rl-secure-scan-ado.yml

parameters:
- name: RL_VERBOSE
  type: boolean
  default: false
- name: RL_WITH_UPLOAD
  type: boolean
  default: true
- name: BUILD_PATH
  default: '.'
- name: MY_ARTIFACT_TO_SCAN
  default: ''
- name: REPORT_PATH
  default: 'report'
- name: RLSECURE_ENCODED_LICENSE
  default: ''
- name: RLSECURE_SITE_KEY
  default: ''
- name: RL_STORE
  type: string
  default: ''
- name: RL_PACKAGE_URL
  type: string
  default: ''
- name: RL_DIFF_WITH
  type: string
  default: ''
- name: RL_PROXY_SERVER
  type: string
  default: ''
- name: RL_PROXY_PORT
  type: string
  default: ''
- name: RL_PROXY_USER
  type: string
  default: ''
- name: RL_PROXY_PASSWORD
  type: string
  default: ''

steps:
# <<< scan with rl-scanner >>>
- bash: |
    #! /bin/bash
    #
    # Parameters supported
    #
    # RL_VERBOSE: string, optional default ''
    #
    # BUILD_PATH: string, optionsl, default '.'
    # MY_ARTIFACT_TO_SCAN: string, mandatory
    # REPORT_PATH: string, optional default: 'RlReport'
    #
    # RLSECURE_SITE_KEY: string, mandatory
    # RLSECURE_ENCODED_LICENSE: string, mandatory
    #
    # RL_STORE: string, optional, default ''
    # RL_PACKAGE_URL: string, optional, default ''
    # RL_DIFF_WITH: string, optional, default ''
    #
    # RLSECURE_PROXY_SERVER: string, optional, default ''
    # RLSECURE_PROXY_PORT: string, optional, default ''
    # RLSECURE_PROXY_USER: string, optional, default ''
    # RLSECURE_PROXY_PASSWORD: string, optional, default ''
    #
    isBool()
    {
        local value="$1"
        if [ -z "$value" ]
        then
            echo "false"
        fi
        if [ "$value" == "0" ]
        then
            echo "false"
        fi
        value=$(
            echo "$value" |
            tr '[:upper:]' '[:lower:]'
        )
        if [ "$value" == "false" ]
        then
            echo "false"
        fi
        echo "true"
    }
    do_verbose()
    {
        cat <<!
    REPORT_PATH:              ${REPORT_PATH:-No report path specified}
    BUILD_PATH:               ${BUILD_PATH:-No build path specified}
    MY_ARTIFACT_TO_SCAN:      ${MY_ARTIFACT_TO_SCAN:-No artifact specified}
    RL_STORE:                 ${RL_STORE:-No path specified for RL_STORE: no diff scan will be executed}
    RL_PACKAGE_URL:           ${RL_PACKAGE_URL:-No package URL given: no diff scan will be executed}
    RL_DIFF_WITH:             ${RL_DIFF_WITH:-No diff with was requested}
    RLSECURE_PROXY_SERVER:    ${RLSECURE_PROXY_SERVER:-No proxy server was provided}
    RLSECURE_PROXY_PORT:      ${RLSECURE_PROXY_PORT:-No proxy port was provided}
    RLSECURE_PROXY_USER:      ${RLSECURE_PROXY_USER:-No proxy user was provided}
    RLSECURE_PROXY_PASSWORD:  ${RLSECURE_PROXY_PASSWORD:-No proxy password was provided}
    !
    }
    doErr()
    {
        local msg="$1"
        echo "##vso[task.logissue type=error;] ${msg}"
        echo "##vso[task.complete result=Failed;]"
        exit 101
    }
    validate_params()
    {
        if [ -z "${REPORT_PATH}" ]
        then
            doErr "FATAL: no 'report-path' provided"
        fi
        if [ -z "${BUILD_PATH}" ]
        then
            doErr "FATAL: no 'build path' provided"
        fi
        if [ -z "${MY_ARTIFACT_TO_SCAN}" ]
        then
            doErr "FATAL: no 'artifact-to-scan' provided"
        fi
        if [ -z "${RLSECURE_ENCODED_LICENSE}" ]
        then
            doErr "FATAL: no 'RLSECURE_ENCODED_LICENSE' is set in your environment"
        fi
        if [ -z "${RLSECURE_SITE_KEY}" ]
        then
            doErr "FATAL: no 'RLSECURE_SITE_KEY' is set in your environment"
        fi
    }
    prep_report()
    {
        if [ -d "${REPORT_PATH}" ]
        then
            if rmdir "${REPORT_PATH}"
            then
                :
            else
                doErr "FATAL: your current REPORT_PATH is not empty"
            fi
        fi
        mkdir -p "${REPORT_PATH}"
    }
    prep_paths()
    {
        R_PATH=$( realpath "${REPORT_PATH}" )
        B_PATH=$( realpath "${BUILD_PATH}" )
        if [ ! -z "${RL_STORE}" ]
        then
            RL_STORE=$(realpath ${RL_STORE})
        fi
    }
    extractProjectFromPackageUrl()
    {
        echo "${RL_PACKAGE_URL}" |
        awk '{
            sub(/@.*/,"")       # remove the @Version part
            split($0, a , "/")  # we expect $Project/$Package
            print a[1]          # print Project
        }'
    }
    extractPackageFromPackageUrl()
    {
        echo "${RL_PACKAGE_URL}" |
        awk '{
            sub(/@.*/,"")       # remove the @Version part
            split($0, a , "/")  # we expect $Project/$Package
            print a[2]          # print Package
        }'
    }
    makeDiffWith()
    {
        DIFF_WITH=""
        if [ -z "$RL_STORE" ]
        then
            return
        fi
        if [ -z "${RL_PACKAGE_URL}" ]
        then
            return
        fi
        if [ -z "${RL_DIFF_WITH}" ]
        then
            return
        fi
        # Split the package URL and find Project and Package
        Project=$( extractProjectFromPackageUrl )
        Package=$( extractPackageFromPackageUrl )
        if [ ! -d "$RL_STORE/.rl-secure/projects/${Project}/packages/${Package}/versions/${RL_DIFF_WITH}" ]
        then
            echo "::notice That version has not been scanned yet: ${RL_DIFF_WITH} in project: ${Project} and package: ${Package}"
            echo "::notice No diff scan will be executed, only ${RL_PACKAGE_URL} will be scanned"
            return
        fi
        DIFF_WITH="--diff-with=${RL_DIFF_WITH}"
    }
    prep_proxy_data()
    {
        PROXY_DATA=""
        if [ ! -z "${RLSECURE_PROXY_SERVER}" ]
        then
            PROXY_DATA="${PROXY_DATA} -e RLSECURE_PROXY_SERVER=${RLSECURE_PROXY_SERVER}"
        fi
        if [ ! -z "${RLSECURE_PROXY_PORT}" ]
        then
            PROXY_DATA="${PROXY_DATA} -e RLSECURE_PROXY_PORT=${RLSECURE_PROXY_PORT}"
        fi
        if [ ! -z "${RLSECURE_PROXY_USER}" ]
        then
            PROXY_DATA="${PROXY_DATA} -e RLSECURE_PROXY_USER=${RLSECURE_PROXY_USER}"
        fi
        if [ ! -z "${RLSECURE_PROXY_PASSWORD}" ]
        then
            PROXY_DATA="${PROXY_DATA} -e RLSECURE_PROXY_PASSWORD=${RLSECURE_PROXY_PASSWORD}"
        fi
    }
    scan_with_store()
    {
        local - # auto restore the next line on function end
        set +e # we do our own error handling in this func
        export RLSECURE_ENCODED_LICENSE
        export RLSECURE_SITE_KEY
        # rl-store will be initialized if it is empty
        docker run --pull always --rm -u $(id -u):$(id -g) \
            -e RLSECURE_ENCODED_LICENSE \
            -e RLSECURE_SITE_KEY \
            ${PROXY_DATA} \
            -v "${B_PATH}/:/packages:ro" \
            -v "${R_PATH}/:/report" \
            -v "${RL_STORE}/:/rl-store" \
            reversinglabs/rl-scanner:latest \
                rl-scan \
                    --replace \
                    --rl-store=/rl-store \
                    --purl=${RL_PACKAGE_URL} \
                    --package-path=/packages/"$(MY_ARTIFACT_TO_SCAN)" \
                    --report-path=/report \
                    --report-format=all \
                    ${DIFF_WITH} 1>1 2>2
        RR=$?
        STATUS=$( grep 'Scan result:' 1 )
    }
    scan_no_store()
    {
        local - # auto restore the next line on function end
        set +e # we do our own error handling in this func
        export RLSECURE_ENCODED_LICENSE
        export RLSECURE_SITE_KEY
        docker run --pull always --rm -u $(id -u):$(id -g) \
            -e RLSECURE_ENCODED_LICENSE \
            -e RLSECURE_SITE_KEY \
            ${PROXY_DATA} \
            -v "${B_PATH}/:/packages:ro" \
            -v "${R_PATH}/:/report" \
            reversinglabs/rl-scanner:latest \
                rl-scan \
                    --replace \
                    --package-path=/packages/"$(MY_ARTIFACT_TO_SCAN)" \
                    --report-path=/report \
                    --report-format=all 1>1 2>2
        RR=$?
        STATUS=$( grep 'Scan result:' 1 )
    }
    what_scan_type()
    {
        if [ -z "${RL_STORE}" ]
        then
            return 0
        fi
        if [ -z "${RL_PACKAGE_URL}" ]
        then
            return 0
        fi
        return 1
    }
    showStdOutErr()
    {
        echo
        echo "## Stdout of reversinglabs/rl-scanner"
        cat 1
        echo
        echo
        echo "## Stderr of reversinglabs/rl-scanner"
        cat 2
        echo
    }
    test_missing_status()
    {
        [ -z "$STATUS" ] && {
            showStdOutErr
            msg="Fatal: cannot find the scan result in the output"
            doErr "$msg"
        }
    }
    set_status_PassFail()
    {
        # show using the scan result text line as explicit feedback message"
        if [ "${RR}" != "0" ]
        then
            echo "##vso[task.logissue type=error;] ${STATUS}; exit code: ${RR}"
            echo "##vso[task.complete result=Failed;]"
        else
            echo "##vso[task.complete result=Succeeded;]"
        fi
    }
    main()
    {
        RL_VERBOSE=$(isBool "${RL_VERBOSE}" )
        if [ "${RL_VERBOSE}" != "false" ]
        then
            do_verbose
        fi
        validate_params
        prep_report
        prep_paths
        prep_proxy_data
        makeDiffWith
        if what_scan_type
        then
            scan_no_store
        else
            scan_with_store
        fi
        if [ "${RL_VERBOSE}" != "false" ]
        then
            showStdOutErr
        fi
        test_missing_status
        set_status_PassFail
        exit ${RR}
    }
    # set
    main $*

  env: # pass secrets via env as is custom on Azure
    RLSECURE_ENCODED_LICENSE: ${{ parameters.RLSECURE_ENCODED_LICENSE }}
    RLSECURE_SITE_KEY: ${{ parameters.RLSECURE_SITE_KEY }}
  displayName: 'Run rl-scanner in docker'

# <<< publish reports always >>>
- publish: $(System.DefaultWorkingDirectory)/$(REPORT_PATH)/report.cyclonedx.json
  condition: and(succeededOrFailed(),eq(${{parameters.RL_WITH_UPLOAD}},'true'))
  displayName: 'Publish CycloneDX'
  artifact: 'CycloneDX-SBOM'

- publish: $(System.DefaultWorkingDirectory)/$(REPORT_PATH)/report.spdx.json
  condition: and(succeededOrFailed(),eq(${{parameters.RL_WITH_UPLOAD}},'true'))
  displayName: 'Publish SPDX'
  artifact: 'SPDX-SBOM'

- publish: $(System.DefaultWorkingDirectory)/$(REPORT_PATH)/report.rl.json
  condition: and(succeededOrFailed(),eq(${{parameters.RL_WITH_UPLOAD}},'true'))
  displayName: 'Publish RL-json'
  artifact: ReversingLabs-JSONreport

- task: PublishBuildArtifacts@1
  condition: and(succeededOrFailed(),eq(${{parameters.RL_WITH_UPLOAD}},'true'))
  inputs:
    PathtoPublish: $(System.DefaultWorkingDirectory)/$(REPORT_PATH)/rl-html
    ArtifactName: 'ReversingLabs-HTMLreport'
    StoreAsTar: true