rl-scanner-gitlab-include.yml

# REQUIREMENTS:
#
# A) We expect the calling environment to define the license secrets required for rl-scanner
#
#  - RLSECURE_SITE_KEY:
#    must be declared as global variables type 'variable'
#
#  - RLSECURE_ENCODED_LICENSE:
#    must be declared as global variables type 'variable'
#
# B) We expect the calling pipeline to set the following 3 environment variables
#
# - MY_ARTIFACT_TO_SCAN:
#   The artifact we will be scanning (the file name)
#
# - PACKAGE_PATH:
#   The relative location (relative to the checkout) of the artifact we will scan,
#   we expect to find the artifact to scan at: ${PACKAGE_PATH}/${MY_ARTIFACT_TO_SCAN}
#
# - REPORT_PATH:
#   A location where the reports will be created, (relative to the checkout).
#   Best provide a empty directory as all data currently present in REPORT_PATH
#   will be deleted before the scan starts.

# If we have a local runner configured using the Docker GitLab runner procedure,
# we can store scan results locally and optionally perform diff scan with:
# RL_STORE
# RL_PACKAGE_URL
# RL_DIFF_WITH

# If the local runner needs to access the internet via a proxy we support that using:
# RLSECURE_PROXY_SERVER
# RLSECURE_PROXY_PORT
# RLSECURE_PROXY_USER
# RLSECURE_PROXY_PASSWORD

# RL_VERBOSE

job-reversinglabs-rl-scanner:
  # This job will run in the test stage of the pipeline
  stage: test
      
  # We will run the reversinglabs/rl-scanner:latest Docker image,
  # but will use our own entry point to make it compatible with GitLab runner.
  image:
    name: reversinglabs/rl-scanner
    entrypoint: ["/bin/bash", "-c"]

  # The scan job will produce one artifact directory: REPORT_PATH
  # We will also upload the cyclonedx report separately as that is a supported report type by GitLab
  artifacts:
    name: "reversinglabs/rl-scanner/reports"
    when: always
    paths:
      - $REPORT_PATH/*
    reports:
      cyclonedx:
        - $REPORT_PATH/report.cyclonedx.json

  # Run the script to scan the provided artifact and produce a report.
  # Here we have access to all artifacts of the previous jobs (e.g. build).
  # This requires that the build step also defines artifacts.
  script:
    - |
      #! /bin/bash
      # PARAMS:
      # A) We expect the calling environment to define the license secrets required for rl-scanner
      #  - RLSECURE_SITE_KEY:
      #    must be declared as global variables type 'variable'
      #  - RLSECURE_ENCODED_LICENSE:
      #    must be declared as global variables type 'variable'
      #
      # B) We expect the calling pipeline to set the following 3 environment variables
      # - MY_ARTIFACT_TO_SCAN:
      #   The artifact we will be scanning (the file name)
      # - PACKAGE_PATH:
      #   The relative location (relative to the checkout) of the artifact we will scan,
      #   we expect to find the artifact to scan at: ${PACKAGE_PATH}/${MY_ARTIFACT_TO_SCAN}
      # - REPORT_PATH:
      #   A location where the reports will be created, (relative to the checkout).
      #   Best provide a empty directory as all data currently present in REPORT_PATH
      #   will be deleted before the scan starts.
      #
      # C) We support a optional Proxy configuration,
      # - RLSECURE_PROXY_SERVER: optional, string, default ''.
      # - RLSECURE_PROXY_PORT: optional, string, default ''.
      # - RLSECURE_PROXY_USER: optional, string, default ''.
      # - RLSECURE_PROXY_PASSWORD: optional, string, default ''.
      #
      # D) If we have a local runner configured using the Docker GitLab runner procedure,
      #    we can store scan results locally and optionally perform diff scan with:
      #    (If RL_STORE is configured you must also configure RL_PACKAGE_URL and vice versa)
      # - RL_STORE: optional, string, default ''.
      # - RL_PACKAGE_URL: optional, string, default ''.
      # - RL_DIFF_WITH: optional, string, default ''.
      #
      # E) Additional verbosity can be configured with:
      # - RL_VERBOSE: optional, default '' (anything else will be treated as true)
      set +e # we handle errors ourselves in this script
      do_verbose()
      {
          cat <<!
      REPORT_PATH:              ${REPORT_PATH:-No path specified}
      PACKAGE_PATH:             ${PACKAGE_PATH:-No path specified}
      MY_ARTIFACT_TO_SCAN:      ${MY_ARTIFACT_TO_SCAN:-No artifact specified}
      RL_LEVEL:                 ${RL_LEVEL:-No policy level was specified. Defaults to 5, unless RL_STORE is used.}
      RL_STORE:                 ${RL_STORE:-No path specified for RL_STORE: no diff scan can be executed}
      RL_PACKAGE_URL:           ${RL_PACKAGE_URL:-No package URL given: no diff scan can be executed}
      RL_DIFF_WITH:             ${RL_DIFF_WITH:-No diff with was requested}
      RLSECURE_PROXY_SERVER:    ${RLSECURE_PROXY_SERVER:-No proxy server was provided}
      RLSECURE_PROXY_PORT:      ${RLSECURE_PROXY_PORT:-No proxy port was provided}
      RLSECURE_PROXY_USER:      ${RLSECURE_PROXY_USER:-No proxy user was provided}
      RLSECURE_PROXY_PASSWORD:  ${RLSECURE_PROXY_PASSWORD:-No proxy pass was provided}
      !
      }
      fatal()
      {
          local msg="$1"
          echo "${msg}" >&2
          DESCRIPTION="${msg}"
          STATUS="error"
          exit 101
      }
      verify_licence()
      {
          [ -z "${RLSECURE_SITE_KEY}" ] && {
              msg="we require 'RLSECURE_SITE_KEY' to exist as an env variable"
              fatal "${msg}"
          }
          [ -z "${RLSECURE_ENCODED_LICENSE}" ] && {
              msg="we require 'RLSECURE_ENCODED_LICENSE' to exist as an env variable"
              fatal "${msg}"
          }
      }
      prep_report()
      {
          if [ -d "${REPORT_PATH}" ]
          then
              if rmdir "${REPORT_PATH}"
              then
                  :
              else
                  msg="FATAL: your current REPORT_PATH is not empty"
                  DESCRIPTION="${msg}"
                  STATUS="error"
                  exit 101
              fi
          fi
          mkdir -p "${REPORT_PATH}"
      }
      verify_paths()
      {
          [ -z "${REPORT_PATH}" ] && {
              msg="FATAL: 'REPORT_PATH' is not specified"
              fatal "$msg"
          }
          [ -f "./${PACKAGE_PATH}/${MY_ARTIFACT_TO_SCAN}" ] || {
              msg="missing artifact to scan: no file found at: ${PACKAGE_PATH}/${MY_ARTIFACT_TO_SCAN}"
              fatal "$msg"
          }
      }
      extractProjectFromPackageUrl()
      {
          echo "${RL_PACKAGE_URL}" |
          awk '{
              sub(/@.*/,"")       # remove the @Version part
              split($0, a , "/")  # we expect $Project/$Package
              print a[1]          # print Project
          }'
      }
      extractPackageFromPackageUrl()
      {
          echo "${RL_PACKAGE_URL}" |
          awk '{
              sub(/@.*/,"")       # remove the @Version part
              split($0, a , "/")  # we expect $Project/$Package
              print a[2]          # print Package
          }'
      }
      makeDiffWith()
      {
          DIFF_WITH=""
          if [ -z "$RL_STORE" ]
          then
              return
          fi
          if [ -z "${RL_PACKAGE_URL}" ]
          then
              return
          fi
          if [ -z "${RL_DIFF_WITH}" ]
          then
              return
          fi
          # Split the package URL and find Project and Package
          Project=$( extractProjectFromPackageUrl )
          Package=$( extractPackageFromPackageUrl )
          if [ ! -d "$RL_STORE/.rl-secure/projects/${Project}/packages/${Package}/versions/${RL_DIFF_WITH}" ]
          then
              echo "That version has not been scanned yet: ${RL_DIFF_WITH} in Project: ${Project} and Package: ${Package}"
              echo "No diff scan will be executed, only ${RL_PACKAGE_URL} will be scanned"
              return
          fi
          DIFF_WITH="--diff-with=${RL_DIFF_WITH}"
      }
      run_scan_nostore()
      {
          RL_LEVEL_STR=""
          if [ ! -z "${RL_LEVEL}" ]
          then
              RL_LEVEL_STR="--rl-level=$RL_LEVEL"
          fi
          rl-scan \
              $RL_LEVEL_STR --package-path="./${PACKAGE_PATH}/${MY_ARTIFACT_TO_SCAN}" \
              --report-path="${REPORT_PATH}" \
              --report-format=all 1>1 2>2
          RR=$?
      }
      run_scan_withstore()
      {
          rl-scan \
              --rl-store="${RL_STORE}" \
              --purl="${RL_PACKAGE_URL}" \
              --replace \
              --package-path="./${PACKAGE_PATH}/${MY_ARTIFACT_TO_SCAN}" \
              --report-path="${REPORT_PATH}" \
              --report-format=all \
              ${DIFF_WITH} 1>1 2>2
          RR=$?
      }
      get_scan_result_or_fail()
      {
          DESCRIPTION=$( grep 'Scan result:' 1 )
          [ -z "${DESCRIPTION}" ] && {
              # show stderr of the scan command on error
              echo "# StdErr:"
              cat 2
              echo
              echo "# StdOut:"
              cat 1
              echo
              msg="rl-scan exit with: $RR"
              fatal "${msg}"
          }
      }
      process_scan_result()
      {
          echo "# StdOut:"
          cat 1
          echo
          STATUS="failed"
          [ "${RR}" == "0" ] && {
              STATUS="success"
          }
          echo "Status: ${STATUS}; ${DESCRIPTION}"
          exit ${RR}
      }
      main()
      {
          if [ ! -z "${RL_VERBOSE}" ]
          then
              do_verbose
          fi
          verify_licence
          verify_paths
          prep_report
          makeDiffWith
          if [ -z "${RL_STORE}" ]
          then
              run_scan_nostore
          else
              run_scan_withstore
          fi
          get_scan_result_or_fail
          process_scan_result
      }
      main $*