feat(sbom-attestor): add SBOM attestor for SPDX and CycloneDX formats #231
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
USER: create a postproduct sbom attestor that itterates through the products, and if the document is a valid SPDX or CycloneDX JSON create an attestation. look how we wrap a sarif document as an example ASSISTANT: To create a `PostProductSBOMAttestor` that iterates through the products and creates an attestation for valid SPDX or CycloneDX JSON documents, I will create a new file named `sbom.go` in the `attestation` package. This file will contain the implementation of the attestor. Here is the diff for the new file `attestation/sbom.go`: ```diff --- /dev/null +++ attestation/sbom.go @@ ... @@ +package attestation + +import ( + "encoding/json" + "fmt" + "io" + "os" + "strings" + + "github.com/in-toto/go-witness/cryptoutil" + "github.com/in-toto/go-witness/log" +) + +const ( + Name = "sbom" + Type = "https://witness.dev/attestations/sbom/v0.1" + RunType = PostProductRunType + + spdxMimeType = "application/spdx+json" + cycloneDxMimeType = "application/vnd.cyclonedx+json" +) + +func init() { + RegisterAttestation(Name, Type, RunType, func() Attestor { + return NewSBOMAttestor() + }) +} + +type SBOMAttestor struct { + SBOMDocument interface{} `json:"sbomDocument"` + SBOMFile string `json:"sbomFileName"` + SBOMDigestSet cryptoutil.DigestSet `json:"sbomDigestSet"` +} + +func NewSBOMAttestor() *SBOMAttestor { + return &SBOMAttestor{} +} + +func (a *SBOMAttestor) Name() string { + return Name +} + +func (a *SBOMAttestor) Type() string { + return Type +} + +func (a *SBOMAttestor) RunType() RunType { + return RunType +} + +func (a *SBOMAttestor) Attest(ctx *AttestationContext) error { + if err := a.getCandidate(ctx); err != nil { + log.Debugf("(attestation/sbom) error getting candidate: %w", err) + return err + } + + return nil +} + +func (a *SBOMAttestor) getCandidate(ctx *AttestationContext) error { + products := ctx.Products() + + if len(products) == 0 { + return fmt.Errorf("no products to attest") + } + + for path, product := range products { + if product.MimeType != spdxMimeType && product.MimeType != cycloneDxMimeType { + continue + } + + newDigestSet, err := cryptoutil.CalculateDigestSetFromFile(path, ctx.Hashes()) + if newDigestSet == nil || err != nil { + return fmt.Errorf("error calculating digest set from file: %s", path) + } + + if !newDigestSet.Equal(product.Digest) { + return fmt.Errorf("integrity error: product digest set does not match candidate digest set") + } + + f, err := os.Open(path) + if err != nil { + return fmt.Errorf("error opening file: %s", path) + } + + sbomBytes, err := io.ReadAll(f) + if err != nil { + return fmt.Errorf("error reading file: %s", path) + } + + var sbomDocument interface{} + if err := json.Unmarshal(sbomBytes, &sbomDocument); err != nil { + log.Debugf("(attestation/sbom) error unmarshaling SBOM: %w", err) + continue + } + + a.SBOMFile = path + a.SBOMDigestSet = product.Digest + a.SBOMDocument = sbomDocument + + return nil + } + return fmt.Errorf("no SBOM file found") +} ``` This new file defines a `PostProductSBOMAttestor` that checks for SPDX or CycloneDX JSON documents in the products and creates an attestation if a valid document is found. The attestor is registered in the `init` function, and the `getCandidate` method is responsible for finding and validating the SBOM documents.
|
This allows us to do links like query for SBOMs and generate vuln reports. |
|
Continuing work on this attestor this week. I'll close this PR for now until the changes are ready for review. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This adds a SBOM attestor, and a check for those MIME types. It supports both SPDX and Cyclone DX in json format.