Add ruletype OSPS-LE- 04 #296

teodor-yanev · 2025-01-28T19:33:04Z

Closes https://github.com/stacklok/minder-stories/issues/199

This PR should be merged only after the external license processor is up and running. The URL in the POST used here should then be updated.
For visibility, this is the lib that will do the processing: https://github.com/CycloneDX/license-scanner

evankanderson · 2025-01-28T19:35:52Z

security-baseline/rule-types/github/osps-le-04.yaml

+        violations[{"msg": msg}] {
+          not license_file
+          msg := "No license file found in release assets"
+        }


I think it's fine for there to be no explicit license in the assets; in that case, we'd expect the source code license to apply. (This is the common case.)

Ok, in that case, I've added a line to exit gracefully if no such is found.

evankanderson · 2025-01-28T19:44:34Z

security-baseline/rule-types/github/osps-le-04.yaml

+        license_file := asset {
+          some asset in input.ingested
+          is_license_file(asset.name)
+        }


Since we don't need to worry about the not license_file case, it seems like we could simplify to put this into the violations[{"msg":msg}] block.

evankanderson · 2025-01-28T20:37:10Z

security-baseline/rule-types/github/osps-le-04.yaml

+              "Accept": "application/json",
+              "Content-Type": "application/octet-stream"
+            },
+            "raw_body": license_resp


Doesn't this need to be the .body or some other attribute of the http response?

For when we have "HTTP message body to include in request. The value WILL NOT be serialized. Use this for non-JSON messages.", "raw_body": https://www.openpolicyagent.org/docs/latest/policy-reference/#http

I meant that license_resp is an object, not a string. I think you want:

Suggested change

"raw_body": license_resp

"raw_body": license_resp.raw_body

Got it! Done, thanks.

security-baseline/rule-types/github/osps-le-04.yaml

evankanderson

I'm assuming you've tested this in staging?

evankanderson · 2025-01-30T14:57:28Z

security-baseline/rule-types/github/osps-le-04.yaml

+          # We have this servcice processing on the other side:
+          # https://github.com/CycloneDX/license-scanner


Suggested change

# We have this servcice processing on the other side:

# https://github.com/CycloneDX/license-scanner

# We have a service for this detection:

# https://github.com/evankanderson/spdx-detector

evankanderson · 2025-01-30T15:00:37Z

security-baseline/rule-types/github/osps-le-04.yaml

+          # Exit without violation if no license file found
+          license_file != {}


I don't think you need this; since license_file is some entry in input.ingested which has a name property which passes is_license_file, you know it's not an empty object (it must contain a name property).

evankanderson · 2025-01-30T15:02:10Z

security-baseline/rule-types/github/osps-le-04.yaml

+        license_pattern := "^license(\\..*)?$"
+        is_license_file(name) if {
+          regex.match(license_pattern, lower(name))
+        }
+
+        violations[{"msg": msg}] {
+          license_file := asset {
+            some asset in input.ingested
+            is_license_file(asset.name)
+          }


This seems simpler as:

Suggested change

license_pattern := "^license(\\..*)?$"

is_license_file(name) if {

regex.match(license_pattern, lower(name))

}

violations[{"msg": msg}] {

license_file := asset {

some asset in input.ingested

is_license_file(asset.name)

}

violations[{"msg": msg}] {

license_file := asset {

some asset in input.ingested

startswith(lower(name), "license")

}

teodor-yanev · 2025-01-31T22:14:28Z

Testing:

./bin/minder profile status list -n my-test-profile --detailed
WARNING: Running against a test environment (staging.stacklok.dev) and may not be stable
+--------------------------------------+-----------------+---------+----------------------+
|                  ID                  |      NAME       | STATUS  |     LAST UPDATED     |
+--------------------------------------+-----------------+---------+----------------------+
| ecdf0b42-74be-46b8-b238-d56b3f12312d | my-test-profile | Failure | 2025-01-31T22:10:20Z |
+--------------------------------------+-----------------+---------+----------------------+
+--------------+----------------------------------+---------+-------------+--------------------------------------+
|  RULE NAME   |              ENTITY              | STATUS  | REMEDIATION |             ENTITY INFO              |
+--------------+----------------------------------+---------+-------------+--------------------------------------+
| osps-le-04   | teodor-yanev/demo-repo-go/v1.0.0 | Success | Skipped     | entity_id:                           |
| [osps-le-04] | [release]                        |         |             | 10110bd7-b0a7-452f-aca6-862837a8eab1 |
|              |                                  |         |             | entity_type: release name:           |
|              |                                  |         |             | teodor-yanev/demo-repo-go/v1.0.0     |
|              |                                  |         |             | provider: github                     |
+              +----------------------------------+---------+-------------+--------------------------------------+
|              | teodor-yanev/demo-repo-go/v1.0.1 | Failure | Skipped     | entity_id:                           |
|              | [release]                        |         |             | d452f035-07e7-4849-b08e-11d0d06f6324 |
|              |                                  |         |             | entity_type: release name:           |
|              |                                  |         |             | teodor-yanev/demo-repo-go/v1.0.1     |
|              |                                  |         |             | provider: github                     |
+              +----------------------------------+---------+-------------+--------------------------------------+
|              | teodor-yanev/demo-repo-go/v1.0.2 | Failure | Skipped     | entity_id:                           |
|              | [release]                        |         |             | 6c26e2b7-6354-44fb-b08f-b9853f16d5dc |
|              |                                  |         |             | entity_type: release name:           |
|              |                                  |         |             | teodor-yanev/demo-repo-go/v1.0.2     |
|              |                                  |         |             | provider: github                     |
+              +----------------------------------+---------+-------------+--------------------------------------+
|              | teodor-yanev/demo-repo-go/v1.0.3 | Failure | Skipped     | entity_id:                           |
|              | [release]                        |         |             | 3d874a79-0be4-41d1-8d79-fe9695ebb066 |
|              |                                  |         |             | entity_type: release name:           |
|              |                                  |         |             | teodor-yanev/demo-repo-go/v1.0.3     |
|              |                                  |         |             | provider: github                     |
+              +----------------------------------+---------+-------------+--------------------------------------+
|              | teodor-yanev/demo-repo-go/v1.0.4 | Success | Skipped     | entity_id:                           |
|              | [release]                        |         |             | 15e9cdc6-5982-4afb-b238-c83d8e608730 |
|              |                                  |         |             | entity_type: release name:           |
|              |                                  |         |             | teodor-yanev/demo-repo-go/v1.0.4     |
|              |                                  |         |             | provider: github                     |
+--------------+----------------------------------+---------+-------------+--------------------------------------+

evankanderson · 2025-01-31T22:17:54Z

security-baseline/rule-types/github/osps-le-04.yaml

+                    "Accept": "application/octet-stream"
+                },
+                "enable_redirect": true,
+                "raise_error": true


This is fine, but it's also the default for http.send.

teodor-yanev added 3 commits January 28, 2025 21:12

add: ruletype osps-le-04

b3e1a45

Merge branch 'main' into add-ruletype-osps-le-04

5055ace

fix: only continue if license file is found

ffb4dfa

teodor-yanev self-assigned this Jan 28, 2025

fix: forgot to add the data_source

911b735

evankanderson reviewed Jan 28, 2025

View reviewed changes

fix: url and core logic around the existence of a license

6debaa7

teodor-yanev marked this pull request as ready for review January 29, 2025 13:24

teodor-yanev requested a review from a team as a code owner January 29, 2025 13:24

teodor-yanev requested a review from evankanderson January 29, 2025 15:27

evankanderson reviewed Jan 29, 2025

View reviewed changes

security-baseline/rule-types/github/osps-le-04.yaml Outdated Show resolved Hide resolved

fix: address raw_body + remove redundant check

89a4c7d

evankanderson approved these changes Jan 30, 2025

View reviewed changes

evankanderson previously approved these changes Jan 30, 2025

View reviewed changes

update: update comment + slight refactoring

5049259

teodor-yanev dismissed evankanderson’s stale review via 5049259 January 31, 2025 12:15

teodor-yanev added 2 commits January 31, 2025 16:06

fix: more rego syntax after local testing

8d5ebfa

fix: update rule after extensive testing

1a69da8

evankanderson approved these changes Jan 31, 2025

View reviewed changes

teodor-yanev merged commit 614ec51 into main Jan 31, 2025
6 checks passed

teodor-yanev deleted the add-ruletype-osps-le-04 branch January 31, 2025 22:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add ruletype OSPS-LE- 04 #296

Add ruletype OSPS-LE- 04 #296

teodor-yanev commented Jan 28, 2025

evankanderson Jan 28, 2025

teodor-yanev Jan 29, 2025

evankanderson Jan 28, 2025

evankanderson Jan 28, 2025

teodor-yanev Jan 29, 2025 •

edited

Loading

evankanderson Jan 29, 2025

teodor-yanev Jan 30, 2025

evankanderson left a comment

evankanderson Jan 30, 2025

evankanderson Jan 30, 2025

evankanderson Jan 30, 2025

teodor-yanev commented Jan 31, 2025

evankanderson Jan 31, 2025

		# We have this servcice processing on the other side:
		# https://github.com/CycloneDX/license-scanner

		# Exit without violation if no license file found
		license_file != {}

Add ruletype OSPS-LE- 04 #296

Add ruletype OSPS-LE- 04 #296

Conversation

teodor-yanev commented Jan 28, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

teodor-yanev Jan 29, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

evankanderson left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

teodor-yanev commented Jan 31, 2025

Choose a reason for hiding this comment

teodor-yanev Jan 29, 2025 •

edited

Loading