chore(migrate): migrate Errata Tool client from SBOMer classic

hack/anonymize-test-data.sh

@@ -0,0 +1,147 @@
+#!/bin/bash
+
+# Script to anonymize sensitive data in errata-tool test JSON files
+# Usage: ./hack/anonymize-test-data.sh
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+TEST_DATA_DIR="$PROJECT_ROOT/src/test/resources/errata-responses"
+
+echo "Anonymizing test data in: $TEST_DATA_DIR"
+
+# Function to anonymize builds.json files
+anonymize_builds_json() {
+    local file="$1"
+    echo "  Processing builds file: $file"
+
+    # Create a temporary file
+    local temp_file="${file}.tmp"
+
+    # Use jq to anonymize sig_key and container_sig_key
+    jq '
+        walk(
+            if type == "object" then
+                if has("sig_key") then
+                    .sig_key = {
+                        "name": "anonymized-key",
+                        "keyid": "00000000"
+                    }
+                else . end |
+                if has("container_sig_key") then
+                    .container_sig_key = {
+                        "name": "anonymized-key",
+                        "keyid": "00000000"
+                    }
+                else . end |
+                if has("added_by") then
+                    .added_by = "anonymized-user@example.com"
+                else . end
+            else . end
+        )
+    ' "$file" > "$temp_file"
+
+    # Replace original file
+    mv "$temp_file" "$file"
+}
+
+# Function to anonymize errata.json files
+anonymize_errata_json() {
+    local file="$1"
+    echo "  Processing errata file: $file"
+
+    # Create a temporary file
+    local temp_file="${file}.tmp"
+
+    # Use jq to anonymize user data, IDs, and CVEs
+    jq '
+        # Function to anonymize CVE references
+        def anonymize_cve:
+            gsub("CVE-[0-9]{4}-[0-9]+"; "CVE-XXXX-XXXXX");
+
+        # Walk through the entire structure
+        walk(
+            if type == "object" then
+                # Anonymize user object
+                if has("user") then
+                    .user = {
+                        "id": 9999999,
+                        "login_name": "anonymized-user@example.com",
+                        "realname": "Anonymized User",
+                        "user_organization_id": 999,
+                        "enabled": .user.enabled,
+                        "receives_mail": .user.receives_mail,
+                        "preferences": {},
+                        "email_address": "anonymized-user@example.com",
+                        "account_name": "anonymized-user",
+                        "type": .user.type
+                    }
+                else . end |
+
+                # Anonymize kerberos_principal_owner
+                if has("kerberos_principal_owner") then
+                    .kerberos_principal_owner = {
+                        "name": "anonymized-service@example.com",
+                        "description": "Anonymized service account"
+                    }
+                else . end |
+
+                # Anonymize reporter_id, assigned_to_id, package_owner_id, manager_id
+                if has("reporter_id") then
+                    .reporter_id = 9999991
+                else . end |
+                if has("assigned_to_id") then
+                    .assigned_to_id = 9999992
+                else . end |
+                if has("package_owner_id") then
+                    .package_owner_id = 9999993
+                else . end |
+                if has("manager_id") then
+                    .manager_id = 9999994
+                else . end |
+                if has("doc_reviewer_id") then
+                    .doc_reviewer_id = 9999995
+                else . end |
+                if has("product_security_reviewer_id") and .product_security_reviewer_id != null then
+                    .product_security_reviewer_id = 9999996
+                else . end
+            else . end |
+
+            # Anonymize CVE references in strings
+            if type == "string" then
+                anonymize_cve
+            else . end
+        )
+    ' "$file" > "$temp_file"
+
+    # Replace original file
+    mv "$temp_file" "$file"
+}
+
+# Process all builds.json files
+echo ""
+echo "=== Anonymizing builds.json files ==="
+find "$TEST_DATA_DIR" -type f -name "*_builds.json" | while read -r file; do
+    anonymize_builds_json "$file"
+done
+
+# Process all errata.json files
+echo ""
+echo "=== Anonymizing errata.json files ==="
+find "$TEST_DATA_DIR" -type f -name "*_errata.json" | while read -r file; do
+    anonymize_errata_json "$file"
+done
+
+echo ""
+echo "=== Anonymization complete ==="
+echo ""
+echo "Summary of changes:"
+echo "  - Replaced sig_key and container_sig_key with placeholder values"
+echo "  - Replaced added_by with anonymized-user@example.com"
+echo "  - Anonymized all user objects (IDs, names, emails, org IDs)"
+echo "  - Anonymized reporter_id, assigned_to_id, package_owner_id, manager_id"
+echo "  - Replaced CVE references with CVE-XXXX-XXXXX"
+echo ""
+
+# Made with Bob

pom.xml

@@ -1,7 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
     <groupId>org.jboss.sbomer</groupId>
     <artifactId>errata-tool-handler</artifactId>
@@ -90,6 +88,19 @@
             <groupId>io.quarkus</groupId>
             <artifactId>quarkus-rest-jackson</artifactId>
         </dependency>
+        <dependency>
+            <groupId>io.quarkus</groupId>
+            <artifactId>quarkus-smallrye-fault-tolerance</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>io.quarkus</groupId>
+            <artifactId>quarkus-rest-client-jackson</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>io.quarkiverse.kerberos</groupId>
+            <artifactId>quarkus-kerberos-client</artifactId>
+            <version>2.2.0</version>
+        </dependency>
         <dependency>
             <groupId>io.quarkus</groupId>
             <artifactId>quarkus-junit5</artifactId>
@@ -100,6 +111,7 @@
             <artifactId>rest-assured</artifactId>
             <scope>test</scope>
         </dependency>
+
         <dependency>
             <groupId>io.quarkus</groupId>
             <artifactId>quarkus-junit5-mockito</artifactId>
@@ -127,7 +139,6 @@
             <version>${logback.version}</version>
             <scope>test</scope>
         </dependency>
-
         <dependency>
             <groupId>org.jboss.sbomer.events</groupId>
             <artifactId>sbomer-contracts</artifactId>
@@ -194,8 +205,7 @@
                 </executions>
                 <configuration>
                     <systemPropertyVariables>
-                        <native.image.path>
-                            ${project.build.directory}/${project.build.finalName}-runner</native.image.path>
+                        <native.image.path>${project.build.directory}/${project.build.finalName}-runner</native.image.path>
                         <java.util.logging.manager>org.jboss.logmanager.LogManager</java.util.logging.manager>
                         <maven.home>${maven.home}</maven.home>
                     </systemPropertyVariables>

src/main/java/org/jboss/sbomer/handler/et/adapter/out/ErrataToolService.java

@@ -1,8 +1,12 @@
 package org.jboss.sbomer.handler.et.adapter.out;
 
-import java.util.ArrayList;
 import java.util.List;
+import java.util.stream.Collectors;
 
+import org.eclipse.microprofile.rest.client.inject.RestClient;
+import org.jboss.sbomer.handler.et.adapter.out.errata.ErrataClient;
+import org.jboss.sbomer.handler.et.adapter.out.errata.dto.Errata;
+import org.jboss.sbomer.handler.et.adapter.out.errata.dto.ErrataBuildList;
 import org.jboss.sbomer.handler.et.core.domain.advisory.Advisory;
 import org.jboss.sbomer.handler.et.core.domain.advisory.Build;
 import org.jboss.sbomer.handler.et.core.port.spi.ErrataTool;
@@ -14,19 +18,65 @@
 @ApplicationScoped
 @Slf4j
 public class ErrataToolService implements ErrataTool {
+
+    @RestClient
+    ErrataClient ec;
+
     @Override
     public List<Build> fetchBuilds(String advisoryId) {
         log.info("Fetching attached builds for advisory with ID: '{}'...", advisoryId);
 
-        // Simulate getting a list of varied builds from an advisory from ET
-        List<Build> builds = new ArrayList<>();
-        builds.add(new Build(456L, "sbom-service-latest", "CONTAINER_IMAGE", "quay.io/sbomer/sbom-service:latest"));
+        // Fetch erratum to get content types
+        Errata erratum = ec.getErratum(advisoryId);
+        String buildType = erratum.getDetails()
+                .map(details -> determineBuildType(details.getContentTypes()))
+                .orElse("UNKNOWN");
 
-        log.debug("Fetched {} builds for advisory with ID: '{}'", builds.size(), advisoryId);
+        ErrataBuildList erratumBuildList = ec.getBuildsList(advisoryId);
 
+        // Flatten the build list and convert BuildItems to Builds
+        List<Build> builds = erratumBuildList.getProductVersions()
+                .values()
+                .stream()
+                .flatMap(productVersionEntry -> productVersionEntry.getBuilds()
+                        .stream()
+                        .flatMap(build -> build.getBuildItems().values().stream()))
+                .map(buildItem -> new Build(
+                        buildItem.getId(),
+                        buildItem.getNvr(),
+                        buildType,
+                        // NVR or NEVR?
+                        buildItem.getNvr()))
+                .collect(Collectors.toList());
         return builds;
     }
 
+    /**
+     * Determines the build type based on erratum content types.
+     *
+     * @param contentTypes List of content types from the erratum
+     * @return The build type string (e.g., "CONTAINER_IMAGE", "RPM")
+     */
+    private String determineBuildType(List<String> contentTypes) {
+        if (contentTypes == null || contentTypes.isEmpty()) {
+            return "UNKNOWN";
+        }
+
+        // Check for container/docker content
+        if (contentTypes.stream().anyMatch(type -> type.equalsIgnoreCase("docker") ||
+                type.equalsIgnoreCase("container"))) {
+            return "CONTAINER_IMAGE";
+        }
+
+        // Check for RPM content
+        if (contentTypes.stream().anyMatch(type -> type.equalsIgnoreCase("rpm"))) {
+            return "RPM";
+        }
+
+        // Default to the first content type in uppercase
+        return contentTypes.get(0).toUpperCase();
+    }
+
     @Override
     public Advisory getInfo(String advisoryId) {
         // TODO temporary dummy check to test error