Skip to content

Final fixes for sw360 v20 #239

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tngraf merged 2 commits into from
Sep 1, 2026
Merged

Final fixes for sw360 v20 #239

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bc42216
fix: ensure that we can analyzeold and new oauth tokens
t-graf Aug 31, 2026
74fbe89
feat: primary source for information are the environment variables `S…
t-graf Sep 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions ChangeLog.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,12 @@

# CaPyCli - Clearing Automation Python Command Line Tool for SW360

## 2.12.0

* Because of security reasons `-client_id` and `-client_secret` should only
be considered as fallback. Primary source for this information are the
environment variables `SW360Client_id` and `SW360Client_secret`.

## 2.12.0.dev1

* Fix for issue 218: Bug when using capycli bom map -o outmap (v2.11.1).
Expand Down
46 changes: 34 additions & 12 deletions capycli/bom/check_bom.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,19 +196,41 @@ def run(self, args: Any) -> None:
if self._bom_has_items_without_id(bom):
print("There are SBOM items without Sw360 id - searching per name may take a little bit longer...")

if not args.sw360_token and args.client_id and args.client_secret:
print_text("Creating token using client id and secret...")
kc = SW360Keycloak(args.sw360_url)
args.sw360_token = kc.get_keycloak_token(args.client_id, args.client_secret, write_access=False)
if args.sw360_token:
args.oauth2 = True
print_text(" Got token.")
else:
print_red(" Failed to get token!")
sys.exit(ResultCode.RESULT_AUTH_ERROR)

if args.sw360_token and args.oauth2:
if not args.sw360_token:
# command line argument precede environment variables
client_id = args.client_id
client_secret = args.client_secret

if not args.client_id and (not args.client_secret):
# look for environment variables
client_id = os.getenv("SW360Client_id")
client_secret = os.getenv("SW360Client_secret")
if client_id and client_secret and args.verbose:
print_text(" Found client id and client secret in environment variables.")

if client_id and client_secret:
url = args.sw360_url
if not url:
url = os.environ.get("SW360ServerUrl", "")
if not url:
print_red(" SW360 URL not specified!")
sys.exit(ResultCode.RESULT_COMMAND_ERROR)

if args.verbose:
print_text(" Creating token using client id and secret...")
kc = SW360Keycloak(url)
args.sw360_token = kc.get_keycloak_token(client_id, client_secret, write_access=False)
if args.sw360_token:
args.oauth2 = True
if args.verbose:
print_text(" Got token.")
else:
print_red(" Failed to get token!")
sys.exit(ResultCode.RESULT_AUTH_ERROR)

if args.sw360_token and args.oauth2 and args.verbose:
self.analyze_token(args.sw360_token)
print_text("")

if not self.login(token=args.sw360_token, url=args.sw360_url, oauth2=args.oauth2):
print_red("ERROR: login failed!")
Expand Down
47 changes: 35 additions & 12 deletions capycli/bom/check_bom_item_status.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -188,6 +188,7 @@ def run(self, args: Any) -> None:
print("-all show status of all versions of the component")
print("-client_id CLIENT_ID the SW360 client_id to be used for token generation")
print("-client_secret CLIENT_SECRET the SW360 client_secret to be used for token generation")
print("-v be verbose")
return

if not args.inputfile:
Expand All @@ -211,19 +212,41 @@ def run(self, args: Any) -> None:
if self._bom_has_items_without_id(bom):
print("There are SBOM items without Sw360 id - searching per name may take a little bit longer...")

if not args.sw360_token and args.client_id and args.client_secret:
print_text("Creating token using client id and secret...")
kc = SW360Keycloak(args.sw360_url)
args.sw360_token = kc.get_keycloak_token(args.client_id, args.client_secret, write_access=False)
if args.sw360_token:
args.oauth2 = True
print_text(" Got token.")
else:
print_red(" Failed to get token!")
sys.exit(ResultCode.RESULT_AUTH_ERROR)

if args.sw360_token and args.oauth2:
if not args.sw360_token:
# command line argument precede environment variables
client_id = args.client_id
client_secret = args.client_secret

if not args.client_id and (not args.client_secret):
# look for environment variables
client_id = os.getenv("SW360Client_id")
client_secret = os.getenv("SW360Client_secret")
if client_id and client_secret and args.verbose:
print_text(" Found client id and client secret in environment variables.")

if client_id and client_secret:
url = args.sw360_url
if not url:
url = os.environ.get("SW360ServerUrl", "")
if not url:
print_red(" SW360 URL not specified!")
sys.exit(ResultCode.RESULT_COMMAND_ERROR)

if args.verbose:
print_text(" Creating token using client id and secret...")
kc = SW360Keycloak(url)
args.sw360_token = kc.get_keycloak_token(client_id, client_secret, write_access=False)
if args.sw360_token:
args.oauth2 = True
if args.verbose:
print_text(" Got token.")
else:
print_red(" Failed to get token!")
sys.exit(ResultCode.RESULT_AUTH_ERROR)

if args.sw360_token and args.oauth2 and args.verbose:
self.analyze_token(args.sw360_token)
print_text("")

if not self.login(token=args.sw360_token, url=args.sw360_url, oauth2=args.oauth2):
print_red("ERROR: login failed!")
Expand Down
45 changes: 34 additions & 11 deletions capycli/bom/create_components.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,7 @@ class BomCreateComponents(capycli.common.script_base.ScriptBase):
" ignore prefixes like \"2:\" (epoch) and suffixes like \".debian\"",
" -client_id CLIENT_ID the SW360 client_id to be used for token generation",
" -client_secret CLIENT_SECRET the SW360 client_secret to be used for token generation"
" -v be verbose"
]

def __init__(self, onlyCreateReleases: bool = False) -> None:
Expand Down Expand Up @@ -777,19 +778,41 @@ def run(self, args: Any) -> None:
print_text("Using relaxed debian version checks")
self.relaxed_debian_parsing = True

if not args.sw360_token and args.client_id and args.client_secret:
print_text("Creating token using client id and secret...")
kc = SW360Keycloak(args.sw360_url)
args.sw360_token = kc.get_keycloak_token(args.client_id, args.client_secret, write_access=True)
if args.sw360_token:
args.oauth2 = True
print_text(" Got token.")
else:
print_red(" Failed to get token!")
sys.exit(ResultCode.RESULT_AUTH_ERROR)
if not args.sw360_token:
# command line argument precede environment variables
client_id = args.client_id
client_secret = args.client_secret

if not args.client_id and (not args.client_secret):
# look for environment variables
client_id = os.getenv("SW360Client_id")
client_secret = os.getenv("SW360Client_secret")
if client_id and client_secret and args.verbose:
print_text(" Found client id and client secret in environment variables.")

if client_id and client_secret:
url = args.sw360_url
if not url:
url = os.environ.get("SW360ServerUrl", "")
if not url:
print_red(" SW360 URL not specified!")
sys.exit(ResultCode.RESULT_COMMAND_ERROR)

if args.verbose:
print_text(" Creating token using client id and secret...")
kc = SW360Keycloak(url)
args.sw360_token = kc.get_keycloak_token(client_id, client_secret, write_access=True)
if args.sw360_token:
args.oauth2 = True
if args.verbose:
print_text(" Got token.")
else:
print_red(" Failed to get token!")
sys.exit(ResultCode.RESULT_AUTH_ERROR)

if args.sw360_token and args.oauth2:
if args.sw360_token and args.oauth2 and args.verbose:
self.analyze_token(args.sw360_token)
print_text("")

if not self.login(token=args.sw360_token, url=args.sw360_url, oauth2=args.oauth2):
print_red("ERROR: login failed!")
Expand Down
45 changes: 35 additions & 10 deletions capycli/bom/findsources.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -772,16 +772,41 @@ def run(self, args: Any) -> None:
self.sw360_url = args.sw360_url

if self.sw360_url:
if args.client_id and args.client_secret:
print_text("Creating token using client id and secret...")
kc = SW360Keycloak(args.sw360_url)
args.sw360_token = kc.get_keycloak_token(args.client_id, args.client_secret, write_access=False)
if args.sw360_token:
args.oauth2 = True
print_text(" Got token.")
else:
print_red(" Failed to get token!")
sys.exit(ResultCode.RESULT_AUTH_ERROR)
if not args.sw360_token:
# command line argument precede environment variables
client_id = args.client_id
client_secret = args.client_secret

if not args.client_id and (not args.client_secret):
# look for environment variables
client_id = os.getenv("SW360Client_id")
client_secret = os.getenv("SW360Client_secret")
if client_id and client_secret and args.verbose:
print_text(" Found client id and client secret in environment variables.")

if client_id and client_secret:
url = args.sw360_url
if not url:
url = os.environ.get("SW360ServerUrl", "")
if not url:
print_red(" SW360 URL not specified!")
sys.exit(ResultCode.RESULT_COMMAND_ERROR)

if args.verbose:
print_text(" Creating token using client id and secret...")
kc = SW360Keycloak(url)
args.sw360_token = kc.get_keycloak_token(client_id, client_secret, write_access=False)
if args.sw360_token:
args.oauth2 = True
if args.verbose:
print_text(" Got token.")
else:
print_red(" Failed to get token!")
sys.exit(ResultCode.RESULT_AUTH_ERROR)

if args.sw360_token and args.oauth2 and args.verbose:
self.analyze_token(args.sw360_token)
print_text("")

self.login(
token=args.sw360_token, url=self.sw360_url, oauth2=args.oauth2)
Expand Down
44 changes: 33 additions & 11 deletions capycli/bom/map_bom.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -935,19 +935,41 @@ def run(self, args: Any) -> None:
if self.verbosity > 1:
print_text(" ", self.get_comp_count_text(sbom), "read from SBOM")

if not args.sw360_token and args.client_id and args.client_secret:
print_text("Creating token using client id and secret...")
kc = SW360Keycloak(args.sw360_url)
args.sw360_token = kc.get_keycloak_token(args.client_id, args.client_secret, write_access=False)
if args.sw360_token:
args.oauth2 = True
print_text(" Got token.")
else:
print_red(" Failed to get token!")
sys.exit(ResultCode.RESULT_AUTH_ERROR)
if not args.sw360_token:
# command line argument precede environment variables
client_id = args.client_id
client_secret = args.client_secret

if not args.client_id and (not args.client_secret):
# look for environment variables
client_id = os.getenv("SW360Client_id")
client_secret = os.getenv("SW360Client_secret")
if client_id and client_secret and args.verbose:
print_text("\n Found client id and client secret in environment variables.")

if client_id and client_secret:
url = args.sw360_url
if not url:
url = os.environ.get("SW360ServerUrl", "")
if not url:
print_red(" SW360 URL not specified!")
sys.exit(ResultCode.RESULT_COMMAND_ERROR)

if args.verbose:
print_text(" Creating token using client id and secret...")
kc = SW360Keycloak(url)
args.sw360_token = kc.get_keycloak_token(client_id, client_secret, write_access=False)
if args.sw360_token:
args.oauth2 = True
if args.verbose:
print_text(" Got token.")
else:
print_red(" Failed to get token!")
sys.exit(ResultCode.RESULT_AUTH_ERROR)

if args.sw360_token and args.oauth2:
if args.sw360_token and args.oauth2 and args.verbose:
self.analyze_token(args.sw360_token)
print_text("")

print_text(" Checking access to SW360...")
if not self.login(token=args.sw360_token, url=args.sw360_url, oauth2=args.oauth2):
Expand Down
2 changes: 1 addition & 1 deletion capycli/common/script_base.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,7 @@ def analyze_token(self, token: str) -> None:
# alg = RS256
decoded = jwt.decode(token, algorithms=["HS256"], options={"verify_signature": False}) # type: ignore
if "scope" in decoded:
scope = decoded["scope"]
scope = str(decoded["scope"])
if scope.lower().find("write") >= 0:
print_text(" Token has write permissions")
else:
Expand Down
1 change: 1 addition & 0 deletions capycli/main/options.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,6 +154,7 @@ def register_options(self) -> None:

self.parser.add_argument(
"-v",
"--verbose",
help="be verbose",
dest="verbose",
action="store_true",
Expand Down
44 changes: 33 additions & 11 deletions capycli/project/check_prerequisites.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -315,19 +315,41 @@ def run(self, args: Any) -> None:
print(" -client_secret CLIENT_SECRET the SW360 client_secret to be used for token generation")
return

if not args.sw360_token and args.client_id and args.client_secret:
print_text("Creating token using client id and secret...")
kc = SW360Keycloak(args.sw360_url)
args.sw360_token = kc.get_keycloak_token(args.client_id, args.client_secret, write_access=False)
if args.sw360_token:
args.oauth2 = True
print_text(" Got token.")
else:
print_red(" Failed to get token!")
sys.exit(ResultCode.RESULT_AUTH_ERROR)
if not args.sw360_token:
# command line argument precede environment variables
client_id = args.client_id
client_secret = args.client_secret

if not args.client_id and (not args.client_secret):
# look for environment variables
client_id = os.getenv("SW360Client_id")
client_secret = os.getenv("SW360Client_secret")
if client_id and client_secret and args.verbose:
print_text(" Found client id and client secret in environment variables.")

if client_id and client_secret:
url = args.sw360_url
if not url:
url = os.environ.get("SW360ServerUrl", "")
if not url:
print_red(" SW360 URL not specified!")
sys.exit(ResultCode.RESULT_COMMAND_ERROR)

if args.verbose:
print_text(" Creating token using client id and secret...")
kc = SW360Keycloak(url)
args.sw360_token = kc.get_keycloak_token(client_id, client_secret, write_access=False)
if args.sw360_token:
args.oauth2 = True
if args.verbose:
print_text(" Got token.")
else:
print_red(" Failed to get token!")
sys.exit(ResultCode.RESULT_AUTH_ERROR)

if args.sw360_token and args.oauth2:
if args.sw360_token and args.oauth2 and args.verbose:
self.analyze_token(args.sw360_token)
print_text("")

if not self.login(token=args.sw360_token, url=args.sw360_url, oauth2=args.oauth2):
print_red("ERROR: login failed!")
Expand Down
Loading
Loading