Skip to content

Commit fbfbd09

Browse files
trumanttrumant
committed
chore: integrate against new version of si-tooling
Signed-off-by: Travis Truman <[email protected]>
1 parent ea46004 commit fbfbd09

File tree

9 files changed

+107
-130
lines changed

9 files changed

+107
-130
lines changed

‎evaluation_plans/osps/build_release/steps.go‎

Lines changed: 27 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -177,37 +177,37 @@ func releaseHasUniqueIdentifier(payloadData interface{}, _ map[string]*layer4.Ch
177177
func getLinks(data data.Payload) []string {
178178
si := data.Insights
179179
links := []string{
180-
si.Header.URL,
181-
si.Header.ProjectSISource,
182-
si.Project.Homepage,
183-
si.Project.Roadmap,
184-
si.Project.Funding,
185-
si.Project.Documentation.DetailedGuide,
186-
si.Project.Documentation.CodeOfConduct,
187-
si.Project.Documentation.QuickstartGuide,
188-
si.Project.Documentation.ReleaseProcess,
189-
si.Project.Documentation.SignatureVerification,
190-
si.Project.Vulnerability.BugBountyProgram,
191-
si.Project.Vulnerability.SecurityPolicy,
192-
si.Repository.URL,
193-
si.Repository.License.URL,
194-
si.Repository.Security.Assessments.Self.Evidence,
180+
si.Header.URL.String(),
181+
si.Header.ProjectSISource.String(),
182+
si.Project.Homepage.String(),
183+
si.Project.Roadmap.String(),
184+
si.Project.Funding.String(),
185+
si.Project.ProjectDocumentation.DetailedGuide.String(),
186+
si.Project.ProjectDocumentation.CodeOfConduct.String(),
187+
si.Project.ProjectDocumentation.QuickstartGuide.String(),
188+
si.Project.ProjectDocumentation.ReleaseProcess.String(),
189+
si.Project.ProjectDocumentation.SignatureVerification.String(),
190+
si.Project.VulnerabilityReporting.BugBountyProgram.String(),
191+
si.Project.VulnerabilityReporting.SecurityPolicy.String(),
192+
si.Repository.Url.String(),
193+
si.Repository.License.Url.String(),
194+
si.Repository.SecurityPosture.Assessments.Self.Evidence.String(),
195195
}
196196
if data.RepositoryMetadata.OrganizationBlogURL() != nil {
197197
links = append(links, *data.RepositoryMetadata.OrganizationBlogURL())
198198
}
199199
for _, repo := range si.Project.Repositories {
200-
links = append(links, repo.URL)
200+
links = append(links, repo.Url.String())
201201
}
202202

203-
for _, repo := range si.Repository.Security.Assessments.ThirdParty {
204-
links = append(links, repo.Evidence)
203+
for _, repo := range si.Repository.SecurityPosture.Assessments.ThirdPartyAssessment {
204+
links = append(links, repo.Evidence.String())
205205
}
206206

207-
for _, tool := range si.Repository.Security.Tools {
208-
links = append(links, tool.Results.Adhoc.Location)
209-
links = append(links, tool.Results.CI.Location)
210-
links = append(links, tool.Results.Release.Location)
207+
for _, tool := range si.Repository.SecurityPosture.Tools {
208+
links = append(links, tool.SecurityToolResults.Adhoc.Location.String())
209+
links = append(links, tool.SecurityToolResults.Ci.Location.String())
210+
links = append(links, tool.SecurityToolResults.Release.Location.String())
211211
}
212212
return links
213213
}
@@ -260,7 +260,7 @@ func insightsHasSlsaAttestation(payloadData interface{}, _ map[string]*layer4.Ch
260260
return layer4.Unknown, message
261261
}
262262

263-
attestations := data.Insights.Repository.Release.Attestations
263+
attestations := data.Insights.Repository.ReleaseDetails.Attestations
264264

265265
for _, attestation := range attestations {
266266
if attestation.PredicateURI == "https://slsa.dev/provenance/v1" {
@@ -275,17 +275,15 @@ func distributionPointsUseHTTPS(payloadData interface{}, _ map[string]*layer4.Ch
275275
if message != "" {
276276
return layer4.Unknown, message
277277
}
278-
279-
distributionPoints := data.Insights.Repository.Release.DistributionPoints
280-
281-
if len(distributionPoints) == 0 {
278+
if data.Insights.Repository.ReleaseDetails == nil || (data.Insights.Repository.ReleaseDetails != nil && len(data.Insights.Repository.ReleaseDetails.DistributionPoints) == 0) {
282279
return layer4.NotApplicable, "No official distribution points found in Security Insights data"
283280
}
281+
distributionPoints := data.Insights.Repository.ReleaseDetails.DistributionPoints
284282

285283
var badURIs []string
286284
for _, point := range distributionPoints {
287-
if insecureURI(point.URI) {
288-
badURIs = append(badURIs, point.URI)
285+
if insecureURI(point.Uri) {
286+
badURIs = append(badURIs, point.Uri)
289287
}
290288
}
291289
if len(badURIs) > 0 {

‎evaluation_plans/osps/docs/steps.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ func hasUserGuides(payloadData interface{}, _ map[string]*layer4.Change) (result
2626
return layer4.Unknown, message
2727
}
2828

29-
if data.Insights.Project.Documentation.DetailedGuide == "" {
29+
if data.Insights.Project.ProjectDocumentation.DetailedGuide == "" {
3030
return layer4.Failed, "User guide was NOT specified in Security Insights data"
3131
}
3232

@@ -39,7 +39,7 @@ func acceptsVulnReports(payloadData interface{}, _ map[string]*layer4.Change) (r
3939
return layer4.Unknown, message
4040
}
4141

42-
if data.Insights.Project.Vulnerability.ReportsAccepted {
42+
if data.Insights.Project.VulnerabilityReporting.ReportsAccepted {
4343
return layer4.Passed, "Repository accepts vulnerability reports"
4444
}
4545

@@ -52,7 +52,7 @@ func hasSignatureVerificationGuide(payloadData interface{}, _ map[string]*layer4
5252
return layer4.Unknown, message
5353
}
5454

55-
if data.Insights.Project.Documentation.SignatureVerification == "" {
55+
if data.Insights.Project.ProjectDocumentation.SignatureVerification == "" {
5656
return layer4.Failed, "Signature verification guide was NOT specified in Security Insights data"
5757
}
5858

@@ -65,7 +65,7 @@ func hasDependencyManagementPolicy(payloadData interface{}, _ map[string]*layer4
6565
return layer4.Unknown, message
6666
}
6767

68-
if data.Insights.Repository.Documentation.DependencyManagement == "" {
68+
if data.Insights.Repository.RepositoryDocumentation.DependencyManagementPolicy.String() == "" {
6969
return layer4.Failed, "Dependency management policy was NOT specified in Security Insights data"
7070
}
7171

‎evaluation_plans/osps/governance/steps.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ func hasRolesAndResponsibilities(payloadData interface{}, _ map[string]*layer4.C
3737
return layer4.Unknown, message
3838
}
3939

40-
if data.Insights.Repository.Documentation.Governance == "" {
40+
if data.Insights.Repository.RepositoryDocumentation.Governance == "" {
4141
return layer4.Failed, "Roles and responsibilities were NOT specified in Security Insights data"
4242
}
4343

@@ -50,11 +50,11 @@ func hasContributionGuide(payloadData interface{}, _ map[string]*layer4.Change)
5050
return layer4.Unknown, message
5151
}
5252

53-
if data.Insights.Project.Documentation.CodeOfConduct != "" && data.Insights.Repository.Documentation.Contributing != "" {
53+
if data.Insights.Project.ProjectDocumentation.CodeOfConduct != "" && data.Insights.Repository.RepositoryDocumentation.ContributingGuide.String() != "" {
5454
return layer4.Passed, "Contributing guide specified in Security Insights data (Bonus: code of conduct location also specified)"
5555
}
5656

57-
if data.Repository.ContributingGuidelines.Body != "" && data.Insights.Project.Documentation.CodeOfConduct != "" {
57+
if data.Repository.ContributingGuidelines.Body != "" && data.Insights.Project.ProjectDocumentation.CodeOfConduct != "" {
5858
return layer4.Passed, "Contributing guide was found via GitHub API (Bonus: code of conduct was specified in Security Insights data)"
5959
}
6060

@@ -71,7 +71,7 @@ func hasContributionReviewPolicy(payloadData interface{}, _ map[string]*layer4.C
7171
return layer4.Unknown, message
7272
}
7373

74-
if data.Insights.Repository.Documentation.ReviewPolicy != "" {
74+
if data.Insights.Repository.RepositoryDocumentation.ReviewPolicy != "" {
7575
return layer4.Passed, "Code review guide was specified in Security Insights data"
7676
}
7777

‎evaluation_plans/osps/vuln_management/steps.go‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,10 @@ func hasSecContact(payloadData interface{}, _ map[string]*layer4.Change) (result
1616

1717
// TODO: Check for a contact email in SECURITY.md
1818

19-
if data.Insights.Project.Vulnerability.Contact.Email != "" {
19+
if data.Insights.Project.VulnerabilityReporting.Contact != nil && data.Insights.Project.VulnerabilityReporting.Contact.Email.String() != "" {
2020
return layer4.Passed, "Security contacts were specified in Security Insights data"
2121
}
22-
for _, champion := range data.Insights.Repository.Security.Champions {
22+
for _, champion := range data.Insights.Repository.SecurityPosture.Champions {
2323
if champion.Email != "" {
2424
return layer4.Passed, "Security contacts were specified in Security Insights data"
2525
}
@@ -28,18 +28,17 @@ func hasSecContact(payloadData interface{}, _ map[string]*layer4.Change) (result
2828
return layer4.Failed, "Security contacts were not specified in Security Insights data"
2929
}
3030

31-
3231
func sastToolDefined(payloadData interface{}, _ map[string]*layer4.Change) (result layer4.Result, message string) {
3332
data, message := reusable_steps.VerifyPayload(payloadData)
3433
if message != "" {
3534
return layer4.Unknown, message
3635
}
3736

38-
for _,tool := range data.Insights.Repository.Security.Tools {
37+
for _, tool := range data.Insights.Repository.SecurityPosture.Tools {
3938
if tool.Type == "SAST" {
40-
41-
enabled := []bool { tool.Integration.Adhoc, tool.Integration.CI, tool.Integration.Release }
42-
39+
40+
enabled := []bool{tool.SecurityToolIntegration.Adhoc, tool.SecurityToolIntegration.Ci, tool.SecurityToolIntegration.Release}
41+
4342
if slices.Contains(enabled, true) {
4443
return layer4.Passed, "Static Application Security Testing documented in Security Insights"
4544
}

‎evaluation_plans/osps/vuln_management/steps_test.go‎

Lines changed: 35 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -10,29 +10,28 @@ import (
1010
)
1111

1212
type testingData struct {
13-
expectedResult layer4.Result
14-
expectedMessage string
15-
payloadData interface{}
13+
expectedResult layer4.Result
14+
expectedMessage string
15+
payloadData interface{}
1616
assertionMessage string
1717
}
1818

19-
2019
func TestSastToolDefined(t *testing.T) {
21-
20+
2221
testData := []testingData{
2322
{
24-
expectedResult: layer4.Passed,
25-
expectedMessage: "Static Application Security Testing documented in Security Insights",
23+
expectedResult: layer4.Passed,
24+
expectedMessage: "Static Application Security Testing documented in Security Insights",
2625
assertionMessage: "Test for SAST integration enabled",
27-
payloadData: data.Payload{
28-
RestData: &data.RestData {
26+
payloadData: data.Payload{
27+
RestData: &data.RestData{
2928
Insights: si.SecurityInsights{
30-
Repository: si.Repository{
31-
Security: si.SecurityInfo{
32-
Tools: []si.Tool{
29+
Repository: &si.Repository{
30+
SecurityPosture: si.SecurityPosture{
31+
Tools: []si.SecurityTool{
3332
{
3433
Type: "SAST",
35-
Integration: si.Integration{
34+
SecurityToolIntegration: si.SecurityToolIntegration{
3635
Adhoc: true,
3736
},
3837
},
@@ -42,18 +41,17 @@ func TestSastToolDefined(t *testing.T) {
4241
},
4342
},
4443
},
45-
4644
},
4745
{
48-
expectedResult: layer4.Failed,
49-
expectedMessage: "No Static Application Security Testing documented in Security Insights",
46+
expectedResult: layer4.Failed,
47+
expectedMessage: "No Static Application Security Testing documented in Security Insights",
5048
assertionMessage: "Test for SAST integration present but not explicitly enabled",
51-
payloadData: data.Payload{
52-
RestData: &data.RestData {
49+
payloadData: data.Payload{
50+
RestData: &data.RestData{
5351
Insights: si.SecurityInsights{
54-
Repository: si.Repository{
55-
Security: si.SecurityInfo{
56-
Tools: []si.Tool{
52+
Repository: &si.Repository{
53+
SecurityPosture: si.SecurityPosture{
54+
Tools: []si.SecurityTool{
5755
{
5856
Type: "SAST",
5957
},
@@ -63,18 +61,17 @@ func TestSastToolDefined(t *testing.T) {
6361
},
6462
},
6563
},
66-
6764
},
6865
{
69-
expectedResult: layer4.Failed,
70-
expectedMessage: "No Static Application Security Testing documented in Security Insights",
66+
expectedResult: layer4.Failed,
67+
expectedMessage: "No Static Application Security Testing documented in Security Insights",
7168
assertionMessage: "Test for Non SAST tool defined",
72-
payloadData: data.Payload{
73-
RestData: &data.RestData {
69+
payloadData: data.Payload{
70+
RestData: &data.RestData{
7471
Insights: si.SecurityInsights{
75-
Repository: si.Repository{
76-
Security: si.SecurityInfo{
77-
Tools: []si.Tool{
72+
Repository: &si.Repository{
73+
SecurityPosture: si.SecurityPosture{
74+
Tools: []si.SecurityTool{
7875
{
7976
Type: "NotSast",
8077
},
@@ -84,31 +81,28 @@ func TestSastToolDefined(t *testing.T) {
8481
},
8582
},
8683
},
87-
8884
},
8985
{
90-
expectedResult: layer4.Failed,
91-
expectedMessage: "No Static Application Security Testing documented in Security Insights",
86+
expectedResult: layer4.Failed,
87+
expectedMessage: "No Static Application Security Testing documented in Security Insights",
9288
assertionMessage: "Test for no tools defined",
93-
payloadData: data.Payload{
94-
RestData: &data.RestData {
89+
payloadData: data.Payload{
90+
RestData: &data.RestData{
9591
Insights: si.SecurityInsights{
96-
Repository: si.Repository{
97-
Security: si.SecurityInfo{
98-
},
92+
Repository: &si.Repository{
93+
SecurityPosture: si.SecurityPosture{},
9994
},
10095
},
10196
},
10297
},
103-
10498
},
10599
}
106-
100+
107101
for _, test := range testData {
108102
result, message := sastToolDefined(test.payloadData, nil)
109103

110104
assert.Equal(t, test.expectedResult, result, test.assertionMessage)
111105
assert.Equal(t, test.expectedMessage, message, test.assertionMessage)
112106
}
113-
114-
}
107+
108+
}

‎evaluation_plans/reusable_steps/evaluations.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ func HasDependencyManagementPolicy(payloadData interface{}, _ map[string]*layer4
9898
return layer4.Unknown, message
9999
}
100100

101-
if len(payload.Insights.Repository.Documentation.DependencyManagement) > 0 {
101+
if len(payload.Insights.Repository.RepositoryDocumentation.DependencyManagementPolicy.String()) > 0 {
102102
return layer4.Passed, "Found dependency management policy in documentation"
103103
}
104104

0 commit comments

Comments
 (0)