Dependency Management in Software Development¶

# Example SLSA provenance verification
import json
from cryptography.x509 import load_pem_x509_certificate
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.primitives import hashes

def verify_slsa_attestation(attestation_path, artifact_path):
    """Verify SLSA attestation for an artifact."""
    # Load attestation
    with open(attestation_path, 'r') as f:
        attestation = json.load(f)

    # Extract certificate and signature
    cert_data = attestation['payload']['certificate']
    signature = attestation['signature']

    # Load certificate
    cert = load_pem_x509_certificate(cert_data.encode('utf-8'))
    public_key = cert.public_key()

    # Calculate artifact digest
    with open(artifact_path, 'rb') as f:
        artifact_data = f.read()
    artifact_digest = hashes.Hash(hashes.SHA256())
    artifact_digest.update(artifact_data)
    digest = artifact_digest.finalize()

    # Verify signature
    try:
        public_key.verify(
            signature,
            digest,
            padding.PKCS1v15(),
            hashes.SHA256()
        )
        print("Signature verification successful")

        # Verify provenance attributes
        builder = attestation['payload']['provenance']['builder']
        built_from = attestation['payload']['provenance']['materials'][0]['uri']

        print(f"Built by: {builder}")
        print(f"Built from: {built_from}")

        return True
    except Exception as e:
        print(f"Verification failed: {e}")
        return False

# Example dependency risk scoring algorithm
def calculate_dependency_risk(dependency):
    """Calculate risk score for a dependency."""
    score = 0

    # Security factors
    if dependency['has_vulnerabilities']:
        vuln_score = sum(v['cvss_score'] for v in dependency['vulnerabilities'])
        score += min(vuln_score, 10) * 2  # Max 20 points

    # Maintenance factors
    if dependency['last_release'] > 365:  # days
        score += 5  # Unmaintained
    elif dependency['last_release'] > 180:
        score += 3  # Poorly maintained

    if dependency['open_issues'] > 100 and dependency['open_issues_rate'] > 0.7:
        score += 5  # Many unresolved issues

    # Popularity factors
    if dependency['downloads_last_month'] < 1000:
        score += 5  # Low adoption
    elif dependency['downloads_last_month'] < 10000:
        score += 3  # Moderate adoption

    # Supply chain factors
    if not dependency['has_2fa']:
        score += 5  # No 2FA for maintainers

    if dependency['contributors_count'] < 3:
        score += 3  # Too few maintainers

    # License factors
    if dependency['license'] in HIGH_RISK_LICENSES:
        score += 5
    elif dependency['license'] in MEDIUM_RISK_LICENSES:
        score += 3

    # Usage factors
    if dependency['is_direct']:
        score *= 1.2  # Direct dependencies are higher risk

    if dependency['used_in_critical_path']:
        score *= 1.5  # Used in critical application features

    return min(score, 100)  # Cap at 100

# Example dependency classification script
import json
import os
import csv

def classify_dependency(name, metadata):
    """Classify a dependency by criticality."""
    # Critical dependencies directly affect security
    security_related = [
        'crypto', 'auth', 'password', 'login', 'cipher',
        'token', 'oauth', 'permission', 'access', 'jwt'
    ]

    # Check if name or description contains security-related terms
    is_security = any(term in name.lower() for term in security_related)
    if metadata.get('description'):
        is_security = is_security or any(term in metadata['description'].lower() 
                                        for term in security_related)

    if is_security:
        return 'critical'

    # High-impact dependencies affect core functionality
    if metadata.get('is_direct') and metadata.get('used_in_core_features'):
        return 'high'

    # Medium-impact dependencies have moderate usage
    if metadata.get('is_direct'):
        return 'medium'

    # Low-impact dependencies are transitive with limited impact
    return 'low'

# Process dependency reports
results = []
for root, dirs, files in os.walk('.'):
    if 'dependency-report.json' in files:
        with open(os.path.join(root, 'dependency-report.json'), 'r') as f:
            try:
                data = json.load(f)
                project_name = os.path.basename(root)

                # Process dependencies
                for dep_name, dep_data in data.get('dependencies', {}).items():
                    classification = classify_dependency(dep_name, dep_data)

                    results.append({
                        'project': project_name,
                        'dependency': dep_name,
                        'version': dep_data.get('version', 'unknown'),
                        'classification': classification,
                        'direct': dep_data.get('is_direct', False),
                        'license': dep_data.get('license', 'unknown')
                    })
            except json.JSONDecodeError:
                print(f"Error processing {os.path.join(root, 'dependency-report.json')}")

# Write results to CSV
with open('dependency-inventory.csv', 'w', newline='') as f:
    writer = csv.DictWriter(f, fieldnames=[
        'project', 'dependency', 'version', 'classification', 
        'direct', 'license'
    ])
    writer.writeheader()
    writer.writerows(results)

# Example security baseline analysis
import json

# Load security scan results
with open('security-baseline-npm.json', 'r') as f:
    npm_results = json.load(f)

# Count vulnerabilities by severity
severity_counts = {
    'critical': 0,
    'high': 0,
    'moderate': 0,
    'low': 0
}

affected_deps = set()

# Process npm results
for vuln in npm_results.get('vulnerabilities', {}).values():
    severity = vuln.get('severity', 'unknown')
    if severity in severity_counts:
        severity_counts[severity] += 1

    affected_deps.add(vuln.get('name'))

print(f"Total affected dependencies: {len(affected_deps)}")
print("Vulnerabilities by severity:")
for severity, count in severity_counts.items():
    print(f"  {severity}: {count}")

# Identify top vulnerable dependencies
dep_count = {}
for vuln in npm_results.get('vulnerabilities', {}).values():
    name = vuln.get('name')
    dep_count[name] = dep_count.get(name, 0) + 1

top_deps = sorted(dep_count.items(), key=lambda x: x[1], reverse=True)[:10]
print("\nTop 10 vulnerable dependencies:")
for dep, count in top_deps:
    print(f"  {dep}: {count} vulnerabilities")

# Example custom dependency update script
import os
import json
import subprocess
import requests
from datetime import datetime

def check_dependency_health(name, version):
    """Check the health of a dependency."""
    # Check GitHub repo stats
    repo_info = get_github_repo_info(name)

    # Check last commit date
    last_commit_date = repo_info.get('last_commit_date')
    if last_commit_date:
        last_commit_date = datetime.fromisoformat(last_commit_date.replace('Z', '+00:00'))
        days_since_commit = (datetime.now() - last_commit_date).days
        if days_since_commit > 365:
            return False, f"Last commit was {days_since_commit} days ago"

    # Check open issues
    open_issues = repo_info.get('open_issues', 0)
    total_issues = repo_info.get('total_issues', 0)
    if total_issues > 0 and open_issues / total_issues > 0.8:
        return False, f"High ratio of open issues: {open_issues}/{total_issues}"

    # Check security advisories
    advisories = get_security_advisories(name, version)
    if advisories:
        return False, f"Has {len(advisories)} security advisories"

    return True, "Dependency is healthy"

def update_dependencies():
    """Update dependencies based on health checks."""
    # Load package.json
    with open('package.json', 'r') as f:
        package_json = json.load(f)

    dependencies = package_json.get('dependencies', {})
    results = {
        'updated': [],
        'skipped': []
    }

    for dep_name, current_version in dependencies.items():
        print(f"Checking {dep_name}@{current_version}...")

        # Get latest version
        latest_version = get_latest_version(dep_name)

        if latest_version == current_version:
            results['skipped'].append({
                'name': dep_name,
                'reason': 'Already at latest version'
            })
            continue

        # Check dependency health
        is_healthy, health_msg = check_dependency_health(dep_name, latest_version)

        if not is_healthy:
            results['skipped'].append({
                'name': dep_name,
                'reason': health_msg
            })
            continue

        # Update dependency
        try:
            subprocess.run(['npm', 'install', f'{dep_name}@{latest_version}'], check=True)
            results['updated'].append({
                'name': dep_name,
                'from': current_version,
                'to': latest_version
            })
        except subprocess.CalledProcessError:
            results['skipped'].append({
                'name': dep_name,
                'reason': 'Installation failed'
            })

    # Output results
    print(f"\nUpdated {len(results['updated'])} dependencies:")
    for dep in results['updated']:
        print(f"  {dep['name']}: {dep['from']} -> {dep['to']}")

    print(f"\nSkipped {len(results['skipped'])} dependencies:")
    for dep in results['skipped']:
        print(f"  {dep['name']}: {dep['reason']}")

    # Run tests to verify updates
    try:
        subprocess.run(['npm', 'test'], check=True)
        print("\n✅ Tests passed with updated dependencies")
    except subprocess.CalledProcessError:
        print("\n❌ Tests failed with updated dependencies")
        print("Rolling back changes...")
        subprocess.run(['git', 'checkout', '--', 'package.json', 'package-lock.json'])
        subprocess.run(['npm', 'ci'])

# Example reproducible build verification
import os
import json
import subprocess
import hashlib

def verify_package_integrity(package_name, version, expected_hash=None):
    """Verify package integrity through reproducible build."""
    print(f"Verifying {package_name}@{version}...")

    # Create temporary build environment
    build_dir = f"./verify-builds/{package_name}"
    os.makedirs(build_dir, exist_ok=True)

    # Clone source
    repo_url = get_repository_url(package_name)
    if not repo_url:
        print(f"❌ Could not determine repository URL for {package_name}")
        return False

    # Clone at specific version
    subprocess.run([
        "git", "clone", repo_url, build_dir
    ], check=True)

    # Checkout version
    os.chdir(build_dir)
    subprocess.run([
        "git", "checkout", f"v{version}"
    ], check=True)

    # Build package in controlled environment
    print("Building from source...")
    build_result = subprocess.run([
        "docker", "run", "--rm",
        "-v", f"{os.getcwd()}:/build",
        "reproducible-build-env:latest",
        "/bin/sh", "-c", "cd /build && npm ci && npm run build"
    ], capture_output=True)

    if build_result.returncode != 0:
        print(f"❌ Build failed: {build_result.stderr.decode('utf-8')}")
        return False

    # Calculate hash of built package
    built_package_path = "./dist/package.tgz"
    if not os.path.exists(built_package_path):
        print(f"❌ Built package not found at {built_package_path}")
        return False

    with open(built_package_path, 'rb') as f:
        built_hash = hashlib.sha256(f.read()).hexdigest()

    # Compare with expected hash
    if expected_hash:
        if built_hash == expected_hash:
            print(f"✅ Package hash matches expected: {built_hash}")
            return True
        else:
            print(f"❌ Hash mismatch! Expected: {expected_hash}, Got: {built_hash}")
            return False

    # If no expected hash, compare with published version
    published_package = get_published_package(package_name, version)
    published_hash = hashlib.sha256(published_package).hexdigest()

    if built_hash == published_hash:
        print(f"✅ Built package matches published package: {built_hash}")
        return True
    else:
        print(f"❌ Hash mismatch! Published: {published_hash}, Built: {built_hash}")
        # Store diff for analysis
        with open(f"{package_name}-{version}-diff.log", "w") as f:
            f.write(f"Published hash: {published_hash}\n")
            f.write(f"Built hash: {built_hash}\n")
        return False