Examples with ToolDependency com.epam.pipeline.entity.scan.ToolDependency used on opensource projects

Example 1 with ToolDependency

use of com.epam.pipeline.entity.scan.ToolDependency in project cloud-pipeline by epam.

the class AggregatingToolScanManager method convertResults.

private ToolVersionScanResult convertResults(ClairScanResult clairScanResult, DockerComponentScanResult compScanResult, Tool tool, String tag, String digest) {
    List<Vulnerability> vulnerabilities = Optional.ofNullable(clairScanResult).map(result -> ListUtils.emptyIfNull(result.getFeatures()).stream()).orElse(Stream.empty()).flatMap(f -> f.getVulnerabilities() != null ? f.getVulnerabilities().stream().map(v -> {
        Vulnerability vulnerability = new Vulnerability();
        vulnerability.setName(v.getName());
        vulnerability.setDescription(v.getDescription());
        vulnerability.setFixedBy(v.getFixedBy());
        vulnerability.setLink(v.getLink());
        vulnerability.setSeverity(v.getSeverity());
        vulnerability.setFeature(f.getName());
        vulnerability.setFeatureVersion(f.getVersion());
        return vulnerability;
    }) : Stream.empty()).collect(Collectors.toList());
    LOGGER.debug("Found: " + vulnerabilities.size() + " vulnerabilities for " + tool.getImage() + ":" + tag);
    // Concat dependencies from Clair and DockerCompScan
    List<ToolDependency> dependencies = Stream.concat(Optional.ofNullable(compScanResult).map(result -> ListUtils.emptyIfNull(result.getLayers()).stream()).orElse(Stream.empty()).flatMap(l -> l.getDependencies().stream().peek(dependency -> {
        dependency.setToolVersion(tag);
        dependency.setToolId(tool.getId());
    })), Optional.ofNullable(clairScanResult).map(result -> ListUtils.emptyIfNull(result.getFeatures()).stream()).orElse(Stream.empty()).map(f -> new ToolDependency(tool.getId(), tag, f.getName(), f.getVersion(), ToolDependency.Ecosystem.SYSTEM, null))).collect(Collectors.toList());
    LOGGER.debug("Found: " + dependencies.size() + " dependencies for " + tool.getImage() + ":" + tag);
    return new ToolVersionScanResult(tag, vulnerabilities, dependencies, ToolScanStatus.COMPLETED, clairScanResult.getName(), digest);
}