Skip to content

Commit baec7a0

Browse files
tromaitromai
authored
chore: add provenance file handling into run_macaron.sh (#698)
Signed-off-by: Trong Nhan Mai <trong.nhan.mai@oracle.com>
1 parent 39bca14 commit baec7a0

File tree

8 files changed

+137
-0
lines changed

8 files changed

+137
-0
lines changed

‎scripts/dev_scripts/integration_tests.sh

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -760,6 +760,29 @@ POLICY_EXPECTED=$WORKSPACE/tests/policy_engine/expected_results/micronaut-core/t
760760
$RUN_POLICY -f $POLICY_FILE -d "$WORKSPACE/output/macaron.db" || log_fail
761761
check_or_update_expected_output $COMPARE_POLICIES $POLICY_RESULT $POLICY_EXPECTED || log_fail
762762

763+
echo -e "\n----------------------------------------------------------------------------------"
764+
echo "behnazh-w/example-maven-app as a local repository"
765+
echo "Test Witness provenance as an input, Cue expectation validation, Policy CLI and VSA generation."
766+
echo -e "----------------------------------------------------------------------------------\n"
767+
RUN_POLICY="macaron verify-policy"
768+
POLICY_FILE=$WORKSPACE/tests/policy_engine/resources/policies/example-maven-project/policy.dl
769+
POLICY_RESULT=$WORKSPACE/output/policy_report.json
770+
POLICY_EXPECTED=$WORKSPACE/tests/policy_engine/expected_results/example-maven-project/example_maven_project_policy_report.json
771+
VSA_RESULT=$WORKSPACE/output/vsa.intoto.jsonl
772+
VSA_PAYLOAD_EXPECTED=$WORKSPACE/tests/vsa/integration/local_witness_example-maven-project/vsa_payload.json
773+
EXPECTATION_FILE=$WORKSPACE/tests/slsa_analyzer/provenance/expectations/cue/resources/valid_expectations/example-maven-project.cue
774+
PROVENANCE_FILE=$WORKSPACE/tests/slsa_analyzer/provenance/resources/valid_provenances/example-maven-project.json
775+
776+
# Cloning the repository locally
777+
git clone https://github.com/behnazh-w/example-maven-app.git $WORKSPACE/output/git_repos/local_repos/example-maven-app || log_fail
778+
779+
$RUN_MACARON analyze -pf $PROVENANCE_FILE -pe $EXPECTATION_FILE -purl pkg:maven/io.github.behnazh-w.demo/example-maven-app@1.0-SNAPSHOT?type=jar --repo-path example-maven-app --skip-deps || log_fail
780+
781+
$RUN_POLICY -f $POLICY_FILE -d "$WORKSPACE/output/macaron.db" || log_fail
782+
783+
check_or_update_expected_output $COMPARE_POLICIES $POLICY_RESULT $POLICY_EXPECTED || log_fail
784+
check_or_update_expected_output "$COMPARE_VSA" "$VSA_RESULT" "$VSA_PAYLOAD_EXPECTED" || log_fail
785+
763786
# Testing the Repo Finder's remote calls.
764787
# This requires the 'packageurl' Python module
765788
echo -e "\n----------------------------------------------------------------------------------"

‎scripts/dev_scripts/integration_tests_docker.sh

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,28 @@ $RUN_MACARON_SCRIPT verify-policy -f $POLICY_FILE -d "$WORKSPACE/output/macaron.
160160
python $COMPARE_POLICIES $POLICY_RESULT $POLICY_EXPECTED || log_fail
161161
python "$COMPARE_VSA" "$VSA_RESULT" "$VSA_PAYLOAD_EXPECTED" || log_fail
162162

163+
echo -e "\n----------------------------------------------------------------------------------"
164+
echo "behnazh-w/example-maven-app as a local repository"
165+
echo "Test Witness provenance as an input, Cue expectation validation, Policy CLI and VSA generation."
166+
echo -e "----------------------------------------------------------------------------------\n"
167+
POLICY_FILE=$WORKSPACE/tests/policy_engine/resources/policies/example-maven-project/policy.dl
168+
POLICY_RESULT=$WORKSPACE/output/policy_report.json
169+
POLICY_EXPECTED=$WORKSPACE/tests/policy_engine/expected_results/example-maven-project/example_maven_project_policy_report.json
170+
VSA_RESULT=$WORKSPACE/output/vsa.intoto.jsonl
171+
VSA_PAYLOAD_EXPECTED=$WORKSPACE/tests/vsa/integration/local_witness_example-maven-project/vsa_payload.json
172+
EXPECTATION_FILE=$WORKSPACE/tests/slsa_analyzer/provenance/expectations/cue/resources/valid_expectations/example-maven-project.cue
173+
PROVENANCE_FILE=$WORKSPACE/tests/slsa_analyzer/provenance/resources/valid_provenances/example-maven-project.json
174+
175+
# Cloning the repository locally
176+
git clone https://github.com/behnazh-w/example-maven-app.git $WORKSPACE/output/git_repos/local_repos/example-maven-app || log_fail
177+
178+
$RUN_MACARON_SCRIPT analyze -pf $PROVENANCE_FILE -pe $EXPECTATION_FILE -purl pkg:maven/io.github.behnazh-w.demo/example-maven-app@1.0-SNAPSHOT?type=jar --repo-path example-maven-app --skip-deps || log_fail
179+
180+
$RUN_MACARON_SCRIPT verify-policy -f $POLICY_FILE -d "$WORKSPACE/output/macaron.db" || log_fail
181+
182+
python $COMPARE_POLICIES $POLICY_RESULT $POLICY_EXPECTED || log_fail
183+
python "$COMPARE_VSA" "$VSA_RESULT" "$VSA_PAYLOAD_EXPECTED" || log_fail
184+
163185
echo -e "\n----------------------------------------------------------------------------------"
164186
echo "Test running the analysis without setting the GITHUB_TOKEN environment variables."
165187
echo -e "----------------------------------------------------------------------------------\n"

‎scripts/release_scripts/run_macaron.sh

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -315,6 +315,10 @@ if [[ $command == "analyze" ]]; then
315315
arg_prov_exp="$2"
316316
shift
317317
;;
318+
-pf|--provenance-file)
319+
arg_prov_file="$2"
320+
shift
321+
;;
318322
-c|--config-path)
319323
arg_config_path="$2"
320324
shift
@@ -440,6 +444,16 @@ if [[ -n "${arg_prov_exp:-}" ]]; then
440444
fi
441445
fi
442446

447+
# Mount the provenance file into ${MACARON_WORKSPACE}/prov_files/${pf_name} where pf_name is a file name.
448+
if [[ -n "${arg_prov_file:-}" ]]; then
449+
prov_file_path="${arg_prov_file}"
450+
prov_file_name="$(basename "${prov_file_path}")"
451+
prov_file_path_in_container=${MACARON_WORKSPACE}/prov_files/${prov_file_name}
452+
argv_command+=("--provenance-file" "$prov_file_path_in_container")
453+
454+
mount_file "-pf/--provenance-file" "$prov_file_path" "$prov_file_path_in_container" "ro,Z"
455+
fi
456+
443457
# MACARON entrypoint - verify-policy command argvs
444458
# This is for macaron verify-policy command.
445459
# Determine the database path to be mounted into ${MACARON_WORKSPACE}/database/macaron.db

‎tests/policy_engine/expected_results/example-maven-project/example_maven_project_policy_report.json

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{
2+
"component_satisfies_policy": [
3+
[
4+
"1",
5+
"pkg:maven/io.github.behnazh-w.demo/example-maven-app@1.0-SNAPSHOT?type=jar",
6+
"gh_witness_provenance_policy"
7+
]
8+
],
9+
"passed_policies": [
10+
[
11+
"gh_witness_provenance_policy"
12+
]
13+
],
14+
"component_violates_policy": [],
15+
"failed_policies": []
16+
}

‎tests/policy_engine/resources/policies/example-maven-project/policy.dl

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
/* Copyright (c) 2024 - 2024, Oracle and/or its affiliates. All rights reserved. */
2+
/* Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/. */
3+
4+
#include "prelude.dl"
5+
6+
Policy("gh_witness_provenance_policy", component_id, "Policy for github Maven project with witness provenances") :-
7+
check_passed(component_id, "mcn_build_service_1"),
8+
check_passed(component_id, "mcn_build_script_1"),
9+
check_passed(component_id, "mcn_provenance_available_1"),
10+
check_passed(component_id, "mcn_provenance_expectation_1").
11+
12+
apply_policy_to("gh_witness_provenance_policy", component_id) :-
13+
is_repo(
14+
_, // repo_id
15+
"github.com/behnazh-w/example-maven-app", // http URL to the repo but without the "http://"
16+
component_id
17+
).

‎tests/slsa_analyzer/provenance/expectations/cue/resources/valid_expectations/example-maven-project.cue

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
target: "pkg:maven/io.github.behnazh-w.demo/example-maven-app",
3+
predicate: {
4+
attestations: [
5+
{
6+
type: "https://witness.dev/attestations/git/v0.1",
7+
attestation: {
8+
commithash: "34c06e8ae3811885c57f8bd42db61f37ac57eb6c"
9+
},
10+
},
11+
_,
12+
_,
13+
_,
14+
_
15+
]
16+
}
17+
}

‎tests/slsa_analyzer/provenance/resources/valid_provenances/example-maven-project.json

Lines changed: 1 addition & 0 deletions
Large diffs are not rendered by default.

‎tests/vsa/integration/local_witness_example-maven-project/vsa_payload.json

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"_type": "https://in-toto.io/Statement/v1",
3+
"subject": [
4+
{
5+
"uri": "pkg:maven/io.github.behnazh-w.demo/example-maven-app@1.0-SNAPSHOT?type=jar",
6+
"digest": {
7+
"sha256": "19986144a60f3d16d1e8d96bc1807c42bb7c91068ab3018b85033f62c2845921"
8+
}
9+
}
10+
],
11+
"predicateType": "https://slsa.dev/verification_summary/v1",
12+
"predicate": {
13+
"verifier": {
14+
"id": "https://github.com/oracle/macaron",
15+
"version": {
16+
"macaron": "0.9.0"
17+
}
18+
},
19+
"timeVerified": "2024-04-19T00:42:58.916316+00:00",
20+
"resourceUri": "pkg:maven/io.github.behnazh-w.demo/example-maven-app@1.0-SNAPSHOT",
21+
"policy": {
22+
"content": "/* Copyright (c) 2024 - 2024, Oracle and/or its affiliates. All rights reserved. */\n/* Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/. */\n\n#include \"prelude.dl\"\n\nPolicy(\"gh_witness_provenance_policy\", component_id, \"Policy for github Maven project with witness provenances\") :-\n check_passed(component_id, \"mcn_build_service_1\"),\n check_passed(component_id, \"mcn_build_script_1\"),\n check_passed(component_id, \"mcn_provenance_available_1\"),\n check_passed(component_id, \"mcn_provenance_expectation_1\").\n\napply_policy_to(\"gh_witness_provenance_policy\", component_id) :-\n is_repo(\n _, // repo_id\n \"github.com/behnazh-w/example-maven-app\", // http URL to the repo but without the \"http://\"\n component_id\n ).\n"
23+
},
24+
"verificationResult": "PASSED",
25+
"verifiedLevels": []
26+
}
27+
}

0 commit comments

Comments
 (0)