Skip to content

Commit 0bcdc5a

Browse files
trumanttrumant
committed
chore: integrate against new version of si-tooling
Signed-off-by: Travis Truman <trumant@gmail.com>
1 parent ea46004 commit 0bcdc5a

File tree

13 files changed

+794
-211
lines changed

13 files changed

+794
-211
lines changed

‎evaluation_plans/osps/build_release/steps.go‎

Lines changed: 82 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -174,49 +174,95 @@ func releaseHasUniqueIdentifier(payloadData interface{}, _ map[string]*layer4.Ch
174174
return layer4.Passed, "All releases found have a unique name"
175175
}
176176

177-
func getLinks(data data.Payload) []string {
177+
func getLinksFromProjectDocumentation(data data.Payload) (urls []string) {
178+
doc := data.Insights.Project.Documentation
179+
if doc == nil {
180+
return urls
181+
}
182+
if doc.DetailedGuide != nil {
183+
urls = append(urls, doc.DetailedGuide.String())
184+
}
185+
if doc.CodeOfConduct != nil {
186+
urls = append(urls, doc.CodeOfConduct.String())
187+
}
188+
if doc.QuickstartGuide != nil {
189+
urls = append(urls, doc.QuickstartGuide.String())
190+
}
191+
if doc.ReleaseProcess != nil {
192+
urls = append(urls, doc.ReleaseProcess.String())
193+
}
194+
if doc.SignatureVerification != nil {
195+
urls = append(urls, doc.SignatureVerification.String())
196+
}
197+
return urls
198+
}
199+
200+
func getLinks(data data.Payload) (links []string) {
178201
si := data.Insights
179-
links := []string{
180-
si.Header.URL,
181-
si.Header.ProjectSISource,
182-
si.Project.Homepage,
183-
si.Project.Roadmap,
184-
si.Project.Funding,
185-
si.Project.Documentation.DetailedGuide,
186-
si.Project.Documentation.CodeOfConduct,
187-
si.Project.Documentation.QuickstartGuide,
188-
si.Project.Documentation.ReleaseProcess,
189-
si.Project.Documentation.SignatureVerification,
190-
si.Project.Vulnerability.BugBountyProgram,
191-
si.Project.Vulnerability.SecurityPolicy,
192-
si.Repository.URL,
193-
si.Repository.License.URL,
194-
si.Repository.Security.Assessments.Self.Evidence,
202+
203+
if len(si.Header.URL.String()) > 0 {
204+
links = append(links, si.Header.URL.String())
195205
}
196-
if data.RepositoryMetadata.OrganizationBlogURL() != nil {
197-
links = append(links, *data.RepositoryMetadata.OrganizationBlogURL())
206+
207+
if si.Header.ProjectSISource != nil && len(si.Header.ProjectSISource.String()) > 0 {
208+
links = append(links, si.Header.ProjectSISource.String())
198209
}
199-
for _, repo := range si.Project.Repositories {
200-
links = append(links, repo.URL)
210+
211+
if si.Project != nil {
212+
for _, repo := range si.Project.Repositories {
213+
links = append(links, repo.Url.String())
214+
}
215+
links = append(links, getLinksFromProjectDocumentation(data)...)
216+
if si.Project.HomePage != nil {
217+
links = append(links, si.Project.HomePage.String())
218+
}
219+
if si.Project.Roadmap != nil {
220+
links = append(links, si.Project.Roadmap.String())
221+
}
222+
if si.Project.Funding != nil {
223+
links = append(links, si.Project.Funding.String())
224+
}
225+
226+
if si.Project.VulnerabilityReporting.BugBountyProgram != nil {
227+
links = append(links, si.Project.VulnerabilityReporting.BugBountyProgram.String())
228+
}
229+
if si.Project.VulnerabilityReporting.SecurityPolicy != nil {
230+
links = append(links, si.Project.VulnerabilityReporting.SecurityPolicy.String())
231+
}
201232
}
233+
if si.Repository != nil {
234+
if len(si.Repository.Url.String()) > 0 {
235+
links = append(links, si.Repository.Url.String())
236+
}
237+
if len(si.Repository.License.Url.String()) > 0 {
238+
links = append(links, si.Repository.License.Url.String())
239+
}
202240

203-
for _, repo := range si.Repository.Security.Assessments.ThirdParty {
204-
links = append(links, repo.Evidence)
241+
for _, tool := range si.Repository.SecurityPosture.Tools {
242+
links = append(links, tool.Results.Adhoc.Location.String())
243+
links = append(links, tool.Results.CI.Location.String())
244+
links = append(links, tool.Results.Release.Location.String())
245+
}
246+
for _, repo := range si.Repository.SecurityPosture.Assessments.ThirdPartyAssessment {
247+
links = append(links, repo.Evidence.String())
248+
}
249+
if si.Repository.SecurityPosture.Assessments.Self.Evidence != nil {
250+
links = append(links, si.Repository.SecurityPosture.Assessments.Self.Evidence.String())
251+
}
205252
}
206253

207-
for _, tool := range si.Repository.Security.Tools {
208-
links = append(links, tool.Results.Adhoc.Location)
209-
links = append(links, tool.Results.CI.Location)
210-
links = append(links, tool.Results.Release.Location)
254+
if data.RepositoryMetadata != nil && data.RepositoryMetadata.OrganizationBlogURL() != nil {
255+
links = append(links, *data.RepositoryMetadata.OrganizationBlogURL())
211256
}
257+
212258
return links
213259
}
214260

215261
func insecureURI(uri string) bool {
216-
if !strings.HasPrefix(uri, "https://") ||
217-
!strings.HasPrefix(uri, "ssh:") ||
218-
!strings.HasPrefix(uri, "git:") ||
219-
!strings.HasPrefix(uri, "git@") {
262+
if strings.HasPrefix(uri, "https://") ||
263+
strings.HasPrefix(uri, "ssh:") ||
264+
strings.HasPrefix(uri, "git:") ||
265+
strings.HasPrefix(uri, "git@") {
220266
return false
221267
}
222268
return true
@@ -260,7 +306,7 @@ func insightsHasSlsaAttestation(payloadData interface{}, _ map[string]*layer4.Ch
260306
return layer4.Unknown, message
261307
}
262308

263-
attestations := data.Insights.Repository.Release.Attestations
309+
attestations := data.Insights.Repository.ReleaseDetails.Attestations
264310

265311
for _, attestation := range attestations {
266312
if attestation.PredicateURI == "https://slsa.dev/provenance/v1" {
@@ -275,17 +321,15 @@ func distributionPointsUseHTTPS(payloadData interface{}, _ map[string]*layer4.Ch
275321
if message != "" {
276322
return layer4.Unknown, message
277323
}
278-
279-
distributionPoints := data.Insights.Repository.Release.DistributionPoints
280-
281-
if len(distributionPoints) == 0 {
324+
if data.Insights.Repository.ReleaseDetails == nil || (data.Insights.Repository.ReleaseDetails != nil && len(data.Insights.Repository.ReleaseDetails.DistributionPoints) == 0) {
282325
return layer4.NotApplicable, "No official distribution points found in Security Insights data"
283326
}
327+
distributionPoints := data.Insights.Repository.ReleaseDetails.DistributionPoints
284328

285329
var badURIs []string
286330
for _, point := range distributionPoints {
287-
if insecureURI(point.URI) {
288-
badURIs = append(badURIs, point.URI)
331+
if insecureURI(point.Uri) {
332+
badURIs = append(badURIs, point.Uri)
289333
}
290334
}
291335
if len(badURIs) > 0 {

‎evaluation_plans/osps/build_release/steps_test.go‎

Lines changed: 46 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,13 @@ import (
66
"slices"
77
"testing"
88

9+
"github.com/ossf/si-tooling/v2/si"
10+
"github.com/revanite-io/pvtr-github-repo/data"
911
"github.com/rhysd/actionlint"
1012
"github.com/stretchr/testify/assert"
1113
)
1214

13-
14-
var goodWorkflowFile =
15-
`name: OSPS Baseline Scan
15+
var goodWorkflowFile = `name: OSPS Baseline Scan
1616
1717
on: [workflow_dispatch]
1818
@@ -38,9 +38,7 @@ jobs:
3838
-v ${{ github.workspace }}/docker_output:/evaluation_results \
3939
eddieknight/pvtr-github-repo:latest`
4040

41-
42-
var badWorkflowFile =
43-
`name: OSPS Baseline Scan
41+
var badWorkflowFile = `name: OSPS Baseline Scan
4442
4543
on: [workflow_dispatch]
4644
@@ -66,25 +64,23 @@ jobs:
6664
-v ${{ github.workspace }}/docker_output:/evaluation_results \
6765
eddieknight/pvtr-github-repo:latest`
6866

69-
7067
type testingData struct {
71-
expectedResult bool
72-
workflowFile string
68+
expectedResult bool
69+
workflowFile string
7370
assertionMessage string
7471
}
7572

73+
func TestCicdSanitizedInputParameters(t *testing.T) {
7674

77-
func TestCicdSanitizedInputParameters (t * testing.T) {
78-
79-
testData := []testingData {
75+
testData := []testingData{
8076
{
81-
expectedResult: false,
82-
workflowFile: badWorkflowFile,
77+
expectedResult: false,
78+
workflowFile: badWorkflowFile,
8379
assertionMessage: "Untrusted input not detected",
8480
},
8581
{
86-
expectedResult: true,
87-
workflowFile: goodWorkflowFile,
82+
expectedResult: true,
83+
workflowFile: goodWorkflowFile,
8884
assertionMessage: "Untrusted input detected where it should not have been",
8985
},
9086
}
@@ -100,11 +96,9 @@ func TestCicdSanitizedInputParameters (t * testing.T) {
10096
}
10197
}
10298

103-
10499
func TestVariableExtraction(t *testing.T) {
105100

106-
var testScript =
107-
`echo ${{github.event.issue.title }}
101+
var testScript = `echo ${{github.event.issue.title }}
108102
if ${{ github.event.commits.arbitrary.data.message}} -ne 0
109103
then
110104
echo "Checkout report image" ${{ githubnodotevent.commits.arbitrary.data.message}}
@@ -115,9 +109,8 @@ func TestVariableExtraction(t *testing.T) {
115109

116110
assert.Equal(t, slices.Contains(varNames, "github.event.issue.title"), true, "Variable extraction failed")
117111
assert.Equal(t, slices.Contains(varNames, "github.event.commits.arbitrary.data.message"), true, "Variable extraction failed")
118-
119-
}
120112

113+
}
121114

122115
func TestMultipleVariables(t *testing.T) {
123116

@@ -129,17 +122,45 @@ func TestMultipleVariables(t *testing.T) {
129122

130123
}
131124

132-
133-
func TestRegex ( t * testing.T ) {
125+
func TestRegex(t *testing.T) {
134126

135127
expression, err := regexp.Compile(regex)
136128
if err != nil {
137129
t.Errorf("Error compiling regex: %v", err)
138130
return
139131
}
140132

141-
assert.Equal(t, expression.Match([]byte("github.event.issue.title")), true, "regex match failed" )
142-
assert.Equal(t, expression.Match([]byte("github.event.commits.arbitrary.data.message")), true, "regex match failed" )
133+
assert.Equal(t, expression.Match([]byte("github.event.issue.title")), true, "regex match failed")
134+
assert.Equal(t, expression.Match([]byte("github.event.commits.arbitrary.data.message")), true, "regex match failed")
143135
}
144136

137+
func TestGetLinks(t *testing.T) {
138+
payload := data.Payload{
139+
RestData: &data.RestData{
140+
Insights: si.SecurityInsights{
141+
Header: si.Header{},
142+
Repository: &si.Repository{},
143+
},
144+
},
145+
}
146+
links := getLinks(payload)
147+
assert.Equal(t, len(links), 0, "getLinks should return an empty slice when no links are present")
148+
}
145149

150+
func TestInsecureURI(t *testing.T) {
151+
testData := []struct {
152+
input string
153+
expected bool
154+
}{
155+
{"http://example.com", true},
156+
{"https://example.com", false},
157+
{"ftp://example.com", true},
158+
{"mailto:", true},
159+
}
160+
for _, data := range testData {
161+
t.Run(data.input, func(t *testing.T) {
162+
result := insecureURI(data.input)
163+
assert.Equal(t, result, data.expected, fmt.Sprintf("Expected %v for input %s", data.expected, data.input))
164+
})
165+
}
166+
}

‎evaluation_plans/osps/docs/evaluations.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,7 @@ func OSPS_DO_06() (evaluation *layer4.ControlEvaluation) {
147147
[]layer4.AssessmentStep{
148148
reusable_steps.HasMadeReleases,
149149
reusable_steps.HasSecurityInsightsFile,
150-
hasDependencyManagementPolicy,
150+
reusable_steps.HasDependencyManagementPolicy,
151151
},
152152
)
153153

‎evaluation_plans/osps/docs/steps.go‎

Lines changed: 5 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,8 @@ func hasUserGuides(payloadData interface{}, _ map[string]*layer4.Change) (result
2525
if message != "" {
2626
return layer4.Unknown, message
2727
}
28-
29-
if data.Insights.Project.Documentation.DetailedGuide == "" {
28+
doc := data.Insights.Project.Documentation
29+
if doc == nil || doc.DetailedGuide == nil || len(doc.DetailedGuide.String()) == 0 {
3030
return layer4.Failed, "User guide was NOT specified in Security Insights data"
3131
}
3232

@@ -39,7 +39,7 @@ func acceptsVulnReports(payloadData interface{}, _ map[string]*layer4.Change) (r
3939
return layer4.Unknown, message
4040
}
4141

42-
if data.Insights.Project.Vulnerability.ReportsAccepted {
42+
if data.Insights.Project.VulnerabilityReporting.ReportsAccepted {
4343
return layer4.Passed, "Repository accepts vulnerability reports"
4444
}
4545

@@ -51,23 +51,10 @@ func hasSignatureVerificationGuide(payloadData interface{}, _ map[string]*layer4
5151
if message != "" {
5252
return layer4.Unknown, message
5353
}
54-
55-
if data.Insights.Project.Documentation.SignatureVerification == "" {
54+
doc := data.Insights.Project.Documentation
55+
if doc == nil || doc.SignatureVerification == nil || len(doc.SignatureVerification.String()) == 0 {
5656
return layer4.Failed, "Signature verification guide was NOT specified in Security Insights data"
5757
}
5858

5959
return layer4.Passed, "Signature verification guide was specified in Security Insights data"
6060
}
61-
62-
func hasDependencyManagementPolicy(payloadData interface{}, _ map[string]*layer4.Change) (result layer4.Result, message string) {
63-
data, message := reusable_steps.VerifyPayload(payloadData)
64-
if message != "" {
65-
return layer4.Unknown, message
66-
}
67-
68-
if data.Insights.Repository.Documentation.DependencyManagement == "" {
69-
return layer4.Failed, "Dependency management policy was NOT specified in Security Insights data"
70-
}
71-
72-
return layer4.Passed, "Dependency management policy was specified in Security Insights data"
73-
}

0 commit comments

Comments
 (0)