feat!: drop onguard integration in favour of tpa

Signed-off-by: Ruben Romero Montes <[email protected]>

Author: ruromero

README.md

@@ -12,7 +12,7 @@
 ## Required parameters
 
 - `api.tpa.host` The host of the Trusted Profile Analyzer service. Used as a Vulnerability Provider.
-- `api.onguard.host` The host where the [ONGuard](https://github.com/trustification/onguard) service is deployed
+- `api.tpa.token` The TPA token for default authentication to use when the `ex-tpa-token` header is not provided
 - `api.snyk.token` Snyk API token for default authentication when the Snyk integration is enabled
 
 ## OpenAPI and SwaggerUI
@@ -25,7 +25,6 @@
 Currently these are the available providers that will provide a vulnerability report for your components or full dependency graph.
 
 - TPA ([`Trusted Profile Analyzer`](https://www.trustification.io/))
-- OSV ([ONGuard](https://github.com/trustification/onguard))
 - Snyk (`snyk`)
 - OSS Index (`oss-index`)
 
@@ -37,7 +36,7 @@ Providers should be defined as a multi-valued list in the `providers` Query Para
 
 The supported Package URL types depends on each external provider.
 
-- TPA, OSV and OSS Index don't have any limitation on the type used.
+- TPA and OSS Index don't have any limitation on the type used.
 - Snyk: Given the limitations of the API endpoint currently being used only supports the following PackageURL types:
   - Maven (`maven`)
   - Gradle (`gradle`)

dashboards/grafana-dashboard-exhort.configmap.yaml

@@ -1021,7 +1021,7 @@ data:
                 "uid": "${datasource}"
               },
               "editorMode": "code",
-              "expr": "histogram_quantile(0.90, sum by (le) (rate(camel_route_policy_seconds_bucket{routeId=\"osvRequest\"}[2m])))",
+              "expr": "histogram_quantile(0.90, sum by (le) (rate(camel_route_policy_seconds_bucket{routeId=\"tpaRequest\"}[2m])))",
               "legendFormat": "0.90",
               "range": true,
               "refId": "A"
@@ -1032,7 +1032,7 @@ data:
                 "uid": "${datasource}"
               },
               "editorMode": "code",
-              "expr": "histogram_quantile(0.95, sum by (le) (rate(camel_route_policy_seconds_bucket{routeId=\"osvRequest\"}[2m])))",
+              "expr": "histogram_quantile(0.95, sum by (le) (rate(camel_route_policy_seconds_bucket{routeId=\"tpaRequest\"}[2m])))",
               "hide": false,
               "legendFormat": "0.95",
               "range": true,
@@ -1044,14 +1044,14 @@ data:
                 "uid": "${datasource}"
               },
               "editorMode": "code",
-              "expr": "histogram_quantile(0.99, sum by (le) (rate(camel_route_policy_seconds_bucket{routeId=\"osvRequest\"}[2m])))",
+              "expr": "histogram_quantile(0.99, sum by (le) (rate(camel_route_policy_seconds_bucket{routeId=\"tpaRequest\"}[2m])))",
               "hide": false,
               "legendFormat": "0.99",
               "range": true,
               "refId": "C"
             }
           ],
-          "title": "ONGuard latency",
+          "title": "TPA latency",
           "type": "timeseries"
         },
         {

src/main/java/com/redhat/exhort/config/metrics/CustomMetrics.java

@@ -42,7 +42,7 @@ public class CustomMetrics {
           "snykValidateToken",
           "snykRequest",
           "getTrustedContent",
-          "osvRequest",
+          "tpaRequest",
           "ossValidateCredentials",
           "ossSplitReq",
           "ossIndexRequest",

src/main/java/com/redhat/exhort/integration/Constants.java

@@ -62,7 +62,6 @@ private Constants() {}
   public static final String SNYK_PROVIDER = "snyk";
   public static final String OSS_INDEX_PROVIDER = "oss-index";
   public static final String TRUSTED_CONTENT_PROVIDER = "trusted-content";
-  public static final String OSV_PROVIDER = "osv";
   public static final String TPA_PROVIDER = "tpa";
   public static final String UNKNOWN_PROVIDER = "unknown";
 
@@ -101,8 +100,6 @@ private Constants() {}
 
   public static final String OSS_INDEX_AUTH_COMPONENT_API_PATH = "/authorized/component-report";
   public static final String OSS_INDEX_VERSION_PATH = "/version";
-  public static final String OSV_NVD_PURLS_PATH = "/purls";
-  public static final String OSV_NVD_HEALTH_PATH = "/q/health";
 
   public static final String TRUSTED_CONTENT_PATH = "/recommend";
   public static final String TPA_ANALYZE_PATH = "/vulnerability/analyze";
@@ -124,7 +121,6 @@ private Constants() {}
             {
               add(SNYK_PROVIDER);
               add(OSS_INDEX_PROVIDER);
-              add(OSV_PROVIDER);
               add(TPA_PROVIDER);
             }
           });

src/main/java/com/redhat/exhort/integration/providers/ProviderHealthCheck.java

@@ -30,7 +30,7 @@
 public class ProviderHealthCheck extends AbstractHealthCheck {
 
   private static final List<String> ALL_PROVIDERS_HEALTH_CHECKS =
-      List.of("direct:snykHealthCheck", "direct:osvHealthCheck", "direct:ossIndexHealthCheck");
+      List.of("direct:snykHealthCheck", "direct:tpaHealthCheck", "direct:ossIndexHealthCheck");
 
   public ProviderHealthCheck() {
     super("External Providers Readiness Check");

src/main/java/com/redhat/exhort/integration/providers/VulnerabilityProvider.java

@@ -51,10 +51,7 @@ public class VulnerabilityProvider {
   @ConfigProperty(name = "api.ossindex.disabled", defaultValue = "true")
   boolean ossIndexDisabled;
 
-  @ConfigProperty(name = "api.onguard.disabled", defaultValue = "false")
-  boolean osvDisabled;
-
-  @ConfigProperty(name = "api.tpa.disabled", defaultValue = "true")
+  @ConfigProperty(name = "api.tpa.disabled", defaultValue = "false")
   boolean tpaDisabled;
 
   private List<String> providers;
@@ -66,7 +63,6 @@ public void initProviders() {
             Constants.PROVIDERS.stream()
                 .filter(p -> !(Constants.SNYK_PROVIDER.equals(p) && snykDisabled))
                 .filter(p -> !(Constants.OSS_INDEX_PROVIDER.equals(p) && ossIndexDisabled))
-                .filter(p -> !(Constants.OSV_PROVIDER.equals(p) && osvDisabled))
                 .filter(p -> !(Constants.TPA_PROVIDER.equals(p) && tpaDisabled))
                 .toList());
   }
@@ -83,7 +79,6 @@ public List<String> getProviderEndpoints(
                 switch (p) {
                   case Constants.SNYK_PROVIDER -> "direct:snykScan";
                   case Constants.OSS_INDEX_PROVIDER -> "direct:ossIndexScan";
-                  case Constants.OSV_PROVIDER -> "direct:osvScan";
                   case Constants.TPA_PROVIDER -> "direct:tpaScan";
                   default -> throw new UnexpectedProviderException(new RuntimeException(p));
                 })