|
| 1 | +#!/bin/sh |
| 2 | +# ******************************************************************************** |
| 3 | +# Copyright (c) 2023 Contributors to the Eclipse Foundation |
| 4 | +# |
| 5 | +# See the NOTICE file(s) with this work for additional |
| 6 | +# information regarding copyright ownership. |
| 7 | +# |
| 8 | +# This program and the accompanying materials are made |
| 9 | +# available under the terms of the Apache Software License 2.0 |
| 10 | +# which is available at https://www.apache.org/licenses/LICENSE-2.0. |
| 11 | +# |
| 12 | +# SPDX-License-Identifier: Apache-2.0 |
| 13 | +# ******************************************************************************** |
| 14 | + |
| 15 | +# This script executes the following SBOM validation mechanisms. |
| 16 | +# - https://github.com/CycloneDX/cyclonedx-cli |
| 17 | +# - ./validateSBOMcontent.sh |
| 18 | + |
| 19 | +JDK_MAJOR_VERSION="" |
| 20 | +SOURCE_TAG="" |
| 21 | +SBOM_LOCATION="" |
| 22 | +ORIGIN="$(pwd)" |
| 23 | +SCRIPT_DIR="$( cd "$( dirname "${0}" )" && pwd )" |
| 24 | +WORKSPACE_DIR="" |
| 25 | +CYCLONEDX_TOOL="" |
| 26 | + |
| 27 | +######################################################################################################################## |
| 28 | +# |
| 29 | +# Parses the three expected arguments passed into this script: |
| 30 | +# - JDK_MAJOR_VERSION: The major version of the JDK whose SBOM this is. |
| 31 | +# - E.g. For JDK17.0.1+35 the major version is 17. |
| 32 | +# - SOURCE_TAG: The tag of the source code build to make the aforementioned JDK. |
| 33 | +# - SBOM_LOCATION: The location of the SBOM to be verified. |
| 34 | +# - This can be a file location or a web URL, but must be an absolute path. |
| 35 | +# |
| 36 | +######################################################################################################################## |
| 37 | +arg_parser() { |
| 38 | + if [ $# -ne 3 ]; then |
| 39 | + echo "ERROR: validateSBOM.sh did not receive 3 arguments." |
| 40 | + echo "Usage: $0 JDK_MAJOR_VERSION SOURCE_TAG SBOM_LOCATION" |
| 41 | + echo "e.g. $0 21 jdk-21+35 /home/jenkins/sbom_file.json" |
| 42 | + exit 1 |
| 43 | + fi |
| 44 | + |
| 45 | + if [ -z "$WORKSPACE" ]; then |
| 46 | + echo "validateSBOM.sh: WARNING: WORKSPACE environment variable not detected." |
| 47 | + echo "validateSBOM.sh: Using ${ORIGIN}/sbom_validation" |
| 48 | + WORKSPACE_DIR="${ORIGIN}/sbom_validation" |
| 49 | + else |
| 50 | + WORKSPACE_DIR="${WORKSPACE}/sbom_validation" |
| 51 | + fi |
| 52 | + |
| 53 | + if [ -d "${WORKSPACE_DIR}" ]; then |
| 54 | + echo "validateSBOM.sh: New temporary workspace already exists in ${WORKSPACE_DIR}" |
| 55 | + echo "Refreshing directory to avoid conflict." |
| 56 | + rm -rf "${WORKSPACE_DIR}" |
| 57 | + fi |
| 58 | + echo "validateSBOM.sh: Setting up workspace directory ${WORKSPACE_DIR}" |
| 59 | + mkdir "${WORKSPACE_DIR}" |
| 60 | + |
| 61 | + cd "${WORKSPACE_DIR}" || exit 1 |
| 62 | + |
| 63 | + JDK_MAJOR_VERSION="$1" |
| 64 | + SOURCE_TAG="$2" |
| 65 | + SBOM_LOCATION="$3" |
| 66 | + |
| 67 | + if ! echo "$JDK_MAJOR_VERSION" | grep -q "^[1-9][0-9]*\$"; then |
| 68 | + echo "ERROR: validateSBOM.sh: first argument must be a positive integer greater than 0." |
| 69 | + exit 1 |
| 70 | + fi |
| 71 | + |
| 72 | + if [ -z "$SOURCE_TAG" ]; then |
| 73 | + echo "ERROR: validateSBOM.sh: second argument must not be empty." |
| 74 | + exit 1 |
| 75 | + fi |
| 76 | + |
| 77 | + TAG_CHECK="" |
| 78 | + if [ "$JDK_MAJOR_VERSION" -eq "8" ]; then |
| 79 | + echo "$SOURCE_TAG" | grep -q -e "^jdk8u[0-9][0-9]*-b[0-9][0-9]*_adopt\$" \ |
| 80 | + -e "^jdk8u[0-9][0-9]*-b[0-9][0-9]*\$" \ |
| 81 | + -e "^jdk8u[0-9][0-9]*-ga\$" \ |
| 82 | + -e "^jdk8u[0-9][0-9]*-dryrun-ga\$" \ |
| 83 | + -e "^jdk8u[0-9][0-9]*-aarch32-[0-9][0-9]*\$" \ |
| 84 | + -e "^jdk8u[0-9][0-9]*-ga-aarch32-[0-9][0-9]*\$" \ |
| 85 | + -e "^jdk8u[0-9][0-9]*-dryrun-ga-aarch32-[0-9][0-9]*\$" |
| 86 | + TAG_CHECK="$?" |
| 87 | + else |
| 88 | + echo "$SOURCE_TAG" | grep -q -e "^jdk-[0-9][0-9\.\+]*_adopt\$" \ |
| 89 | + -e "^jdk-[0-9][0-9\.\+]*\$" \ |
| 90 | + -e "^jdk-[0-9][0-9\.\+]*-dryrun-ga\$" \ |
| 91 | + -e "^jdk-[0-9][0-9\.\+]*-ga\$" |
| 92 | + TAG_CHECK="$?" |
| 93 | + fi |
| 94 | + |
| 95 | + if ! echo "${TAG_CHECK}" | grep -q "0"; then |
| 96 | + echo "WARNING: validateSBOM.sh: SOURCE_TAG does not use a valid upstream tag structure." |
| 97 | + echo "INFO: validateSBOM.sh: Build is presumed to be a personal or dev build." |
| 98 | + echo "INFO: validateSBOM.sh: SCM and SHA checks will be skipped." |
| 99 | + SOURCE_TAG="null" |
| 100 | + fi |
| 101 | + |
| 102 | + if [ -z "$SBOM_LOCATION" ]; then |
| 103 | + echo "ERROR: validateSBOM.sh: third argument must not be empty." |
| 104 | + exit 1 |
| 105 | + fi |
| 106 | + |
| 107 | + # Now we check that the third argument is a valid link. |
| 108 | + if echo "$SBOM_LOCATION" | grep -q "^https.*"; then |
| 109 | + if ! curl -L "$SBOM_LOCATION" -O; then |
| 110 | + echo "ERROR: SBOM_LOCATION could not be downloaded." |
| 111 | + exit 1 |
| 112 | + fi |
| 113 | + SBOM_NAME=${SBOM_LOCATION##*/} |
| 114 | + SBOM_LOCATION="${WORKSPACE_DIR}/${SBOM_NAME}" |
| 115 | + elif [ ! -r "$SBOM_LOCATION" ]; then |
| 116 | + echo "ERROR: SBOM_LOCATION could not be found/accessed: $SBOM_LOCATION" |
| 117 | + exit 1 |
| 118 | + fi |
| 119 | +} |
| 120 | + |
| 121 | +######################################################################################################################## |
| 122 | +# |
| 123 | +# Downloads the cyclonedx tool for the current os/arch. |
| 124 | +# return : cyclonedx cli tool command |
| 125 | +# |
| 126 | +######################################################################################################################## |
| 127 | +download_cyclonedx_tool() { |
| 128 | + cyclonedx_os="" |
| 129 | + cyclonedx_arch="" |
| 130 | + cyclonedx_suffix="" |
| 131 | + cyclonedx_checksum="" |
| 132 | + |
| 133 | + cyclonedx_suffix="" |
| 134 | + |
| 135 | + kernel="$(uname -s)" |
| 136 | + case "${kernel}" in |
| 137 | + Linux*) cyclonedx_os=linux;; |
| 138 | + Darwin*) cyclonedx_os=osx;; |
| 139 | + CYGWIN*) cyclonedx_os=win |
| 140 | + cyclonedx_suffix=".exe";; |
| 141 | + *) cyclonedx_os="unknown";; |
| 142 | + esac |
| 143 | + |
| 144 | + machine="$(uname -m)" |
| 145 | + case "${machine}" in |
| 146 | + x86_64) cyclonedx_arch=x64;; |
| 147 | + aarch64) cyclonedx_arch=arm64;; |
| 148 | + *) cyclonedx_arch="unknown";; |
| 149 | + esac |
| 150 | + |
| 151 | + case "${cyclonedx_os}-${cyclonedx_arch}" in |
| 152 | + linux-x64) cyclonedx_checksum="5e1595542a6367378a3944bbd3008caab3de65d572345361d3b9597b1dbbaaa0";; |
| 153 | + linux-arm64) cyclonedx_checksum="5b4181f6fd4d8fbe54e55c1b3983d9af66ce2910a263814b290cbd5e351e68a4";; |
| 154 | + osx-x64) cyclonedx_checksum="331c2245ef7dadf09fa3d2710a2aaab071ff6bea2ba3e5df8f95a4f3f6e825e9";; |
| 155 | + osx-arm64) cyclonedx_checksum="2d24c331c2ccc5e4061722bd4780c8b295041b2569d130bbe80cf7da95b97171";; |
| 156 | + win-x64) cyclonedx_checksum="bb26bb56293ebe6f08fa63d2bf50653fc6b180174fded975c81ac96ac192a7db";; |
| 157 | + win-arm64) cyclonedx_checksum="35762d3e1979576f474ffc1c5b2273e19c33cdca44e5f1994c3de5d9cd0e9c1d";; |
| 158 | + *) cyclonedx_checksum="";; |
| 159 | + esac |
| 160 | + |
| 161 | + if [ -n "${cyclonedx_checksum}" ]; then |
| 162 | + echo "validateSBOM.sh: Downloading CycloneDX CLI binary ..." |
| 163 | + |
| 164 | + CYCLONEDX_TOOL="cyclonedx-${cyclonedx_os}-${cyclonedx_arch}${cyclonedx_suffix}" |
| 165 | + |
| 166 | + cd "${WORKSPACE_DIR}" || exit 1 |
| 167 | + [ ! -r "${CYCLONEDX_TOOL}" ] && curl -LOsS https://github.com/CycloneDX/cyclonedx-cli/releases/download/v0.27.2/"${CYCLONEDX_TOOL}" |
| 168 | + if [ "$(sha256sum "${CYCLONEDX_TOOL}" | cut -d' ' -f1)" != "${cyclonedx_checksum}" ]; then |
| 169 | + echo "validateSBOM.sh: Error: Cannot verify checksum of CycloneDX CLI binary" |
| 170 | + exit 1 |
| 171 | + else |
| 172 | + echo "validateSBOM.sh: Downloaded CycloneDX CLI binary to '${CYCLONEDX_TOOL}'" |
| 173 | + fi |
| 174 | + chmod 700 "${CYCLONEDX_TOOL}" |
| 175 | + else |
| 176 | + echo "validateSBOM.sh: No CycloneDX CLI SBOM verification tool available for '${kernel}-${machine}'" |
| 177 | + echo "validateSBOM.sh: Skipping CycloneDX SBOM check and proceeding to the next sbom verification step." |
| 178 | + CYCLONEDX_TOOL="" |
| 179 | + fi |
| 180 | +} |
| 181 | + |
| 182 | +######################################################################################################################## |
| 183 | +# |
| 184 | +# Verifies the SBOM using cyclonedx-cli |
| 185 | +# |
| 186 | +######################################################################################################################## |
| 187 | +validate_sbom_cyclonedx() { |
| 188 | + echo "validateSBOM.sh: Running general SBOM validation from https://github.com/CycloneDX/cyclonedx-cli" |
| 189 | + |
| 190 | + # shellcheck disable=SC2010 |
| 191 | + echo "validateSBOM.sh: Running ${CYCLONEDX_TOOL} ..." |
| 192 | + |
| 193 | + echo "Command: \"${WORKSPACE_DIR}/${CYCLONEDX_TOOL}\" validate --input-file \"${SBOM_LOCATION}\" --input-format json" |
| 194 | + if ! "${WORKSPACE_DIR}/${CYCLONEDX_TOOL}" validate --input-file "${SBOM_LOCATION}" --input-format json; then |
| 195 | + echo "validateSBOM.sh: Error: Failed CycloneDX validation check." |
| 196 | + exit 5 |
| 197 | + else |
| 198 | + echo "validateSBOM.sh: Passed CycloneDX validation check." |
| 199 | + fi |
| 200 | +} |
| 201 | + |
| 202 | +######################################################################################################################## |
| 203 | +# |
| 204 | +# Verifies the SBOM using validateSBOMcontent.sh |
| 205 | +# |
| 206 | +######################################################################################################################## |
| 207 | +validate_sbom_content() { |
| 208 | + # shellcheck disable=SC2086 |
| 209 | + echo "validateSBOM.sh: Running validateSBOMcontent.sh" |
| 210 | + |
| 211 | + if sh "${SCRIPT_DIR}/validateSBOMcontent.sh" "$SBOM_LOCATION" "$JDK_MAJOR_VERSION" "$SOURCE_TAG"; then |
| 212 | + echo "validateSBOMcontent.sh: PASSED" |
| 213 | + else |
| 214 | + echo "validateSBOMcontent.sh: ERROR: FAILED with return code $?" |
| 215 | + exit 1 |
| 216 | + fi |
| 217 | + |
| 218 | + echo "SBOM validation complete." |
| 219 | +} |
| 220 | + |
| 221 | +# Script start |
| 222 | +arg_parser "$@" |
| 223 | + |
| 224 | +download_cyclonedx_tool |
| 225 | + |
| 226 | +echo "validateSBOM.sh: SBOM validation start." |
| 227 | + |
| 228 | +if [ -n "${CYCLONEDX_TOOL}" ]; then |
| 229 | + validate_sbom_cyclonedx |
| 230 | +fi |
| 231 | + |
| 232 | +validate_sbom_content |
| 233 | + |
| 234 | +echo "validateSBOM.sh: SBOM validation complete." |
| 235 | + |
| 236 | +cd "${ORIGIN}" || exit 1 |
| 237 | + |
| 238 | +exit 0 # Success |
0 commit comments