grype-db/manager/tests/unit/cli/test_config.py at 1ce75acaacbbfbf851b80b9ac676ee8dae2d57bf · securebuildhq/grype-db · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
import os

import yaml

from grype_db_manager.cli import config


def test_include_tag_is_registered():
    """Test that the !include constructor is properly registered with yaml.SafeLoader."""
    assert "!include" in yaml.SafeLoader.yaml_constructors


def test_override_from_environment():
    env = {
        "TEST_APP_LOG_LEVEL": "DEBUG",
    }

    cfg = config.Application(
        log=config.Log(
            level="INFO",
        ),
    )

    config.override_from_environment(cfg, prefix="TEST_APP", env=env)

    assert cfg.log.level == "DEBUG"


def test_load_from_env_vars_overrides_disk(test_dir_path):
    env = {
        "GRYPE_DB_MANAGER_VALIDATE_LISTING_OVERRIDE_GRYPE_VERSION": "grype-version",
        "GRYPE_DB_MANAGER_VALIDATE_LISTING_OVERRIDE_DB_SCHEMA_VERSION": "schema-version",
        "GRYPE_DB_MANAGER_DISTRIBUTION_S3_PATH": "s3-path",
    }

    # ensure that we override values from disk with env vars
    config_path = test_dir_path("fixtures/config/full.yaml")
    cfg = config.load(config_path, wire_values=False, env=env)

    assert cfg.validate.listing.override_grype_version == "grype-version"
    assert cfg.validate.listing.override_db_schema_version == "schema-version"
    assert cfg.distribution.s3_path == "s3-path"


def test_load_default():
    cfg = config.Application()

    actual = cfg.to_yaml()

    expected = """\
assertAwsCredentials: true
data:
  root: .grype-db-manager
  vunnelRoot: data/vunnel
  yardstickRoot: data/yardstick
distribution:
  awsRegion: null
  downloadUrlPrefix: null
  listingFileName: listing.json
  listingReplicas: []
  s3AlwaysSuffixSchemaVersion: false
  s3Bucket: null
  s3EndpointUrl: null
  s3Path: null
grypeDb:
  config: ''
  version: latest
log:
  level: INFO
schemaMappingFile: ''
validate:
  defaultMaxYear: 2021
  expectedProviders:
    - alpine
    - amazon
    - chainguard
    - debian
    - echo
    - github
    - mariner
    - minimos
    - nvd
    - oracle
    - rhel
    - secureos
    - sles
    - ubuntu
    - wolfi
  gates: []
  listing:
    image: null
    minimumPackages: null
    minimumVulnerabilities: null
    overrideDbSchemaVersion: null
    overrideGrypeVersion: null
verbosity: 0
"""

    assert actual == expected


def test_load(test_dir_path):
    config_path = test_dir_path("fixtures/config/full.yaml")

    cfg = config.load(config_path, wire_values=False)

    actual = cfg.to_yaml()

    expected = """\
assertAwsCredentials: false
data:
  root: data/manager
  vunnelRoot: data/vunnel
  yardstickRoot: data/yardstick
distribution:
  awsRegion: us-west-2
  downloadUrlPrefix: http://localhost:4566/testbucket
  listingFileName: listing.json
  listingReplicas:
    - awsRegion: us-west-2
      listingFileName: listing.json
      s3Bucket: testbucket
      s3Path: grype/databases
  s3AlwaysSuffixSchemaVersion: false
  s3Bucket: testbucket
  s3EndpointUrl: http://localhost:4566
  s3Path: grype/databases
grypeDb:
  config: config/grype-db-nightly-publisher.yaml
  version: file://.
log:
  level: INFO
schemaMappingFile: mapping.json
validate:
  defaultMaxYear: 2021
  expectedProviders:
    - alpine
  gates:
    - allowEmptyResultsForSchemas:
        - 1
        - 2
        - 3
      gate:
        allowedNamespaces: []
        candidateToolLabel: candidate
        failOnEmptyMatchSet: true
        maxF1Regression: 0.15
        maxNewFalseNegatives: 10
        maxUnlabeledPercent: 50
        maxYear: 2021
        name: default
        referenceToolLabel: reference
        requiredNamespaces: []
        yearFromCveOnly: null
      grype:
        config: ''
      images:
        - docker.io/cloudbees/cloudbees-core-agent:2.289.2.2@sha256:d48f0546b4cf5ef4626136242ce302f94a42751156b7be42f4b1b75a66608880
  listing:
    image: centos:8.2.2004
    minimumPackages: 85
    minimumVulnerabilities: 400
    overrideDbSchemaVersion: null
    overrideGrypeVersion: null
verbosity: 2
"""

    assert actual == expected