Supply Chain & Third-Party Risk

# SBOM Risk Analysis Script
# Analyzes CycloneDX SBOM for supply chain risk indicators

import json
from dataclasses import dataclass, field
from datetime import datetime, timezone


@dataclass
class DependencyRisk:
    name: str
    version: str
    risk_score: float = 0.0
    risk_factors: list = field(default_factory=list)


def analyze_sbom(sbom_path: str) -> list[DependencyRisk]:
    """Analyze SBOM for supply chain risk indicators."""
    with open(sbom_path, "r") as f:
        sbom = json.load(f)

    findings = []
    components = sbom.get("components", [])

    for comp in components:
        risk = DependencyRisk(
            name=comp.get("name", "unknown"),
            version=comp.get("version", "unknown"),
        )

        # Check for known vulnerabilities
        vulns = comp.get("vulnerabilities", [])
        if vulns:
            critical = sum(
                1 for v in vulns
                if v.get("severity", "").lower() == "critical"
            )
            risk.risk_score += critical * 25 + len(vulns) * 5
            risk.risk_factors.append(
                f"{len(vulns)} known vulns ({critical} critical)"
            )

        # Check for outdated components
        licenses = comp.get("licenses", [])
        if not licenses:
            risk.risk_score += 10
            risk.risk_factors.append("No license declared")
        else:
            for lic in licenses:
                license_id = lic.get("license", {}).get("id", "")
                if license_id in ("AGPL-3.0", "GPL-3.0-only"):
                    risk.risk_score += 15
                    risk.risk_factors.append(
                        f"Copyleft license: {license_id}"
                    )

        # Check supplier information
        supplier = comp.get("supplier", {})
        if not supplier:
            risk.risk_score += 10
            risk.risk_factors.append("No supplier information")

        # Flag components without hashes
        hashes = comp.get("hashes", [])
        if not hashes:
            risk.risk_score += 15
            risk.risk_factors.append("No integrity hashes")

        if risk.risk_factors:
            findings.append(risk)

    # Sort by risk score descending
    findings.sort(key=lambda r: r.risk_score, reverse=True)
    return findings


def generate_risk_report(findings: list[DependencyRisk]) -> str:
    """Generate supply chain risk summary report."""
    lines = ["Supply Chain Risk Analysis Report"]
    lines.append("=" * 40)
    lines.append(
        f"Analysis Date: "
        f"{datetime.now(timezone.utc).strftime('%Y-%m-%d %H:%M UTC')}"
    )
    lines.append(f"Components Analyzed: {len(findings)} with findings")
    lines.append("")

    high_risk = [f for f in findings if f.risk_score >= 50]
    medium_risk = [f for f in findings if 20 <= f.risk_score < 50]
    low_risk = [f for f in findings if f.risk_score < 20]

    lines.append(f"HIGH RISK:   {len(high_risk)} components")
    lines.append(f"MEDIUM RISK: {len(medium_risk)} components")
    lines.append(f"LOW RISK:    {len(low_risk)} components")

    for risk_level, items in [
        ("HIGH", high_risk),
        ("MEDIUM", medium_risk),
    ]:
        if items:
            lines.append(f"\n--- {risk_level} RISK ---")
            for item in items[:10]:
                lines.append(
                    f"  {item.name}@{item.version} "
                    f"(score: {item.risk_score})"
                )
                for factor in item.risk_factors:
                    lines.append(f"    - {factor}")

    return "\n".join(lines)