path: root/buildscripts/blackduck_hub.py

#!/usr/bin/env python3
"""Utility script to run Black Duck scans and query Black Duck database."""
#pylint: disable=too-many-lines

import argparse
import functools
import io
import json
import logging
import os
import re
import subprocess
import sys
import tempfile
import time
import warnings

from abc import ABCMeta, abstractmethod
from typing import Dict, List, Optional

import urllib3.util.retry as urllib3_retry
import requests
import yaml

from blackduck.HubRestApi import HubInstance

try:
    import requests.packages.urllib3.exceptions as urllib3_exceptions  #pylint: disable=ungrouped-imports
except ImportError:
    # Versions of the requests package prior to 1.2.0 did not vendor the urllib3 package.
    urllib3_exceptions = None

LOGGER = logging.getLogger(__name__)

############################################################################

# Name of project to upload to and query about
BLACKDUCK_PROJECT = "mongodb/mongo"

# Version of project to query about
# Black Duck automatically determines the version based on branch
BLACKDUCK_PROJECT_VERSION = "master"

# Timeout to wait for a Black Duck scan to complete
BLACKDUCK_TIMEOUT_SECS = 600

# Black Duck hub api uses this file to get settings
BLACKDUCK_RESTCONFIG = ".restconfig.json"

# Wiki page where we document more information about Black Duck
BLACKDUCK_WIKI_PAGE = "https://wiki.corp.mongodb.com/display/KERNEL/Black+Duck"

# Black Duck failed report prefix
BLACKDUCK_FAILED_PREFIX = "A Black Duck scan was run and failed"

# Black Duck default teaam
BLACKDUCK_DEFAULT_TEAM = "Service Development Platform"

############################################################################

# Globals
BLACKDUCK_PROJECT_URL = None

############################################################################

# Build Logger constants

BUILD_LOGGER_CREATE_BUILD_ENDPOINT = "/build"
BUILD_LOGGER_APPEND_GLOBAL_LOGS_ENDPOINT = "/build/%(build_id)s"
BUILD_LOGGER_CREATE_TEST_ENDPOINT = "/build/%(build_id)s/test"
BUILD_LOGGER_APPEND_TEST_LOGS_ENDPOINT = "/build/%(build_id)s/test/%(test_id)s"

BUILD_LOGGER_DEFAULT_URL = "https://logkeeper.mongodb.org"
BUILD_LOGGER_TIMEOUT_SECS = 65

LOCAL_REPORTS_DIR = "bd_reports"

############################################################################

THIRD_PARTY_DIRECTORIES = [
    'src/third_party/wiredtiger/test/3rdparty',
    'src/third_party',
]

THIRD_PARTY_COMPONENTS_FILE = "etc/third_party_components.yml"

############################################################################

RE_LETTERS = re.compile("[A-Za-z]{2,}")


def default_if_none(value, default):
    """Set default if value is 'None'."""
    return value if value is not None else default


# Derived from buildscripts/resmokelib/logging/handlers.py
class HTTPHandler(object):
    """A class which sends data to a web server using POST requests."""

    def __init__(self, url_root, username, password, should_retry=False):
        """Initialize the handler with the necessary authentication credentials."""

        self.auth_handler = requests.auth.HTTPBasicAuth(username, password)

        self.session = requests.Session()

        if should_retry:
            retry_status = [500, 502, 503, 504]  # Retry for these statuses.
            retry = urllib3_retry.Retry(
                backoff_factor=0.1,  # Enable backoff starting at 0.1s.
                allowed_methods=False,  # Support all HTTP verbs.
                status_forcelist=retry_status)

            adapter = requests.adapters.HTTPAdapter(max_retries=retry)
            self.session.mount('http://', adapter)
            self.session.mount('https://', adapter)

        self.url_root = url_root

    def make_url(self, endpoint):
        """Generate a url to post to."""
        return "%s/%s/" % (self.url_root.rstrip("/"), endpoint.strip("/"))

    def post(self, endpoint, data=None, headers=None, timeout_secs=BUILD_LOGGER_TIMEOUT_SECS):
        """
        Send a POST request to the specified endpoint with the supplied data.

        Return the response, either as a string or a JSON object based
        on the content type.
        """

        data = default_if_none(data, [])
        data = json.dumps(data)

        headers = default_if_none(headers, {})
        headers["Content-Type"] = "application/json; charset=utf-8"

        url = self.make_url(endpoint)

        LOGGER.info("POSTING to %s", url)

        with warnings.catch_warnings():
            if urllib3_exceptions is not None:
                try:
                    warnings.simplefilter("ignore", urllib3_exceptions.InsecurePlatformWarning)
                except AttributeError:
                    # Versions of urllib3 prior to 1.10.3 didn't define InsecurePlatformWarning.
                    # Versions of requests prior to 2.6.0 didn't have a vendored copy of urllib3
                    # that defined InsecurePlatformWarning.
                    pass

                try:
                    warnings.simplefilter("ignore", urllib3_exceptions.InsecureRequestWarning)
                except AttributeError:
                    # Versions of urllib3 prior to 1.9 didn't define InsecureRequestWarning.
                    # Versions of requests prior to 2.4.0 didn't have a vendored copy of urllib3
                    # that defined InsecureRequestWarning.
                    pass

            response = self.session.post(url, data=data, headers=headers, timeout=timeout_secs,
                                         auth=self.auth_handler, verify=True)

        response.raise_for_status()

        if not response.encoding:
            response.encoding = "utf-8"

        headers = response.headers

        if headers["Content-Type"].startswith("application/json"):
            return response.json()

        return response.text


# Derived from buildscripts/resmokelib/logging/buildlogger.py
class BuildloggerServer(object):
    # pylint: disable=too-many-instance-attributes
    """
    A remote server to which build logs can be sent.

    It is used to retrieve handlers that can then be added to logger
    instances to send the log to the servers.
    """

    def __init__(self, username, password, task_id, builder, build_num, build_phase, url):
        # pylint: disable=too-many-arguments
        """Initialize BuildloggerServer."""
        self.username = username
        self.password = password
        self.builder = builder
        self.build_num = build_num
        self.build_phase = build_phase
        self.url = url
        self.task_id = task_id

        self.handler = HTTPHandler(url_root=self.url, username=self.username,
                                   password=self.password, should_retry=True)

    def new_build_id(self, suffix):
        """Return a new build id for sending global logs to."""
        builder = "%s_%s" % (self.builder, suffix)
        build_num = int(self.build_num)

        response = self.handler.post(
            BUILD_LOGGER_CREATE_BUILD_ENDPOINT, data={
                "builder": builder,
                "buildnum": build_num,
                "task_id": self.task_id,
            })

        return response["id"]

    def new_test_id(self, build_id, test_filename, test_command):
        """Return a new test id for sending test logs to."""
        endpoint = BUILD_LOGGER_CREATE_TEST_ENDPOINT % {"build_id": build_id}

        response = self.handler.post(
            endpoint, data={
                "test_filename": test_filename,
                "command": test_command,
                "phase": self.build_phase,
                "task_id": self.task_id,
            })

        return response["id"]

    def post_new_file(self, build_id, test_name, lines):
        """Post a new file to the build logger server."""
        test_id = self.new_test_id(build_id, test_name, "foo")
        endpoint = BUILD_LOGGER_APPEND_TEST_LOGS_ENDPOINT % {
            "build_id": build_id,
            "test_id": test_id,
        }

        dt = time.time()

        dlines = [(dt, line) for line in lines]

        try:
            self.handler.post(endpoint, data=dlines)
        except requests.HTTPError as err:
            # Handle the "Request Entity Too Large" error, set the max size and retry.
            raise ValueError("Encountered an HTTP error: %s" % (err))
        except requests.RequestException as err:
            raise ValueError("Encountered a network error: %s" % (err))
        except:  # pylint: disable=bare-except
            raise ValueError("Encountered an error.")

        return self.handler.make_url(endpoint)


def _to_dict(items, func):
    dm = {}

    for i in items:
        tuple1 = func(i)
        dm[tuple1[0]] = tuple1[1]

    return dm


def _compute_security_risk(security_risk_profile):
    counts = security_risk_profile["counts"]

    cm = _to_dict(counts, lambda i: (i["countType"], int(i["count"])))

    priorities = ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'OK', 'UNKNOWN']

    for priority in priorities:
        if cm[priority] > 0:
            return priority

    return "OK"


@functools.total_ordering
class VersionInfo:
    """Parse and break apart version strings so they can be compared."""

    def __init__(self, ver_str):
        """Parse a version string input a tuple of ints or mark it as a beta release."""
        try:

            self.ver_str = ver_str
            self.production_version = True

            # Abseil has an empty string for one version
            if self.ver_str == "":
                self.production_version = False
                return

            # Special case Intel's Decimal library since it is just too weird
            if ver_str == "v2.0 U1":
                self.ver_array = [2, 0]
                return

            # BlackDuck thinks boost 1.70.0 was released on 2007 which means we have to check hundreds of versions
            bad_keywords = ["(", "+b", "-b", "b1", ".0a"]
            if [bad for bad in bad_keywords if bad in self.ver_str]:
                self.production_version = False
                return

            # Clean the version information
            # Some versions start with 'v'. Some components have a mix of 'v' and not 'v' prefixed versions so trim the 'v'
            # MongoDB versions start with 'r'
            if ver_str[0] == 'v' or ver_str[0] == 'r':
                self.ver_str = ver_str[1:]

            # Git hashes are not valid versions
            if len(self.ver_str) == 40 and bytes.fromhex(self.ver_str):
                self.production_version = False
                return

            # Clean out Mozilla's suffix
            self.ver_str = self.ver_str.replace("esr", "")

            # Clean out GPerfTool's prefix
            self.ver_str = self.ver_str.replace("gperftools-", "")

            # Clean out Yaml Cpp's prefix
            self.ver_str = self.ver_str.replace("yaml-cpp-", "")

            # Clean out Boosts's prefix
            self.ver_str = self.ver_str.replace("boost-", "")
            self.ver_str = self.ver_str.replace("asio-", "")

            if self.ver_str.endswith('-'):
                self.ver_str = self.ver_str[0:-1]

            # Boost keeps varying the version strings so filter for anything with 2 or more ascii charaters
            if RE_LETTERS.search(self.ver_str):
                self.production_version = False
                return

            # Some versions end with "-\d", change the "-" since it just means a patch release from a debian/rpm package
            # yaml-cpp has this problem where Black Duck sourced the wrong version information
            self.ver_str = self.ver_str.replace("-", ".")

            # If we trimmed the string to nothing, treat it as a beta version
            if self.ver_str == '':
                self.production_version = False
                return

            # Versions are generally a multi-part integer tuple
            self.ver_array = [int(part) for part in self.ver_str.split(".")]

        except:
            LOGGER.error("Failed to parse version '%s' as '%s', exception", ver_str, self.ver_str)
            raise

    def __repr__(self):
        return self.__str__()

    def __str__(self):
        return ".".join([str(val) for val in self.ver_array])

    def __eq__(self, other):
        return (self.production_version, self.ver_array) == (other.production_version,
                                                             other.ver_array)

    def __gt__(self, other):
        if self.production_version != other.production_version:
            return self.production_version

        return self.ver_array > other.ver_array


def _test_version_info():
    VersionInfo("v2.0 U1")
    VersionInfo("60.7.0-esr")
    VersionInfo("v1.1")
    VersionInfo("0.4.2-1")
    VersionInfo("7.0.2")
    VersionInfo("gperftools-2.8")
    VersionInfo("v1.5-rc2")
    VersionInfo("r4.7.0-alpha")
    VersionInfo("r4.2.10")
    VersionInfo("2.0.0.1")
    VersionInfo("7.0.2-2")
    VersionInfo("git")
    VersionInfo("20200225.2")
    VersionInfo('release-68-alpha')
    VersionInfo('cldr/2020-09-22')
    VersionInfo('release-67-rc')
    VersionInfo('66.1~rc')
    VersionInfo('release-66-rc')
    VersionInfo('release-66-preview')
    VersionInfo('65.1')
    VersionInfo('release-65-rc')
    VersionInfo('64.2-rc')
    VersionInfo('release-64-rc2')
    VersionInfo('release-63-rc')
    VersionInfo('last-cvs-commit')
    VersionInfo('last-svn-commit')
    VersionInfo('release-62-rc')
    VersionInfo('cldr-32-beta2')
    VersionInfo('release-60-rc')
    VersionInfo('milestone-60-0-1')
    VersionInfo('release-59-rc')
    VersionInfo('milestone-59-0-1')
    VersionInfo('release-58-2-eclipse-20170118')
    VersionInfo('tools-release-58')
    VersionInfo('icu-latest')
    VersionInfo('icu4j-latest')
    VersionInfo('icu4j-release-58-1')
    VersionInfo('icu4j-release-58-rc')
    VersionInfo('icu-release-58-rc')
    VersionInfo('icu-milestone-58-0-1')
    VersionInfo('icu4j-milestone-58-0-1')

    VersionInfo('yaml-cpp-0.6.3')

    VersionInfo('gb-c8-task188949.100')
    VersionInfo('1.2.8-alt1.M80C.1')
    VersionInfo('1.2.8-alt2')

    assert VersionInfo('7.0.2.2') > VersionInfo('7.0.0.1')
    assert VersionInfo('7.0.2.2') > VersionInfo('7.0.2')
    assert VersionInfo('7.0.2.2') > VersionInfo('3.1')
    assert VersionInfo('7.0.2.2') <= VersionInfo('8.0.2')


class Component:
    """
    Black Duck Component description.

    Contains a subset of information about a component extracted from Black Duck for a given project and version
    """

    def __init__(self, name, version, licenses, policy_status, security_risk, newest_release,
                 is_manually_added):
        # pylint: disable=too-many-arguments
        """Initialize Black Duck component."""
        self.name = name
        self.version = version
        self.licenses = licenses
        self.policy_status = policy_status
        self.security_risk = security_risk
        self.newest_release = newest_release
        self.is_manually_added = is_manually_added

    @staticmethod
    def parse(hub, component):
        # pylint: disable=too-many-locals
        """Parse a Black Duck component from a dictionary."""
        name = component["componentName"]
        cversion = component.get("componentVersionName", "unknown_version")
        licenses = ",".join([a.get("spdxId", a["licenseDisplay"]) for a in component["licenses"]])

        policy_status = component["policyStatus"]
        security_risk = _compute_security_risk(component['securityRiskProfile'])

        newer_releases = component["activityData"].get("newerReleases", 0)

        is_manually_added = 'MANUAL_BOM_COMPONENT' in component['matchTypes']

        LOGGER.info("Retrievinng version information for Comp %s - %s  Releases %s", name, cversion,
                    newer_releases)
        cver = VersionInfo(cversion)
        newest_release = None

        # Blackduck's newerReleases is based on "releasedOn" date. This means that if a upstream component releases a beta or rc,
        # it counts as newer but we do not consider those newer for our purposes
        # Missing newerReleases means we do not have to upgrade
        if newer_releases > 0:
            limit = newer_releases + 1
            versions_url = component["component"] + f"/versions?sort=releasedon%20desc&limit={limit}"

            LOGGER.info("Retrieving version information via %s", versions_url)
            vjson = hub.execute_get(versions_url).json()

            versions = [(ver["versionName"], ver["releasedOn"]) for ver in vjson["items"]]

            LOGGER.info("Known versions: %s ", versions)

            versions = [ver["versionName"] for ver in vjson["items"]]

            # For Firefox, only examine Extended Service Releases (i.e. esr), their long term support releases
            if name == "Mozilla Firefox":
                versions = [ver for ver in versions if "esr" in ver]

            # For yaml-cpp, we need to clean the list of versions a little
            # yaml-cpp uses #.#.# but there are some entires with #.#.#.# so the later needs to
            # be filtered out.
            if name == "jbeder/yaml-cpp":
                ver_regex = re.compile(r"\d+\.\d+\.\d+$")
                versions = [ver for ver in versions if ver_regex.match(ver)]

            # For Boost C++ Libraries - boost, we need to clean the list of versions a little
            # All boost versions for the last 10 years start with 1.x.x. Black Duck thinks some
            # versions are 4.x.x which are bogus and throw off the sorting.
            # Also, boost uses #.#.# but there are some entires with #.#.#.# so the later needs to
            # be filtered out.
            if name == "Boost C++ Libraries - boost":
                ver_regex = re.compile(r"\d+\.\d+\.\d+$")
                versions = [ver for ver in versions if ver.startswith("1") and ver_regex.match(ver)]

            ver_info = [VersionInfo(ver) for ver in versions]
            ver_info = [ver for ver in ver_info if ver.production_version]
            LOGGER.info("Filtered versions: %s ", ver_info)

            ver_info = sorted([ver for ver in ver_info if ver.production_version and ver > cver],
                              reverse=True)

            LOGGER.info("Sorted versions: %s ", ver_info)

            if ver_info:
                newest_release = ver_info[0]

        return Component(name, cversion, licenses, policy_status, security_risk, newest_release,
                         is_manually_added)


class BlackDuckConfig:
    """
    Black Duck configuration settings.

    Format is defined by Black Duck Python hub API.
    """

    def __init__(self):
        """Init Black Duck config from disk."""
        if not os.path.exists(BLACKDUCK_RESTCONFIG):
            raise ValueError("Cannot find %s for blackduck configuration" % (BLACKDUCK_RESTCONFIG))

        with open(BLACKDUCK_RESTCONFIG, "r") as rfh:
            rc = json.loads(rfh.read())

        self.url = rc["baseurl"]
        self.username = rc["username"]
        self.password = rc["password"]


def _run_scan():
    # Get user name and password from .restconfig.json
    bdc = BlackDuckConfig()

    with tempfile.NamedTemporaryFile() as fp:
        fp.write(f"""#/!bin/sh
curl --retry 5 -s -L https://detect.synopsys.com/detect.sh  | bash -s -- --blackduck.url={bdc.url} --blackduck.username={bdc.username} --blackduck.password={bdc.password} --detect.report.timeout={BLACKDUCK_TIMEOUT_SECS} --snippet-matching --upload-source --detect.wait.for.results=true
""".encode())
        fp.flush()

        subprocess.call(["/bin/sh", fp.name])


def _scan_cmd_args(args):
    # pylint: disable=unused-argument
    LOGGER.info("Running Black Duck Scan")

    _run_scan()


def _query_blackduck():
    # pylint: disable=global-statement
    global BLACKDUCK_PROJECT_URL

    hub = HubInstance()

    LOGGER.info("Fetching project %s from blackduck", BLACKDUCK_PROJECT)
    project = hub.get_project_by_name(BLACKDUCK_PROJECT)

    LOGGER.info("Fetching project version %s from blackduck", BLACKDUCK_PROJECT_VERSION)
    version = hub.get_version_by_name(project, BLACKDUCK_PROJECT_VERSION)

    LOGGER.info("Getting version components from blackduck")
    bom_components = hub.get_version_components(version)

    components = [
        Component.parse(hub, comp) for comp in bom_components["items"] if comp['ignored'] is False
    ]

    BLACKDUCK_PROJECT_URL = version["_meta"]["href"]

    return components


class TestResultEncoder(json.JSONEncoder):
    """JSONEncoder for TestResults."""

    def default(self, o):
        """Serialize objects by default as a dictionary."""
        # pylint: disable=method-hidden
        return o.__dict__


class TestResult:
    """A single test result in the Evergreen report.json format."""

    def __init__(self, name, status, url):
        """Init test result."""
        # This matches the report.json schema
        # See https://github.com/evergreen-ci/evergreen/blob/789bee107d3ffb9f0f82ae344d72502945bdc914/model/task/task.go#L264-L284
        assert status in ["pass", "fail"]

        self.test_file = name
        self.status = status
        self.exit_code = 1

        if url:
            self.url = url
            self.url_raw = url + "?raw=1"

        if status == "pass":
            self.exit_code = 0


class TestResults:
    """Evergreen TestResult format for report.json."""

    def __init__(self):
        """Init test results."""
        self.results = []

    def add_result(self, result: TestResult):
        """Add a test result."""
        self.results.append(result)

    def write(self, filename: str):
        """Write the test results to disk."""

        with open(filename, "w") as wfh:
            wfh.write(json.dumps(self, cls=TestResultEncoder))


class ReportLogger(object, metaclass=ABCMeta):
    """Base Class for all report loggers."""

    @abstractmethod
    def log_report(self, name: str, content: str) -> Optional[str]:
        """Get the command to run a linter."""
        pass


class LocalReportLogger(ReportLogger):
    """Write reports to local directory as a set of files."""

    def __init__(self):
        """Init logger and create directory."""
        if not os.path.exists(LOCAL_REPORTS_DIR):
            os.mkdir(LOCAL_REPORTS_DIR)

    def log_report(self, name: str, content: str) -> Optional[str]:
        """Log report to a local file."""
        file_name = os.path.join(LOCAL_REPORTS_DIR, name + ".log")

        with open(file_name, "w") as wfh:
            wfh.write(content)


class BuildLoggerReportLogger(ReportLogger):
    """Write reports to a build logger server."""

    def __init__(self, build_logger):
        """Init logger."""
        self.build_logger = build_logger

        self.build_id = self.build_logger.new_build_id("bdh")

    def log_report(self, name: str, content: str) -> Optional[str]:
        """Log report to a build logger."""

        content = content.split("\n")

        return self.build_logger.post_new_file(self.build_id, name, content)


def _get_default(list1, idx, default):
    if (idx + 1) < len(list1):
        return list1[idx]

    return default


class TableWriter:
    """Generate an ASCII table that summarizes the results of all the reports generated."""

    def __init__(self, headers: List[str]):
        """Init writer."""
        self._headers = headers
        self._rows = []

    def add_row(self, row: List[str]):
        """Add a row to the table."""
        self._rows.append(row)

    @staticmethod
    def _write_row(col_sizes: List[int], row: List[str], writer: io.StringIO):
        writer.write("|")
        for idx, row_value in enumerate(row):
            writer.write(" ")
            writer.write(row_value)
            writer.write(" " * (col_sizes[idx] - len(row_value)))
            writer.write(" |")
        writer.write("\n")

    def print(self, writer: io.StringIO):
        """Print the final table to the string stream."""
        cols = max([len(r) for r in self._rows])

        assert cols == len(self._headers)

        col_sizes = []
        for col in range(0, cols):
            col_sizes.append(
                max([len(_get_default(row, col, []))
                     for row in self._rows] + [len(self._headers[col])]))

        TableWriter._write_row(col_sizes, self._headers, writer)

        TableWriter._write_row(col_sizes, ["-" * c for c in col_sizes], writer)

        for row in self._rows:
            TableWriter._write_row(col_sizes, row, writer)


class TableData:
    """Store scalar values in a two-dimensional matrix indexed by the first column's value."""

    def __init__(self):
        """Init table data."""
        self._rows = {}

    def add_value(self, col: str, value: str):
        """Add a value for a given column. Order sensitive."""
        if col not in self._rows:
            self._rows[col] = []

        self._rows[col].append(value)

    def write(self, headers: List[str], writer: io.StringIO):
        """Write table data as nice prettty table to writer."""
        tw = TableWriter(headers)

        for row in self._rows:
            tw.add_row([row] + self._rows[row])

        tw.print(writer)


class ReportManager:
    """Manage logging reports to ReportLogger and generate summary report."""

    def __init__(self, logger: ReportLogger):
        """Init report manager."""
        self._logger = logger
        self._results = TestResults()
        self._data = TableData()

    @staticmethod
    def _get_norm_comp_name(comp_name: str):
        return comp_name.replace(" ", "_").replace("/", "_").lower()

    def write_report(self, comp_name: str, report_name: str, status: str, content: str):
        """
        Write a report about a test to the build logger.

        status is a string of "pass" or "fail"
        """
        comp_name = ReportManager._get_norm_comp_name(comp_name)

        name = comp_name + "_" + report_name

        LOGGER.info("Writing Report %s - %s", name, status)

        self._data.add_value(comp_name, status)

        url = self._logger.log_report(name, content)

        self._results.add_result(TestResult(name, status, url))

    def add_report_metric(self, comp_name: str, metric: str):
        """Add a column to be included in the pretty table."""
        comp_name = ReportManager._get_norm_comp_name(comp_name)

        self._data.add_value(comp_name, metric)

    def finish(self, reports_file: Optional[str], vulnerabilties_only: bool):
        """Generate final summary of all reports run."""

        if reports_file:
            self._results.write(reports_file)

        stream = io.StringIO()

        if vulnerabilties_only:
            self._data.write(["Component", "Vulnerability"], stream)
        else:
            self._data.write(
                ["Component", "Vulnerability", "Upgrade", "Current Version", "Newest Version"],
                stream)

        print(stream.getvalue())


class ThirdPartyComponent:
    """MongoDB Third Party component from third_party_components.yml."""

    def __init__(self, name, homepage_url, local_path, team_owner):
        """Init class."""
        # Required fields
        self.name = name
        self.homepage_url = homepage_url
        self.local_path = local_path
        self.team_owner = team_owner

        # optional fields
        self.is_test_only = False
        self.vulnerability_suppression = None
        self.upgrade_suppression = None


def _get_field(name, ymap, field: str):
    if field not in ymap:
        raise ValueError("Missing field %s for component %s" % (field, name))

    return ymap[field]


def _get_supression_field(ymap, field: str):
    if field not in ymap:
        return None

    value = ymap[field].lower()

    if not "todo" in value:
        raise ValueError(
            "Invalid suppression, a suppression must include the word 'TODO' so that the TODO scanner finds resolved tickets."
        )

    return value


def _read_third_party_components():
    with open(THIRD_PARTY_COMPONENTS_FILE) as rfh:
        yaml_file = yaml.load(rfh.read())

    third_party = []
    components = yaml_file["components"]
    for comp in components:
        cmap = components[comp]

        tp = ThirdPartyComponent(comp, _get_field(comp, cmap, 'homepage_url'),
                                 _get_field(comp, cmap, 'local_directory_path'),
                                 _get_field(comp, cmap, 'team_owner'))

        tp.is_test_only = cmap.get("is_test_only", False)
        tp.vulnerability_suppression = _get_supression_field(cmap, "vulnerability_suppression")
        tp.upgrade_suppression = _get_supression_field(cmap, "upgrade_suppression")

        third_party.append(tp)

    return third_party


def _generate_report_missing_blackduck_component(mgr: ReportManager, mcomp: ThirdPartyComponent):
    mgr.write_report(
        mcomp.name, "missing_blackduck_component", "fail", f"""{BLACKDUCK_FAILED_PREFIX}

The {mcomp.name} library was found in {THIRD_PARTY_COMPONENTS_FILE} but not detected by Black Duck.

This is caused by one of two issues:
1. The {THIRD_PARTY_COMPONENTS_FILE} file is out of date and the entry needs to be removed for "{mcomp.name}".
or
2. A entry to the component needs to be manually added to Black Duck.

Next Steps:

Build Baron:
A BF ticket should be generated and assigned to "{BLACKDUCK_DEFAULT_TEAM}" with
this text.

Developer:
To address this build failure, the next steps are as follows:
1. Verify that the component is correct in {THIRD_PARTY_COMPONENTS_FILE}.

2. If the component is incorrect, add a comment to the component in Black Duck and mark it as "Ignored".
or
2. If the component is correct, add the correct information to {THIRD_PARTY_COMPONENTS_FILE}.

If the "{BLACKDUCK_DEFAULT_TEAM}" cannot do this work for any reason, the BF should be assigned to
the component owner team "{mcomp.team_owner}".

For more information, see {BLACKDUCK_WIKI_PAGE}.
""")


def _generate_report_blackduck_missing_directory(mgr: ReportManager, directory: str):
    mgr.write_report(
        directory, "missing_directory", "fail", f"""{BLACKDUCK_FAILED_PREFIX}

The directory "{directory}" was found in a known MongoDB third_party directory but is not known to
Black Duck or {THIRD_PARTY_COMPONENTS_FILE}. This directory likely needs to be added to Black Duck
manually.

Next Steps:

Build Baron:
A BF ticket should be generated and assigned to "{BLACKDUCK_DEFAULT_TEAM}" with
this text.

Developer:
To address this build failure, the next steps are as follows:
1. Verify that the component is correct.
2. Add the component manually to the Black Duck project at
   {BLACKDUCK_PROJECT_URL}.
3. Once the component has been accepted by Black Duck, add the correct information to
   {THIRD_PARTY_COMPONENTS_FILE}.

For more information, see {BLACKDUCK_WIKI_PAGE}.
""")


def _generate_report_missing_yaml_component(mgr: ReportManager, comp: Component):
    mgr.write_report(
        comp.name, "missing_yaml_component", "fail", f"""{BLACKDUCK_FAILED_PREFIX}

The {comp.name} library with version "{comp.version}" was detected by Black Duck but not found in
{THIRD_PARTY_COMPONENTS_FILE}.

This is caused by one of two issues:
1. Black Duck has made an error and the software is not being vendored by MongoDB.
2. Black Duck is correct and {THIRD_PARTY_COMPONENTS_FILE} must be updated.

Next Steps:

Build Baron:
A BF ticket should be generated and assigned to "{BLACKDUCK_DEFAULT_TEAM}" with
this text.

Developer:
To address this build failure, the next steps are as follows:
1. Verify that the component is correct at {BLACKDUCK_PROJECT_URL}.

2. If the component is incorrect, add a comment to the component and mark it as "Ignored".
or
3. If the component is correct, add the correct information to {THIRD_PARTY_COMPONENTS_FILE}.

For more information, see {BLACKDUCK_WIKI_PAGE}.
""")


def _generate_report_upgrade(mgr: ReportManager, comp: Component, mcomp: ThirdPartyComponent,
                             fail: bool):
    if not fail:
        mgr.write_report(comp.name, "upgrade_check", "pass", "Blackduck run passed")
    else:

        if comp.is_manually_added:
            component_explanation = f"""This component requires a manual update in the Black Duck Database because it was added to
Black Duck manually.  After the update to the third-party library is committed, please update the
version information for this component at {BLACKDUCK_PROJECT_URL}. Click on the down arrow on the
far right of the component, choose edit and specify the new version."""
        else:
            component_explanation = """This commponent was automatically detected by Black Duck. Black Duck should automatically detect
the new version after the library is updated and the daily scanner task runs again."""

        mgr.write_report(
            comp.name, "upgrade_check", "fail", f"""{BLACKDUCK_FAILED_PREFIX}

The {comp.name} library at {mcomp.local_path} is out of date. The current version is
"{comp.version}" and the newest version is "{comp.newest_release}" according to Black Duck.

MongoDB policy requires all third-party software to be updated to the latest version on the master
branch.

Next Steps:

Build Baron:
A BF ticket should be generated and assigned to "{BLACKDUCK_DEFAULT_TEAM}" with
this text.

Developer:
To address this build failure, the next steps are as follows:
1. File a SERVER ticket to update the software if one already does not exist.
2. Add a “upgrade_supression” to {THIRD_PARTY_COMPONENTS_FILE} with the SERVER ticket to acknowledge
   this report. Note that you do not need to immediately update the library, just file a ticket.

{component_explanation}

If the "{BLACKDUCK_DEFAULT_TEAM}" cannot do this work for any reason, the BF should be assigned to
the component owner team "{mcomp.team_owner}".

For more information, see {BLACKDUCK_WIKI_PAGE}.
""")

    mgr.add_report_metric(comp.name, str(comp.version))
    mgr.add_report_metric(comp.name, str(comp.newest_release))


def _generate_report_vulnerability(mgr: ReportManager, comp: Component, mcomp: ThirdPartyComponent,
                                   fail: bool):
    if not fail:
        mgr.write_report(comp.name, "vulnerability_check", "pass", "Blackduck run passed")
        return

    mgr.write_report(
        comp.name, "vulnerability_check", "fail", f"""{BLACKDUCK_FAILED_PREFIX}

The {comp.name} library at {mcomp.local_path} had HIGH and/or CRITICAL security issues. The current
version in Black Duck is "{comp.version}".

MongoDB policy requires all third-party software to be updated to a version clean of HIGH and
CRITICAL vulnerabilities on the master branch.

Next Steps:

Build Baron:
A BF ticket should be generated and assigned to "{BLACKDUCK_DEFAULT_TEAM}" with
this text.

Developer:
To address this build failure, the next steps are as follows:
1. File a SERVER ticket to update the software if one already does not exist. Note that you do not
   need to immediately update the library, just file a ticket.
2. Add a “vulnerability_supression” to {THIRD_PARTY_COMPONENTS_FILE} with the SERVER ticket to
   acknowledge this report.

If you believe the library is already up-to-date but Black Duck has the wrong version, please update
version information for this component at {BLACKDUCK_PROJECT_URL}.

If the "{BLACKDUCK_DEFAULT_TEAM}" cannot do this work for any reason, the BF should be assigned to
the component owner team "{mcomp.team_owner}".

For more information, see {BLACKDUCK_WIKI_PAGE}.
""")


def _get_third_party_directories():
    third_party = []
    for tp in THIRD_PARTY_DIRECTORIES:
        for entry in os.scandir(tp):
            if entry.name not in ["scripts"] and entry.is_dir():
                third_party.append(entry.path)

    return sorted(third_party)


class Analyzer:
    """
    Analyze the MongoDB source code for software maintence issues.

    Queries Black Duck for out of date software
    Consults a local yaml file for detailed information about third party components included in the MongoDB source code.
    """

    def __init__(self):
        """Init analyzer."""
        self.third_party_components = None
        self.third_party_directories = None
        self.black_duck_components = None
        self.mgr = None

    def _do_reports(self, vulnerabilties_only: bool):
        for comp in self.black_duck_components:
            # 1. Validate if this is in the YAML file
            if self._verify_yaml_contains_component(comp, vulnerabilties_only):

                # 2. Validate there are no security issues
                self._verify_vulnerability_status(comp)

                # 3. Check for upgrade issue
                if not vulnerabilties_only:
                    self._verify_upgrade_status(comp)

        if vulnerabilties_only:
            return

        # 4. Validate that each third_party directory is in the YAML file
        self._verify_directories_in_yaml()

        # 5. Verify the YAML file has all the entries in Black Duck
        self._verify_components_in_yaml()

    def _verify_yaml_contains_component(self, comp: Component, vulnerabilties_only: bool):
        # It should be rare that Black Duck detects something that is not in the YAML file
        # As a result, we do not generate a "pass" report for simply be consistent between Black Duck and the yaml file
        if comp.name not in [c.name for c in self.third_party_components]:
            if not vulnerabilties_only:
                _generate_report_missing_yaml_component(self.mgr, comp)
            return False

        return True

    def _verify_directories_in_yaml(self):

        comp_dirs = [c.local_path for c in self.third_party_components]
        for cdir in self.third_party_directories:
            # Ignore WiredTiger since it is not a third-party library but made by MongoDB, Inc.
            if cdir in ["src/third_party/wiredtiger"]:
                continue

            if cdir not in comp_dirs:
                _generate_report_blackduck_missing_directory(self.mgr, cdir)

    def _verify_components_in_yaml(self):

        comp_names = [c.name for c in self.black_duck_components]
        for mcomp in self.third_party_components:
            # These components are known to be missing from Black Duck
            # Aladdin MD5 is a pair of C files for MD5 computation
            # timelib is simply missing
            # Unicode is not code
            if mcomp.name in ["Aladdin MD5", "timelib", "unicode"]:
                continue

            if mcomp.name not in comp_names:
                _generate_report_missing_blackduck_component(self.mgr, mcomp)

    def _verify_upgrade_status(self, comp: Component):
        mcomp = self._get_mongo_component(comp)

        if comp.newest_release and not mcomp.upgrade_suppression and not mcomp.is_test_only:
            _generate_report_upgrade(self.mgr, comp, mcomp, True)
        else:
            _generate_report_upgrade(self.mgr, comp, mcomp, False)

    def _verify_vulnerability_status(self, comp: Component):
        mcomp = self._get_mongo_component(comp)

        if comp.security_risk in [
                "HIGH", "CRITICAL"
        ] and not mcomp.vulnerability_suppression and not mcomp.is_test_only:
            _generate_report_vulnerability(self.mgr, comp, mcomp, True)
        else:
            _generate_report_vulnerability(self.mgr, comp, mcomp, False)

    def _get_mongo_component(self, comp: Component):
        mcomp = next((x for x in self.third_party_components if x.name == comp.name), None)

        if not mcomp:
            raise ValueError(
                "Cannot find third party component for Black Duck Component '%s'. Please update '%s'. "
                % (comp.name, THIRD_PARTY_COMPONENTS_FILE))

        return mcomp

    def run(self, logger: ReportLogger, report_file: Optional[str], vulnerabilties_only: bool):
        """Run analysis of Black Duck scan and local files."""

        self.third_party_directories = _get_third_party_directories()

        LOGGER.info("Found the following third party directories: %s", self.third_party_directories)

        self.third_party_components = _read_third_party_components()

        self.black_duck_components = _query_blackduck()

        # Black Duck detects ourself everytime we release a new version
        # Rather then constantly have to supress this in Black Duck itself which will generate false positives
        # We filter ourself our of the list of components.
        self.black_duck_components = [
            comp for comp in self.black_duck_components
            if not (comp.name == "MongoDB" or comp.name == "WiredTiger")
        ]

        # Remove duplicate Black Duck components. We only care about the component with highest version number
        # Black Duck can detect different versions of the same component for instance if an upgrade of a component happens
        bd_names = {comp.name for comp in self.black_duck_components}
        if len(bd_names) != len(self.black_duck_components):
            LOGGER.warning("Found duplicate Black Duck components")
            bd_unique = {}
            for comp in self.black_duck_components:
                if comp.name in bd_unique:
                    LOGGER.warning("Found duplicate Black Duck component: %s", comp.name)
                    first = bd_unique[comp.name]
                    if comp.version > first.version:
                        bd_unique[comp.name] = comp
                else:
                    bd_unique[comp.name] = comp

            self.black_duck_components = list(bd_unique.values())

        self.mgr = ReportManager(logger)

        self._do_reports(vulnerabilties_only)

        self.mgr.finish(report_file, vulnerabilties_only)


# Derived from buildscripts/resmokelib/logging/buildlogger.py
def _get_build_logger_from_file(filename, build_logger_url, task_id):
    tmp_globals = {}
    config = {}

    # The build logger config file is actually python
    # It is a mix of quoted strings and ints
    exec(compile(open(filename, "rb").read(), filename, 'exec'), tmp_globals, config)

    # Rename "slavename" to "username" if present.
    if "slavename" in config and "username" not in config:
        config["username"] = config["slavename"]
        del config["slavename"]

    # Rename "passwd" to "password" if present.
    if "passwd" in config and "password" not in config:
        config["password"] = config["passwd"]
        del config["passwd"]

    return BuildloggerServer(config["username"], config["password"], task_id, config["builder"],
                             config["build_num"], config["build_phase"], build_logger_url)


def _generate_reports_args(args):
    LOGGER.info("Generating Reports")

    # Log to LOCAL_REPORTS_DIR directory unless build logger is explicitly chosen
    logger = LocalReportLogger()

    if args.build_logger_local:
        build_logger = BuildloggerServer("fake_user", "fake_pass", "fake_task", "fake_builder", 1,
                                         "fake_build_phase", "http://localhost:8080")
        logger = BuildLoggerReportLogger(build_logger)
    elif args.build_logger:
        if not args.build_logger_task_id:
            raise ValueError("Must set build_logger_task_id if using build logger")

        build_logger = _get_build_logger_from_file(args.build_logger, args.build_logger_url,
                                                   args.build_logger_task_id)
        logger = BuildLoggerReportLogger(build_logger)

    analyzer = Analyzer()
    analyzer.run(logger, args.report_file, args.vulnerabilities_only)


def _scan_and_report_args(args):
    LOGGER.info("Running Black Duck Scan And Generating Reports")

    _run_scan()

    _generate_reports_args(args)


def main() -> None:
    """Execute Main entry point."""

    parser = argparse.ArgumentParser(description='Black Duck hub controller.')

    parser.add_argument('-v', "--verbose", action='store_true', help="Enable verbose logging")
    parser.add_argument('-d', "--debug", action='store_true', help="Enable debug logging")

    sub = parser.add_subparsers(title="Hub subcommands", help="sub-command help")
    generate_reports_cmd = sub.add_parser('generate_reports',
                                          help='Generate reports from Black Duck')

    generate_reports_cmd.add_argument("--report_file", type=str,
                                      help="report json file to write to")
    generate_reports_cmd.add_argument(
        "--build_logger", type=str, help="Log to build logger with credentials from specified file")
    generate_reports_cmd.add_argument("--build_logger_url", type=str,
                                      default=BUILD_LOGGER_DEFAULT_URL,
                                      help="build logger url to log to")
    generate_reports_cmd.add_argument("--build_logger_task_id", type=str,
                                      help="build logger task id")
    generate_reports_cmd.add_argument("--build_logger_local", action='store_true',
                                      help="Log to local build logger, logs to disk by default")
    generate_reports_cmd.add_argument("--vulnerabilities_only", action='store_true',
                                      help="Only check for security vulnerabilities")
    generate_reports_cmd.set_defaults(func=_generate_reports_args)

    scan_cmd = sub.add_parser('scan', help='Do Black Duck Scan')
    scan_cmd.set_defaults(func=_scan_cmd_args)

    scan_and_report_cmd = sub.add_parser('scan_and_report',
                                         help='Run scan and then generate reports')
    scan_and_report_cmd.add_argument("--report_file", type=str, help="report json file to write to")

    scan_and_report_cmd.add_argument(
        "--build_logger", type=str, help="Log to build logger with credentials from specified file")
    scan_and_report_cmd.add_argument("--build_logger_url", type=str,
                                     default=BUILD_LOGGER_DEFAULT_URL,
                                     help="build logger url to log to")
    scan_and_report_cmd.add_argument("--build_logger_task_id", type=str,
                                     help="build logger task id")
    scan_and_report_cmd.add_argument("--build_logger_local", action='store_true',
                                     help="Log to local build logger, logs to disk by default")
    scan_and_report_cmd.add_argument("--vulnerabilities_only", action='store_true',
                                     help="Only check for security vulnerabilities")
    scan_and_report_cmd.set_defaults(func=_scan_and_report_args)

    args = parser.parse_args()

    _test_version_info()

    if args.debug:
        logging.basicConfig(level=logging.DEBUG)
    elif args.verbose:
        logging.basicConfig(level=logging.INFO)

    args.func(args)


if __name__ == "__main__":
    main()