in_env=[ |
| 65 | + 'ARTIFACTORY_PASSWORD', |
| 66 | + 'ARTIFACTORY_USER', |
| 67 | + 'branch_name', |
| 68 | + 'KONDUKTO_TOKEN', |
| 69 | + ], |
| 70 | + script='.evergreen/scripts/sbom.sh', |
| 71 | + ), |
| 72 | + ] |
| 73 | + |
| 74 | + |
| 75 | +class UploadAugmentedSBOM(Function): |
| 76 | + name = 'upload augmented sbom' |
| 77 | + commands = [ |
| 78 | + # The current Augmented SBOM, ignoring version and timestamp fields. |
| 79 | + s3_put( |
| 80 | + command_type=EvgCommandType.SYSTEM, |
| 81 | + aws_key='${aws_key}', |
| 82 | + aws_secret='${aws_secret}', |
| 83 | + bucket='mciuploads', |
| 84 | + content_type='application/json', |
| 85 | + display_name='Augmented SBOM (Old)', |
| 86 | + local_file='mongo-cxx-driver/old.json', |
| 87 | + permissions='public-read', |
| 88 | + remote_file='mongo-cxx-driver/${build_variant}/${revision}/${version_id}/${build_id}/sbom/old.json', |
| 89 | + ), |
| 90 | + # The updated Augmented SBOM, ignoring version and timestamp fields. |
| 91 | + s3_put( |
| 92 | + command_type=EvgCommandType.SYSTEM, |
| 93 | + aws_key='${aws_key}', |
| 94 | + aws_secret='${aws_secret}', |
| 95 | + bucket='mciuploads', |
| 96 | + content_type='application/json', |
| 97 | + display_name='Augmented SBOM (New)', |
| 98 | + local_file='mongo-cxx-driver/new.json', |
| 99 | + permissions='public-read', |
| 100 | + remote_file='mongo-cxx-driver/${build_variant}/${revision}/${version_id}/${build_id}/sbom/new.json', |
| 101 | + ), |
| 102 | + # The difference between the current and updated Augmented SBOM. |
| 103 | + s3_put( |
| 104 | + command_type=EvgCommandType.SYSTEM, |
| 105 | + aws_key='${aws_key}', |
| 106 | + aws_secret='${aws_secret}', |
| 107 | + bucket='mciuploads', |
| 108 | + content_type='application/json', |
| 109 | + display_name='Augmented SBOM (Diff)', |
| 110 | + local_file='mongo-cxx-driver/diff.txt', |
| 111 | + permissions='public-read', |
| 112 | + remote_file='mongo-cxx-driver/${build_variant}/${revision}/${version_id}/${build_id}/sbom/diff.txt', |
| 113 | + ), |
| 114 | + # The updated Augmented SBOM without any filtering or modifications. |
| 115 | + s3_put( |
| 116 | + command_type=EvgCommandType.SYSTEM, |
| 117 | + aws_key='${aws_key}', |
| 118 | + aws_secret='${aws_secret}', |
| 119 | + bucket='mciuploads', |
| 120 | + content_type='application/json', |
| 121 | + display_name='Augmented SBOM (Updated)', |
| 122 | + local_file='mongo-cxx-driver/etc/augmented.sbom.json.new', |
| 123 | + permissions='public-read', |
| 124 | + remote_file='mongo-cxx-driver/${build_variant}/${revision}/${version_id}/${build_id}/sbom/augmented.sbom.json', |
| 125 | + ), |
| 126 | + ] |
| 127 | + |
| 128 | + |
| 129 | +def functions(): |
| 130 | + return merge_defns( |
| 131 | + CheckAugmentedSBOM.defn(), |
| 132 | + UploadAugmentedSBOM.defn(), |
| 133 | + ) |
| 134 | + |
| 135 | + |
| 136 | +def tasks(): |
| 137 | + distro_name = 'rhel80' |
| 138 | + distro = find_small_distro(distro_name) |
| 139 | + |
| 140 | + yield EvgTask( |
| 141 | + name='sbom', |
| 142 | + tags=[TAG, distro_name], |
| 143 | + run_on=distro.name, |
| 144 | + commands=[ |
| 145 | + Setup.call(), |
| 146 | + CheckAugmentedSBOM.call(), |
| 147 | + UploadAugmentedSBOM.call(), |
| 148 | + ], |
| 149 | + ) |
| 150 | + |
| 151 | + |
| 152 | +def variants(): |
| 153 | + return [ |
| 154 | + BuildVariant( |
| 155 | + name=TAG, |
| 156 | + display_name='SBOM', |
| 157 | + tasks=[EvgTaskRef(name=f'.{TAG}')], |
| 158 | + ), |
| 159 | + ] |
0 commit comments