SCA SBOM report format support (#542)

* Adding support to SBOM report format

* Adding support to SBOM report format
- The sca /export/requests api is not working properly

* Adding SCA SBOM report features

* SCA SBOM
- improvements
- unity + integration tests

* linter

* pr review suggestions && fixes

* improving SBOM error messages

Author: igorlombacx

cmd/main.go

@@ -42,9 +42,11 @@ func main() {
 	descriptionsPath := viper.GetString(params.DescriptionsPathKey)
 	tenantConfigurationPath := viper.GetString(params.TenantConfigurationPathKey)
 	resultsPdfPath := viper.GetString(params.ResultsPdfReportPathKey)
+	resultsSbomPath := viper.GetString(params.ResultsSbomReportPathKey)
 
 	scansWrapper := wrappers.NewHTTPScansWrapper(scans)
 	resultsPdfReportsWrapper := wrappers.NewResultsPdfReportsHTTPWrapper(resultsPdfPath)
+	resultsSbomReportsWrapper := wrappers.NewResultsSbomReportsHTTPWrapper(resultsSbomPath)
 	groupsWrapper := wrappers.NewHTTPGroupsWrapper(groups)
 	logsWrapper := wrappers.NewLogsWrapper(logs)
 	uploadsWrapper := wrappers.NewUploadsHTTPWrapper(uploads)
@@ -68,6 +70,7 @@ func main() {
 
 	astCli := commands.NewAstCLI(
 		scansWrapper,
+		resultsSbomReportsWrapper,
 		resultsPdfReportsWrapper,
 		resultsPredicatesWrapper,
 		codeBashingWrapper,

internal/commands/result.go

@@ -24,48 +24,51 @@ import (
 )
 
 const (
-	failedCreatingSummary    = "Failed creating summary"
-	failedGettingScan        = "Failed getting scan"
-	failedListingResults     = "Failed listing results"
-	failedListingCodeBashing = "Failed codebashing link"
-	mediumLabel              = "medium"
-	highLabel                = "high"
-	lowLabel                 = "low"
-	infoLabel                = "info"
-	sonarTypeLabel           = "_sonar"
-	directoryPermission      = 0700
-	infoSonar                = "INFO"
-	lowSonar                 = "MINOR"
-	mediumSonar              = "MAJOR"
-	highSonar                = "CRITICAL"
-	infoLowSarif             = "note"
-	mediumSarif              = "warning"
-	highSarif                = "error"
-	vulnerabilitySonar       = "VULNERABILITY"
-	infoCx                   = "INFO"
-	lowCx                    = "LOW"
-	mediumCx                 = "MEDIUM"
-	highCx                   = "HIGH"
-	codeBashingKey           = "cb-url"
-	failedGettingBfl         = "Failed getting BFL"
-	notAvailableString       = "N/A"
-	notAvailableNumber       = -1
-	defaultPaddingSize       = -14
-	scanPendingMessage       = "Scan triggered in asynchronous mode or still running. Click more details to get the full status."
-	scaType                  = "sca"
-	directDependencyType     = "Direct Dependency"
-	indirectDependencyType   = "Transitive Dependency"
-	startedStatus            = "started"
-
+	failedCreatingSummary     = "Failed creating summary"
+	failedGettingScan         = "Failed getting scan"
+	failedListingResults      = "Failed listing results"
+	failedListingCodeBashing  = "Failed codebashing link"
+	mediumLabel               = "medium"
+	highLabel                 = "high"
+	lowLabel                  = "low"
+	infoLabel                 = "info"
+	sonarTypeLabel            = "_sonar"
+	directoryPermission       = 0700
+	infoSonar                 = "INFO"
+	lowSonar                  = "MINOR"
+	mediumSonar               = "MAJOR"
+	highSonar                 = "CRITICAL"
+	infoLowSarif              = "note"
+	mediumSarif               = "warning"
+	highSarif                 = "error"
+	vulnerabilitySonar        = "VULNERABILITY"
+	infoCx                    = "INFO"
+	lowCx                     = "LOW"
+	mediumCx                  = "MEDIUM"
+	highCx                    = "HIGH"
+	codeBashingKey            = "cb-url"
+	failedGettingBfl          = "Failed getting BFL"
+	notAvailableString        = "N/A"
+	notAvailableNumber        = -1
+	defaultPaddingSize        = -14
+	scanPendingMessage        = "Scan triggered in asynchronous mode or still running. Click more details to get the full status."
+	scaType                   = "sca"
+	directDependencyType      = "Direct Dependency"
+	indirectDependencyType    = "Transitive Dependency"
+	startedStatus             = "started"
 	completedStatus           = "completed"
+	exportingStatus           = "Exporting"
+	pendingStatus             = "Pending"
 	pdfToEmailFlagDescription = "Send the PDF report to the specified email address." +
 		" Use \",\" as the delimiter for multiple emails"
 	pdfOptionsFlagDescription = "Sections to generate PDF report. Available options: Iac-Security,Sast,Sca," +
 		defaultPdfOptionsDataSections
-	delayValueForPdfReport                  = 150
+	sbomReportFlagDescription               = "Sections to generate SBOM report. Available options: CycloneDxJson,CycloneDxXml,SpdxJson"
+	delayValueForReport                     = 150
 	reportNameScanReport                    = "scan-report"
 	reportTypeEmail                         = "email"
 	defaultPdfOptionsDataSections           = "ScanSummary,ExecutiveSummary,ScanResults"
+	defaultSbomOption                       = "CycloneDxJson"
 	exploitablePathFlagDescription          = "Enable or disable exploitable path in scan. Available options: true,false"
 	scaLastScanTimeFlagDescription          = "SCA last scan time. Available options: integer above 1"
 	projectPrivatePackageFlagDescription    = "Enable or disable project private package. Available options: true,false"
@@ -109,6 +112,7 @@ var sonarSeverities = map[string]string{
 func NewResultsCommand(
 	resultsWrapper wrappers.ResultsWrapper,
 	scanWrapper wrappers.ScansWrapper,
+	resultsSbomWrapper wrappers.ResultsSbomWrapper,
 	resultsPdfReportsWrapper wrappers.ResultsPdfWrapper,
 	codeBashingWrapper wrappers.CodeBashingWrapper,
 	bflWrapper wrappers.BflWrapper,
@@ -125,7 +129,7 @@ func NewResultsCommand(
 			),
 		},
 	}
-	showResultCmd := resultShowSubCommand(resultsWrapper, scanWrapper, resultsPdfReportsWrapper, risksOverviewWrapper)
+	showResultCmd := resultShowSubCommand(resultsWrapper, scanWrapper, resultsSbomWrapper, resultsPdfReportsWrapper, risksOverviewWrapper)
 	codeBashingCmd := resultCodeBashing(codeBashingWrapper)
 	bflResultCmd := resultBflSubCommand(bflWrapper)
 	resultCmd.AddCommand(
@@ -137,6 +141,7 @@ func NewResultsCommand(
 func resultShowSubCommand(
 	resultsWrapper wrappers.ResultsWrapper,
 	scanWrapper wrappers.ScansWrapper,
+	resultsSbomWrapper wrappers.ResultsSbomWrapper,
 	resultsPdfReportsWrapper wrappers.ResultsPdfWrapper,
 	risksOverviewWrapper wrappers.RisksOverviewWrapper,
 ) *cobra.Command {
@@ -149,7 +154,7 @@ func resultShowSubCommand(
 			$ cx results show --scan-id <scan Id>
 		`,
 		),
-		RunE: runGetResultCommand(resultsWrapper, scanWrapper, resultsPdfReportsWrapper, risksOverviewWrapper),
+		RunE: runGetResultCommand(resultsWrapper, scanWrapper, resultsSbomWrapper, resultsPdfReportsWrapper, risksOverviewWrapper),
 	}
 	addScanIDFlag(resultShowCmd, "ID to report on.")
 	addResultFormatFlag(
@@ -159,10 +164,12 @@ func resultShowSubCommand(
 		printer.FormatSummaryConsole,
 		printer.FormatSarif,
 		printer.FormatSummaryJSON,
+		printer.FormatSbom,
 		printer.FormatPDF,
 		printer.FormatSummaryMarkdown,
 	)
 	resultShowCmd.PersistentFlags().String(commonParams.ReportFormatPdfToEmailFlag, "", pdfToEmailFlagDescription)
+	resultShowCmd.PersistentFlags().String(commonParams.ReportSbomFormatFlag, defaultSbomOption, sbomReportFlagDescription)
 	resultShowCmd.PersistentFlags().String(commonParams.ReportFormatPdfOptionsFlag, defaultPdfOptionsDataSections, pdfOptionsFlagDescription)
 	resultShowCmd.PersistentFlags().String(commonParams.TargetFlag, "cx_result", "Output file")
 	resultShowCmd.PersistentFlags().String(commonParams.TargetPathFlag, ".", "Output Path")
@@ -511,6 +518,7 @@ func generateScanSummaryURL(summary *wrappers.ResultSummary) string {
 func runGetResultCommand(
 	resultsWrapper wrappers.ResultsWrapper,
 	scanWrapper wrappers.ScansWrapper,
+	resultsSbomWrapper wrappers.ResultsSbomWrapper,
 	resultsPdfReportsWrapper wrappers.ResultsPdfWrapper,
 	risksOverviewWrapper wrappers.RisksOverviewWrapper,
 ) func(cmd *cobra.Command, args []string) error {
@@ -520,6 +528,7 @@ func runGetResultCommand(
 		format, _ := cmd.Flags().GetString(commonParams.TargetFormatFlag)
 		formatPdfToEmail, _ := cmd.Flags().GetString(commonParams.ReportFormatPdfToEmailFlag)
 		formatPdfOptions, _ := cmd.Flags().GetString(commonParams.ReportFormatPdfOptionsFlag)
+		formatSbomOptions, _ := cmd.Flags().GetString(commonParams.ReportSbomFormatFlag)
 
 		scanID, _ := cmd.Flags().GetString(commonParams.ScanIDFlag)
 		params, err := getFilters(cmd)
@@ -530,11 +539,13 @@ func runGetResultCommand(
 			resultsWrapper,
 			risksOverviewWrapper,
 			scanWrapper,
+			resultsSbomWrapper,
 			resultsPdfReportsWrapper,
 			scanID,
 			format,
 			formatPdfToEmail,
 			formatPdfOptions,
+			formatSbomOptions,
 			targetFile,
 			targetPath,
 			params)
@@ -585,11 +596,13 @@ func CreateScanReport(
 	resultsWrapper wrappers.ResultsWrapper,
 	risksOverviewWrapper wrappers.RisksOverviewWrapper,
 	scanWrapper wrappers.ScansWrapper,
+	resultsSbomWrapper wrappers.ResultsSbomWrapper,
 	resultsPdfReportsWrapper wrappers.ResultsPdfWrapper,
 	scanID,
 	reportTypes,
 	formatPdfToEmail,
 	formatPdfOptions,
+	formatSbomOptions,
 	targetFile,
 	targetPath string,
 	params map[string]string,
@@ -621,7 +634,7 @@ func CreateScanReport(
 
 	reportList := strings.Split(reportTypes, ",")
 	for _, reportType := range reportList {
-		err = createReport(reportType, formatPdfToEmail, formatPdfOptions, targetFile, targetPath, results, summary, resultsPdfReportsWrapper)
+		err = createReport(reportType, formatPdfToEmail, formatPdfOptions, formatSbomOptions, targetFile, targetPath, results, summary, resultsSbomWrapper, resultsPdfReportsWrapper)
 		if err != nil {
 			return err
 		}
@@ -674,10 +687,12 @@ func createReport(
 	format,
 	formatPdfToEmail,
 	formatPdfOptions,
+	formatSbomOptions,
 	targetFile,
 	targetPath string,
 	results *wrappers.ScanResultsCollection,
 	summary *wrappers.ResultSummary,
+	resultsSbomWrapper wrappers.ResultsSbomWrapper,
 	resultsPdfReportsWrapper wrappers.ResultsPdfWrapper,
 
 ) error {
@@ -719,8 +734,20 @@ func createReport(
 		convertNotAvailableNumberToZero(summary)
 		return writeMarkdownSummary(summaryRpt, summary)
 	}
-	err := fmt.Errorf("bad report format %s", format)
-	return err
+	if printer.IsFormat(format, printer.FormatSbom) {
+		targetType := printer.FormatJSON
+		if strings.Contains(strings.ToLower(formatSbomOptions), printer.FormatXML) {
+			targetType = printer.FormatXML
+		}
+		summaryRpt := createTargetName(fmt.Sprintf("%s_%s", targetFile, printer.FormatSbom), targetPath, targetType)
+		convertNotAvailableNumberToZero(summary)
+
+		if !contains(summary.EnginesEnabled, scaType) {
+			return fmt.Errorf("to generate %s report, SCA engine must be enabled on scan summary", printer.FormatSbom)
+		}
+		return exportSbomResults(resultsSbomWrapper, summaryRpt, summary, formatSbomOptions)
+	}
+	return fmt.Errorf("bad report format %s", format)
 }
 
 func createTargetName(targetFile, targetPath, targetType string) string {
@@ -869,9 +896,47 @@ func exportJSONSummaryResults(targetFile string, results *wrappers.ResultSummary
 	return nil
 }
 
+func exportSbomResults(sbomWrapper wrappers.ResultsSbomWrapper, targetFile string, results *wrappers.ResultSummary, formatSbomOptions string) error {
+	payload := &wrappers.SbomReportsPayload{
+		ScanID:     results.ScanID,
+		FileFormat: defaultSbomOption,
+	}
+	if formatSbomOptions != "" && formatSbomOptions != defaultSbomOption {
+		format, err := validateSbomOptions(formatSbomOptions)
+		if err != nil {
+			return err
+		}
+		payload.FileFormat = format
+	}
+
+	pollingResp := &wrappers.SbomPollingResponse{}
+
+	sbomresp, err := sbomWrapper.GenerateSbomReport(payload)
+	if err != nil {
+		return err
+	}
+
+	log.Println("Generating SBOM report with " + payload.FileFormat + " file format")
+	pollingResp.ExportStatus = exportingStatus
+	for pollingResp.ExportStatus == exportingStatus || pollingResp.ExportStatus == pendingStatus {
+		pollingResp, err = sbomWrapper.GetSbomReportStatus(sbomresp.ExportID)
+		if err != nil {
+			return errors.Wrapf(err, "%s", "failed getting SBOM report status")
+		}
+		time.Sleep(delayValueForReport * time.Millisecond)
+	}
+	if !strings.EqualFold(pollingResp.ExportStatus, completedStatus) {
+		return errors.Errorf("SBOM generating failed - Current status: %s", pollingResp.ExportStatus)
+	}
+	err = sbomWrapper.DownloadSbomReport(pollingResp.ExportID, targetFile)
+	if err != nil {
+		return errors.Wrapf(err, "%s", "Failed downloading SBOM report")
+	}
+	return nil
+}
 func exportPdfResults(pdfWrapper wrappers.ResultsPdfWrapper, summary *wrappers.ResultSummary, summaryRpt, formatPdfToEmail, pdfOptions string) error {
 	pdfReportsPayload := &wrappers.PdfReportsPayload{}
-	poolingResp := &wrappers.PdfPoolingResponse{}
+	pollingResp := &wrappers.PdfPollingResponse{}
 
 	pdfOptionsSections, pdfOptionsEngines, err := validatePdfOptions(pdfOptions)
 	if err != nil {
@@ -910,16 +975,16 @@ func exportPdfResults(pdfWrapper wrappers.ResultsPdfWrapper, summary *wrappers.R
 	}
 
 	log.Println("Generating PDF report")
-	poolingResp.Status = startedStatus
-	for poolingResp.Status == startedStatus {
-		poolingResp, webErr, err = pdfWrapper.CheckPdfReportStatus(pdfReportID.ReportID)
+	pollingResp.Status = startedStatus
+	for pollingResp.Status == startedStatus {
+		pollingResp, webErr, err = pdfWrapper.CheckPdfReportStatus(pdfReportID.ReportID)
 		if err != nil || webErr != nil {
 			return errors.Wrapf(err, "%v", webErr)
 		}
-		time.Sleep(delayValueForPdfReport * time.Millisecond)
+		time.Sleep(delayValueForReport * time.Millisecond)
 	}
-	if poolingResp.Status != completedStatus {
-		return errors.Errorf("PDF generating failed - Current status: %s", poolingResp.Status)
+	if pollingResp.Status != completedStatus {
+		return errors.Errorf("PDF generating failed - Current status: %s", pollingResp.Status)
 	}
 	err = pdfWrapper.DownloadPdfReport(pdfReportID.ReportID, summaryRpt)
 	if err != nil {
@@ -928,6 +993,19 @@ func exportPdfResults(pdfWrapper wrappers.ResultsPdfWrapper, summary *wrappers.R
 	return nil
 }
 
+func validateSbomOptions(sbomOption string) (string, error) {
+	var sbomOptionsStringMap = map[string]string{
+		"cyclonedxjson": "CycloneDxJson",
+		"cyclonedxxml":  "CycloneDxXml",
+		"spdxjson":      "SpdxJson",
+	}
+	sbomOption = strings.ToLower(strings.ReplaceAll(sbomOption, " ", ""))
+	if sbomOptionsStringMap[sbomOption] != "" {
+		return sbomOptionsStringMap[sbomOption], nil
+	}
+	return "", errors.Errorf("invalid SBOM option: %s", sbomOption)
+}
+
 func validatePdfOptions(pdfOptions string) (pdfOptionsSections, pdfOptionsEngines []string, err error) {
 	var pdfOptionsSectionsMap = map[string]string{
 		"scansummary":      "ScanSummary",

internal/commands/result_test.go

@@ -277,3 +277,28 @@ func TestRunGetResultsGeneratingPdfReporWithOptions(t *testing.T) {
 	_, err = os.Stat(fmt.Sprintf("%s.%s", fileName, printer.FormatPDF))
 	assert.NilError(t, err, "report file should exist: "+fileName+printer.FormatPDF)
 }
+
+func TestSBOMReportInvalidSBOMOption(t *testing.T) {
+	err := execCmdNotNilAssertion(t,
+		"results", "show",
+		"--report-format", "sbom",
+		"--scan-id", "MOCK",
+		"--report-sbom-format", "invalid")
+	assert.Equal(t, err.Error(), "invalid SBOM option: invalid", "Wrong expected error message")
+}
+
+func TestSBOMReportJson(t *testing.T) {
+	execCmdNilAssertion(t, "results", "show", "--scan-id", "MOCK", "--report-format", "sbom")
+	_, err := os.Stat(fmt.Sprintf("%s.%s", fileName+"_"+printer.FormatSbom, printer.FormatJSON))
+	assert.NilError(t, err, "Report file should exist for extension "+printer.FormatJSON)
+	// Remove generated json file
+	os.Remove(fmt.Sprintf("%s.%s", fileName+"_"+printer.FormatSbom, printer.FormatJSON))
+}
+
+func TestSBOMReportXML(t *testing.T) {
+	execCmdNilAssertion(t, "results", "show", "--scan-id", "MOCK", "--report-format", "sbom", "--report-sbom-format", "CycloneDxXml")
+	_, err := os.Stat(fmt.Sprintf("%s.%s", fileName+"_"+printer.FormatSbom, printer.FormatXML))
+	assert.NilError(t, err, "Report file should exist for extension "+printer.FormatXML)
+	// Remove generated json file
+	os.Remove(fmt.Sprintf("%s.%s", fileName+"_"+printer.FormatSbom, printer.FormatXML))
+}

internal/commands/root.go

@@ -24,6 +24,7 @@ const ErrorCodeFormat = "%s: CODE: %d, %s\n"
 // NewAstCLI Return a Checkmarx One CLI root command to execute
 func NewAstCLI(
 	scansWrapper wrappers.ScansWrapper,
+	resultsSbomWrapper wrappers.ResultsSbomWrapper,
 	resultsPdfReportsWrapper wrappers.ResultsPdfWrapper,
 	resultsPredicatesWrapper wrappers.ResultsPredicatesWrapper,
 	codeBashingWrapper wrappers.CodeBashingWrapper,
@@ -128,6 +129,7 @@ func NewAstCLI(
 	// Create the CLI command structure
 	scanCmd := NewScanCommand(
 		scansWrapper,
+		resultsSbomWrapper,
 		resultsPdfReportsWrapper,
 		uploadsWrapper,
 		resultsWrapper,
@@ -141,6 +143,7 @@ func NewAstCLI(
 	resultsCmd := NewResultsCommand(
 		resultsWrapper,
 		scansWrapper,
+		resultsSbomWrapper,
 		resultsPdfReportsWrapper,
 		codeBashingWrapper,
 		bflWrapper,