Skip to content

Commit 7d3c63e

Browse files
mabdollahpour-olbehnazh-w
mabdollahpour-ol
and
behnazh-w
authored
chore: address comments from PR#873 (#913)
This PR aims to address the remaining comments from PR#873. - Generate API documents for modified and new code. - Make the repository verification check generic. - Fix repo verification fact parameter docs. Signed-off-by: Mohammad Abdollahpour <[email protected]> Co-authored-by: Behnaz Hassanshahi <[email protected]>
1 parent 3854a85 commit 7d3c63e

File tree

12 files changed

+115
-56
lines changed

12 files changed

+115
-56
lines changed

‎docs/source/index.rst‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,9 @@ the requirements that are currently supported by Macaron.
8989
* - ``mcn_provenance_derived_commit_1``
9090
- **Provenance derived commit** - Check if the analysis target's commit matches the commit in the provenance.
9191
- If there is no commit, this check will fail.
92+
* - ``mcn_scm_authenticity_check_1``
93+
- **Source repo authenticity** - Check whether the claims of a source code repository made by a package can be corroborated.
94+
- If the source code repository contains conflicting evidence regarding its claim of the source code repository, this check will fail. If no source code repository or corroborating evidence is found, or if the build system is unsupported, the check will return ``UNKNOWN`` as the result. This check currently supports only Maven artifacts.
9295

9396
****************************************************************************************
9497
Macaron checks that report integrity issues but do not map to SLSA requirements directly

‎docs/source/pages/developers_guide/apidoc/macaron.parsers.rst‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,3 +40,11 @@ macaron.parsers.github\_workflow\_model module
4040
:members:
4141
:undoc-members:
4242
:show-inheritance:
43+
44+
macaron.parsers.pomparser module
45+
--------------------------------
46+
47+
.. automodule:: macaron.parsers.pomparser
48+
:members:
49+
:undoc-members:
50+
:show-inheritance:

‎docs/source/pages/developers_guide/apidoc/macaron.repo_verifier.rst‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
macaron.repo\_verifier package
2+
==============================
3+
4+
.. automodule:: macaron.repo_verifier
5+
:members:
6+
:undoc-members:
7+
:show-inheritance:
8+
9+
Submodules
10+
----------
11+
12+
macaron.repo\_verifier.repo\_verifier module
13+
--------------------------------------------
14+
15+
.. automodule:: macaron.repo_verifier.repo_verifier
16+
:members:
17+
:undoc-members:
18+
:show-inheritance:
19+
20+
macaron.repo\_verifier.repo\_verifier\_base module
21+
--------------------------------------------------
22+
23+
.. automodule:: macaron.repo_verifier.repo_verifier_base
24+
:members:
25+
:undoc-members:
26+
:show-inheritance:
27+
28+
macaron.repo\_verifier.repo\_verifier\_gradle module
29+
----------------------------------------------------
30+
31+
.. automodule:: macaron.repo_verifier.repo_verifier_gradle
32+
:members:
33+
:undoc-members:
34+
:show-inheritance:
35+
36+
macaron.repo\_verifier.repo\_verifier\_maven module
37+
---------------------------------------------------
38+
39+
.. automodule:: macaron.repo_verifier.repo_verifier_maven
40+
:members:
41+
:undoc-members:
42+
:show-inheritance:

‎docs/source/pages/developers_guide/apidoc/macaron.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ Subpackages
2121
macaron.parsers
2222
macaron.policy_engine
2323
macaron.repo_finder
24+
macaron.repo_verifier
2425
macaron.slsa_analyzer
2526
macaron.vsa
2627

‎docs/source/pages/developers_guide/apidoc/macaron.slsa_analyzer.checks.rst‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -121,6 +121,14 @@ macaron.slsa\_analyzer.checks.provenance\_witness\_l1\_check module
121121
:undoc-members:
122122
:show-inheritance:
123123

124+
macaron.slsa\_analyzer.checks.scm\_authenticity\_check module
125+
-------------------------------------------------------------
126+
127+
.. automodule:: macaron.slsa_analyzer.checks.scm_authenticity_check
128+
:members:
129+
:undoc-members:
130+
:show-inheritance:
131+
124132
macaron.slsa\_analyzer.checks.trusted\_builder\_l3\_check module
125133
----------------------------------------------------------------
126134

‎src/macaron/slsa_analyzer/checks/maven_repo_verification_check.py‎ renamed to ‎src/macaron/slsa_analyzer/checks/scm_authenticity_check.py‎

Lines changed: 40 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,10 @@
11
# Copyright (c) 2024 - 2024, Oracle and/or its affiliates. All rights reserved.
22
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/.
33

4-
"""A check to determine whether the source repository of a maven package can be independently verified."""
4+
"""A check to determine whether the source repository of a package can be independently verified."""
55

66
import logging
77

8-
from packageurl import PackageURL
98
from sqlalchemy import ForeignKey, Integer, String
109
from sqlalchemy.orm import Mapped, mapped_column
1110

@@ -14,59 +13,58 @@
1413
from macaron.repo_verifier.repo_verifier_base import RepositoryVerificationStatus
1514
from macaron.slsa_analyzer.analyze_context import AnalyzeContext
1615
from macaron.slsa_analyzer.checks.base_check import BaseCheck
17-
from macaron.slsa_analyzer.checks.check_result import CheckResultData, CheckResultType, Confidence
16+
from macaron.slsa_analyzer.checks.check_result import CheckResultData, CheckResultType, Confidence, JustificationType
1817
from macaron.slsa_analyzer.registry import registry
1918

2019
logger: logging.Logger = logging.getLogger(__name__)
2120

2221

23-
class MavenRepoVerificationFacts(CheckFacts):
24-
"""The ORM mapping for justifications in maven source repo check."""
22+
class ScmAuthenticityFacts(CheckFacts):
23+
"""The ORM mapping for justifications in scm authenticity check."""
2524

26-
__tablename__ = "_maven_repo_verification_check"
25+
__tablename__ = "_scm_authenticity_check"
2726

2827
#: The primary key.
2928
id: Mapped[int] = mapped_column(ForeignKey("_check_facts.id"), primary_key=True) # noqa: A003
3029

31-
group: Mapped[str] = mapped_column(String, nullable=False)
32-
artifact: Mapped[str] = mapped_column(String, nullable=False)
33-
version: Mapped[str] = mapped_column(String, nullable=False)
30+
#: Repository link identified by Macaron's repo finder.
31+
repo_link: Mapped[str] = mapped_column(String, nullable=True, info={"justification": JustificationType.HREF})
3432

35-
# Repository link identified by Macaron's repo finder.
36-
repo_link: Mapped[str] = mapped_column(String, nullable=True)
33+
#: Number of stars on the repository.
34+
stars_count: Mapped[int | None] = mapped_column(
35+
Integer, nullable=True, info={"justification": JustificationType.TEXT}
36+
)
3737

38-
# Repository link identified by deps.dev.
39-
deps_dev_repo_link: Mapped[str | None] = mapped_column(String, nullable=True)
38+
#: Number of forks on the repository.
39+
fork_count: Mapped[int | None] = mapped_column(
40+
Integer, nullable=True, info={"justification": JustificationType.TEXT}
41+
)
4042

41-
# Number of stars on the repository identified by deps.dev.
42-
deps_dev_stars_count: Mapped[int | None] = mapped_column(Integer, nullable=True)
43+
#: The status of repo verification: passed, failed, or unknown.
44+
status: Mapped[str] = mapped_column(String, nullable=False, info={"justification": JustificationType.TEXT})
4345

44-
# Number of forks on the repository identified by deps.dev.
45-
deps_dev_fork_count: Mapped[int | None] = mapped_column(Integer, nullable=True)
46+
#: The reason for the status.
47+
reason: Mapped[str] = mapped_column(String, nullable=False, info={"justification": JustificationType.TEXT})
4648

47-
# The status of the check: passed, failed, or unknown.
48-
status: Mapped[str] = mapped_column(String, nullable=False)
49-
50-
# The reason for the status.
51-
reason: Mapped[str] = mapped_column(String, nullable=False)
52-
53-
# The build tool used to build the package.
54-
build_tool: Mapped[str] = mapped_column(String, nullable=False)
49+
#: The build tool used to build the package.
50+
build_tool: Mapped[str] = mapped_column(String, nullable=False, info={"justification": JustificationType.TEXT})
5551

5652
__mapper_args__ = {
57-
"polymorphic_identity": "_maven_repo_verification_check",
53+
"polymorphic_identity": __tablename__,
5854
}
5955

6056

61-
class MavenRepoVerificationCheck(BaseCheck):
62-
"""Check whether the claims of a source repository provenance made by a maven package can be independently verified."""
57+
class ScmAuthenticityCheck(BaseCheck):
58+
"""Check whether the claims of a source repository provenance made by a package can be corroborated."""
6359

6460
def __init__(self) -> None:
6561
"""Initialize a check instance."""
66-
check_id = "mcn_maven_repo_verification_1"
62+
check_id = "mcn_scm_authenticity_1"
6763
description = (
6864
"Check whether the claims of a source repository provenance"
69-
" made by a maven package can be independently verified."
65+
" made by a package can be corroborated."
66+
" At this moment, this check only supports Maven packages"
67+
" and returns UNKNOWN for others."
7068
)
7169

7270
super().__init__(
@@ -87,15 +85,18 @@ def run_check(self, ctx: AnalyzeContext) -> CheckResultData:
8785
CheckResultData
8886
The result of the check.
8987
"""
88+
# Only support Maven at the moment.
89+
# TODO: Add support for other systems.
9090
if ctx.component.type != "maven":
9191
return CheckResultData(result_tables=[], result_type=CheckResultType.UNKNOWN)
9292

93-
deps_dev_repo_finder = DepsDevRepoFinder()
94-
deps_dev_repo_link = deps_dev_repo_finder.find_repo(PackageURL.from_string(ctx.component.purl))
95-
deps_dev_repo_info = deps_dev_repo_finder.get_project_info(deps_dev_repo_link)
96-
9793
stars_count: int | None = None
9894
fork_count: int | None = None
95+
deps_dev_repo_info: dict | None = None
96+
97+
repo_link = ctx.component.repository.remote_path if ctx.component.repository else None
98+
if repo_link:
99+
deps_dev_repo_info = DepsDevRepoFinder.get_project_info(repo_link)
99100

100101
if deps_dev_repo_info:
101102
stars_count = deps_dev_repo_info.get("starsCount")
@@ -105,18 +106,14 @@ def run_check(self, ctx: AnalyzeContext) -> CheckResultData:
105106
result_tables: list[CheckFacts] = []
106107
for verification_result in ctx.dynamic_data.get("repo_verification", []):
107108
result_tables.append(
108-
MavenRepoVerificationFacts(
109-
group=ctx.component.namespace,
110-
artifact=ctx.component.name,
111-
version=ctx.component.version,
112-
repo_link=ctx.component.repository.remote_path if ctx.component.repository else None,
109+
ScmAuthenticityFacts(
110+
repo_link=repo_link,
113111
reason=verification_result.reason,
114112
status=verification_result.status.value,
115113
build_tool=verification_result.build_tool.name,
116114
confidence=Confidence.MEDIUM,
117-
deps_dev_repo_link=deps_dev_repo_link,
118-
deps_dev_stars_count=stars_count,
119-
deps_dev_fork_count=fork_count,
115+
stars_count=stars_count,
116+
fork_count=fork_count,
120117
)
121118
)
122119

@@ -129,4 +126,4 @@ def run_check(self, ctx: AnalyzeContext) -> CheckResultData:
129126
return CheckResultData(result_tables=result_tables, result_type=result_type)
130127

131128

132-
registry.register(MavenRepoVerificationCheck())
129+
registry.register(ScmAuthenticityCheck())

‎tests/integration/cases/maven_repo_verification/config.ini‎ renamed to ‎tests/integration/cases/scm_authenticity/config.ini‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,4 @@
33

44
[analysis.checks]
55
exclude =
6-
include = mcn_maven_repo_verification_1
6+
include = mcn_scm_authenticity_1

‎tests/integration/cases/maven_repo_verification/policy_fail_1.dl‎ renamed to ‎tests/integration/cases/scm_authenticity/policy_fail_1.dl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
#include "prelude.dl"
55

66
Policy("test_policy", component_id, "") :-
7-
check_failed(component_id, "mcn_maven_repo_verification_1").
7+
check_failed(component_id, "mcn_scm_authenticity_1").
88

99
apply_policy_to("test_policy", component_id) :-
1010
is_component(component_id, "pkg:maven/com.alibaba.ververica/[email protected]").

‎tests/integration/cases/maven_repo_verification/policy_pass_1.dl‎ renamed to ‎tests/integration/cases/scm_authenticity/policy_pass_1.dl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
#include "prelude.dl"
55

66
Policy("test_policy", component_id, "") :-
7-
check_passed(component_id, "mcn_maven_repo_verification_1").
7+
check_passed(component_id, "mcn_scm_authenticity_1").
88

99
apply_policy_to("test_policy", component_id) :-
1010
is_component(component_id, "pkg:maven/org.antlr/[email protected]").

‎tests/integration/cases/maven_repo_verification/policy_pass_2.dl‎ renamed to ‎tests/integration/cases/scm_authenticity/policy_pass_2.dl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
#include "prelude.dl"
55

66
Policy("test_policy", component_id, "") :-
7-
check_passed(component_id, "mcn_maven_repo_verification_1").
7+
check_passed(component_id, "mcn_scm_authenticity_1").
88

99
apply_policy_to("test_policy", component_id) :-
1010
is_component(component_id, "pkg:maven/org.neo4j/[email protected]").

0 commit comments

Comments
 (0)