fix: recompute local promotion evidence
This commit is contained in:
DongHyeonka
@@ -0,0 +1,150 @@
|
||||
import {
|
||||
dependencyDiffArtifactSchema,
|
||||
dependencyInventoryArtifactSchema,
|
||||
licenseReportArtifactSchema,
|
||||
} from "../contracts/release-artifacts.ts";
|
||||
import type { DistOutput } from "./release-candidate.ts";
|
||||
import {
|
||||
diffDependencyInventories,
|
||||
supplyChainDigest,
|
||||
validateDependencyReview,
|
||||
validateLicensePolicy,
|
||||
} from "./supply-chain.ts";
|
||||
|
||||
type Document = Record<string, unknown>;
|
||||
|
||||
export function recomputeDependencyEvidence(input: Readonly<{
|
||||
inventory: unknown;
|
||||
baseline: unknown;
|
||||
baselineApproval: unknown;
|
||||
dependencyChangeEvidence: unknown;
|
||||
skipBaseline?: boolean;
|
||||
}>) {
|
||||
const inventory = dependencyInventoryArtifactSchema.parse(input.inventory);
|
||||
const baseline = asDocument(input.baseline);
|
||||
const approval = asDocument(input.baselineApproval);
|
||||
const dependencyChangeEvidence = asDocument(input.dependencyChangeEvidence);
|
||||
const failures: string[] = [];
|
||||
const skipBaseline = input.skipBaseline === true;
|
||||
let diff: ReturnType<typeof diffDependencyInventories> = Object.freeze({
|
||||
added: Object.freeze([]),
|
||||
removed: Object.freeze([]),
|
||||
changed: Object.freeze([]),
|
||||
upgrades: Object.freeze([]),
|
||||
});
|
||||
let review: ReturnType<typeof validateDependencyReview> = Object.freeze({
|
||||
passed: skipBaseline,
|
||||
highRisk: Object.freeze([]),
|
||||
failures: Object.freeze(
|
||||
skipBaseline ? [] : ["dependency baseline unavailable"],
|
||||
),
|
||||
});
|
||||
const baselineDigest = baseline ? supplyChainDigest(baseline) : null;
|
||||
|
||||
if (baseline && approval) {
|
||||
diff = diffDependencyInventories(baseline, inventory);
|
||||
review = validateDependencyReview(
|
||||
diff,
|
||||
inventory,
|
||||
dependencyChangeEvidence ?? {},
|
||||
);
|
||||
if (
|
||||
approval.schemaVersion !== 1 ||
|
||||
approval.snapshotDigest !== baselineDigest ||
|
||||
typeof approval.owner !== "string" ||
|
||||
approval.owner.trim().length === 0
|
||||
) {
|
||||
failures.push("dependency baseline approval digest mismatch");
|
||||
}
|
||||
} else if (!skipBaseline) {
|
||||
failures.push("dependency baseline and approval are required");
|
||||
}
|
||||
failures.push(...review.failures);
|
||||
|
||||
const report = dependencyDiffArtifactSchema.parse({
|
||||
schemaVersion: 2,
|
||||
baselineDigest,
|
||||
currentDigest: supplyChainDigest(inventory),
|
||||
...diff,
|
||||
highRisk: review.highRisk,
|
||||
reviewFailures: review.failures,
|
||||
});
|
||||
return Object.freeze({
|
||||
report,
|
||||
dependencyDiff: diff,
|
||||
highRisk: review.highRisk,
|
||||
failures: Object.freeze(failures),
|
||||
});
|
||||
}
|
||||
|
||||
export function compareStoredDependencyEvidence(
|
||||
recomputed: ReturnType<typeof recomputeDependencyEvidence>,
|
||||
stored: unknown,
|
||||
): string[] {
|
||||
const parsed = dependencyDiffArtifactSchema.safeParse(stored);
|
||||
if (
|
||||
!parsed.success ||
|
||||
supplyChainDigest(parsed.data) !== supplyChainDigest(recomputed.report)
|
||||
) {
|
||||
return ["stored dependency diff does not match recomputed policy evidence"];
|
||||
}
|
||||
return [...recomputed.failures];
|
||||
}
|
||||
|
||||
export function recomputeLicenseEvidence(input: Readonly<{
|
||||
inventory: unknown;
|
||||
policy: unknown;
|
||||
}>) {
|
||||
const inventory = dependencyInventoryArtifactSchema.parse(input.inventory);
|
||||
const policy = asDocument(input.policy) ?? {};
|
||||
const result = validateLicensePolicy(inventory, policy);
|
||||
const report = licenseReportArtifactSchema.parse({
|
||||
schemaVersion: 1,
|
||||
status: result.passed ? "PASS" : "FAIL",
|
||||
dependencyCount: inventory.dependencyCount,
|
||||
results: result.results,
|
||||
failures: result.failures,
|
||||
});
|
||||
return Object.freeze({
|
||||
report,
|
||||
failures: result.failures,
|
||||
});
|
||||
}
|
||||
|
||||
export function compareStoredLicenseEvidence(
|
||||
recomputed: ReturnType<typeof recomputeLicenseEvidence>,
|
||||
stored: unknown,
|
||||
): string[] {
|
||||
const parsed = licenseReportArtifactSchema.safeParse(stored);
|
||||
if (
|
||||
!parsed.success ||
|
||||
supplyChainDigest(parsed.data) !== supplyChainDigest(recomputed.report)
|
||||
) {
|
||||
return ["stored license report does not match recomputed policy evidence"];
|
||||
}
|
||||
return [...recomputed.failures];
|
||||
}
|
||||
|
||||
export function distChecksumsText(outputs: readonly DistOutput[]): string {
|
||||
return `${[...outputs]
|
||||
.sort((left, right) => left.path.localeCompare(right.path))
|
||||
.map((output) => `${output.sha256} ${output.path}`)
|
||||
.join("\n")}\n`;
|
||||
}
|
||||
|
||||
export function verifyStoredDistChecksums(
|
||||
outputs: readonly DistOutput[],
|
||||
stored: string,
|
||||
): string[] {
|
||||
return stored === distChecksumsText(outputs)
|
||||
? []
|
||||
: ["stored dist checksums do not match current outputs"];
|
||||
}
|
||||
|
||||
function asDocument(value: unknown): Document | null {
|
||||
return value !== null &&
|
||||
typeof value === "object" &&
|
||||
!Array.isArray(value)
|
||||
? (value as Document)
|
||||
: null;
|
||||
}
|
||||
@@ -32,10 +32,21 @@ import type { ReleaseCandidateManifest } from "./release-candidate.ts";
|
||||
import { collectDistOutputs, distSha256 } from "./release-candidate.ts";
|
||||
import { verifyReleaseRuntimeCoherence } from "./release-runtime-coherence.ts";
|
||||
import { digestReleaseInputFiles } from "./release-input-evidence.ts";
|
||||
import {
|
||||
compareStoredDependencyEvidence,
|
||||
compareStoredLicenseEvidence,
|
||||
recomputeDependencyEvidence,
|
||||
recomputeLicenseEvidence,
|
||||
verifyStoredDistChecksums,
|
||||
} from "./local-policy-evidence.ts";
|
||||
import {
|
||||
buildRepositoryFileInventory,
|
||||
parseRepositoryFileInventoryPolicy,
|
||||
} from "./repository-file-inventory.ts";
|
||||
import {
|
||||
evaluateRepositorySecretScan,
|
||||
verifyStoredSecretScan,
|
||||
} from "./secret-scan-evaluator.ts";
|
||||
import {
|
||||
isValidSha512Integrity,
|
||||
parsePnpmLockfilePackages,
|
||||
@@ -137,15 +148,15 @@ export async function verifyLocalSupplyChainEvidence(
|
||||
}
|
||||
const sbomSha256 = sbom ? supplyChainDigest(sbom) : "0".repeat(64);
|
||||
|
||||
let coherenceFailures: readonly string[] = Object.freeze([]);
|
||||
if (inventory && sbom && provenance) {
|
||||
failures.push(
|
||||
...verifySupplyChainCoherence(
|
||||
sbom,
|
||||
inventory,
|
||||
provenance,
|
||||
distDigest,
|
||||
).failures,
|
||||
);
|
||||
coherenceFailures = verifySupplyChainCoherence(
|
||||
sbom,
|
||||
inventory,
|
||||
provenance,
|
||||
distDigest,
|
||||
).failures;
|
||||
failures.push(...coherenceFailures);
|
||||
}
|
||||
if (
|
||||
!inventory ||
|
||||
@@ -193,6 +204,53 @@ export async function verifyLocalSupplyChainEvidence(
|
||||
failures.push("release source inventory is unavailable or unreadable");
|
||||
}
|
||||
}
|
||||
if (inventory && verification) {
|
||||
try {
|
||||
const dependencyPolicy = recomputeDependencyEvidence({
|
||||
inventory,
|
||||
baseline: await optionalReadJson(
|
||||
repositoryRoot,
|
||||
"config/security/dependency-baseline.json",
|
||||
),
|
||||
baselineApproval: await optionalReadJson(
|
||||
repositoryRoot,
|
||||
"config/security/dependency-baseline.approval.json",
|
||||
),
|
||||
dependencyChangeEvidence: await readJson(
|
||||
repositoryRoot,
|
||||
"config/security/dependency-change-evidence.json",
|
||||
),
|
||||
});
|
||||
const licensePolicy = recomputeLicenseEvidence({
|
||||
inventory,
|
||||
policy: await readJson(
|
||||
repositoryRoot,
|
||||
"config/security/dependency-policy.json",
|
||||
),
|
||||
});
|
||||
const expectedFailures = [
|
||||
...licensePolicy.failures,
|
||||
...dependencyPolicy.failures,
|
||||
...coherenceFailures,
|
||||
];
|
||||
if (
|
||||
supplyChainDigest(verification.dependencyDiff) !==
|
||||
supplyChainDigest(dependencyPolicy.dependencyDiff) ||
|
||||
supplyChainDigest(verification.highRiskReview) !==
|
||||
supplyChainDigest(dependencyPolicy.highRisk) ||
|
||||
supplyChainDigest(verification.failures) !==
|
||||
supplyChainDigest(expectedFailures) ||
|
||||
verification.localStatus !==
|
||||
(expectedFailures.length === 0 ? "PASS" : "FAIL")
|
||||
) {
|
||||
failures.push(
|
||||
"supply-chain verification policy fields do not match recomputed evidence",
|
||||
);
|
||||
}
|
||||
} catch {
|
||||
failures.push("supply-chain verification policy inputs are invalid");
|
||||
}
|
||||
}
|
||||
|
||||
const lockRows = parsePnpmLockfilePackages(lockfileText);
|
||||
const inventoryRows = inventory?.dependencies ?? [];
|
||||
@@ -366,6 +424,13 @@ async function validateSupportingArtifacts(
|
||||
repositoryRoot: string,
|
||||
failures: string[],
|
||||
): Promise<void> {
|
||||
let actualOutputs: Awaited<ReturnType<typeof collectDistOutputs>> | null =
|
||||
null;
|
||||
try {
|
||||
actualOutputs = await collectDistOutputs(repositoryRoot);
|
||||
} catch {
|
||||
failures.push("supporting evidence dist inputs are unreadable");
|
||||
}
|
||||
const bundle = await parseArtifact(
|
||||
repositoryRoot,
|
||||
"artifacts/performance/bundle.json",
|
||||
@@ -373,16 +438,35 @@ async function validateSupportingArtifacts(
|
||||
"bundle report",
|
||||
failures,
|
||||
);
|
||||
if (bundle) {
|
||||
if (
|
||||
bundle &&
|
||||
actualOutputs &&
|
||||
JSON.stringify(bundle.outputs) !== JSON.stringify(actualOutputs)
|
||||
) {
|
||||
failures.push("bundle report does not describe current dist bytes");
|
||||
}
|
||||
if (actualOutputs) {
|
||||
try {
|
||||
const actual = await collectDistOutputs(repositoryRoot);
|
||||
if (JSON.stringify(bundle.outputs) !== JSON.stringify(actual)) {
|
||||
failures.push("bundle report does not describe current dist bytes");
|
||||
}
|
||||
failures.push(
|
||||
...verifyStoredDistChecksums(
|
||||
actualOutputs,
|
||||
await readFile(
|
||||
path.join(repositoryRoot, "artifacts/release/checksums.txt"),
|
||||
"utf8",
|
||||
),
|
||||
),
|
||||
);
|
||||
} catch {
|
||||
failures.push("bundle report dist inputs are unreadable");
|
||||
failures.push("stored dist checksums are missing or unreadable");
|
||||
}
|
||||
}
|
||||
const inventory = await parseArtifact(
|
||||
repositoryRoot,
|
||||
"artifacts/release/dependency-inventory.json",
|
||||
dependencyInventoryArtifactSchema,
|
||||
"dependency inventory",
|
||||
failures,
|
||||
);
|
||||
const dependencyDiff = await parseArtifact(
|
||||
repositoryRoot,
|
||||
"artifacts/security/dependency-diff.json",
|
||||
@@ -390,8 +474,29 @@ async function validateSupportingArtifacts(
|
||||
"dependency diff",
|
||||
failures,
|
||||
);
|
||||
if (dependencyDiff && dependencyDiff.reviewFailures.length > 0) {
|
||||
failures.push("dependency review evidence is not PASS");
|
||||
if (inventory && dependencyDiff) {
|
||||
try {
|
||||
const recomputed = recomputeDependencyEvidence({
|
||||
inventory,
|
||||
baseline: await optionalReadJson(
|
||||
repositoryRoot,
|
||||
"config/security/dependency-baseline.json",
|
||||
),
|
||||
baselineApproval: await optionalReadJson(
|
||||
repositoryRoot,
|
||||
"config/security/dependency-baseline.approval.json",
|
||||
),
|
||||
dependencyChangeEvidence: await readJson(
|
||||
repositoryRoot,
|
||||
"config/security/dependency-change-evidence.json",
|
||||
),
|
||||
});
|
||||
failures.push(
|
||||
...compareStoredDependencyEvidence(recomputed, dependencyDiff),
|
||||
);
|
||||
} catch {
|
||||
failures.push("dependency policy evidence is missing or invalid");
|
||||
}
|
||||
}
|
||||
const license = await parseArtifact(
|
||||
repositoryRoot,
|
||||
@@ -400,8 +505,19 @@ async function validateSupportingArtifacts(
|
||||
"license report",
|
||||
failures,
|
||||
);
|
||||
if (license && (license.status !== "PASS" || license.failures.length > 0)) {
|
||||
failures.push("license report is not PASS");
|
||||
if (inventory && license) {
|
||||
try {
|
||||
const recomputed = recomputeLicenseEvidence({
|
||||
inventory,
|
||||
policy: await readJson(
|
||||
repositoryRoot,
|
||||
"config/security/dependency-policy.json",
|
||||
),
|
||||
});
|
||||
failures.push(...compareStoredLicenseEvidence(recomputed, license));
|
||||
} catch {
|
||||
failures.push("license policy evidence is missing or invalid");
|
||||
}
|
||||
}
|
||||
const vulnerability = await parseArtifact(
|
||||
repositoryRoot,
|
||||
@@ -485,20 +601,13 @@ async function verifySecretScan(
|
||||
failures: string[],
|
||||
): Promise<void> {
|
||||
try {
|
||||
const sarif = asRecord(
|
||||
await readJson(repositoryRoot, "artifacts/security/scan.sarif"),
|
||||
"secret scan SARIF",
|
||||
const evaluation = await evaluateRepositorySecretScan({ repositoryRoot });
|
||||
failures.push(
|
||||
...verifyStoredSecretScan(
|
||||
evaluation,
|
||||
await readJson(repositoryRoot, "artifacts/security/scan.sarif"),
|
||||
),
|
||||
);
|
||||
const runs = Array.isArray(sarif.runs) ? sarif.runs : [];
|
||||
if (
|
||||
sarif.version !== "2.1.0" ||
|
||||
runs.length !== 1 ||
|
||||
!isRecord(runs[0]) ||
|
||||
!Array.isArray(runs[0].results) ||
|
||||
runs[0].results.length !== 0
|
||||
) {
|
||||
failures.push("secret scan SARIF is not an empty PASS");
|
||||
}
|
||||
} catch {
|
||||
failures.push("secret scan SARIF is missing or invalid");
|
||||
}
|
||||
@@ -523,6 +632,17 @@ async function readJson(repositoryRoot: string, file: string): Promise<unknown>
|
||||
return JSON.parse(await readFile(path.join(repositoryRoot, file), "utf8"));
|
||||
}
|
||||
|
||||
async function optionalReadJson(
|
||||
repositoryRoot: string,
|
||||
file: string,
|
||||
): Promise<unknown | null> {
|
||||
try {
|
||||
return await readJson(repositoryRoot, file);
|
||||
} catch {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
function asRecord(value: unknown, label: string): Record<string, unknown> {
|
||||
if (!isRecord(value)) throw new TypeError(`${label} must be a JSON object`);
|
||||
return value;
|
||||
|
||||
@@ -0,0 +1,272 @@
|
||||
import { readFile } from "node:fs/promises";
|
||||
import path from "node:path";
|
||||
|
||||
import { z } from "zod";
|
||||
|
||||
import {
|
||||
buildRepositoryFileInventory,
|
||||
parseRepositoryFileInventoryPolicy,
|
||||
} from "./repository-file-inventory.ts";
|
||||
import {
|
||||
findSecretMatches,
|
||||
secretScanRules,
|
||||
type SecretAllowlistEntry,
|
||||
type SecretFinding,
|
||||
} from "./secret-scan.ts";
|
||||
import {
|
||||
parseSecretScanIncludedPaths,
|
||||
selectIncludedInventoryFiles,
|
||||
} from "./secret-scan-policy.ts";
|
||||
import { supplyChainDigest } from "./supply-chain.ts";
|
||||
|
||||
const nonEmptyString = z.string().min(1);
|
||||
const sarifRuleSchema = z
|
||||
.object({
|
||||
id: nonEmptyString,
|
||||
shortDescription: z.object({ text: nonEmptyString }).strict(),
|
||||
})
|
||||
.strict();
|
||||
const sarifResultSchema = z
|
||||
.object({
|
||||
ruleId: nonEmptyString,
|
||||
message: z.object({ text: nonEmptyString }).strict(),
|
||||
partialFingerprints: z
|
||||
.object({ primaryLocationLineHash: nonEmptyString })
|
||||
.strict()
|
||||
.optional(),
|
||||
locations: z
|
||||
.array(
|
||||
z
|
||||
.object({
|
||||
physicalLocation: z
|
||||
.object({
|
||||
artifactLocation: z.object({ uri: nonEmptyString }).strict(),
|
||||
region: z.object({ startLine: z.int().positive() }).strict(),
|
||||
})
|
||||
.strict(),
|
||||
})
|
||||
.strict(),
|
||||
)
|
||||
.optional(),
|
||||
})
|
||||
.strict();
|
||||
|
||||
export const secretScanSarifSchema = z
|
||||
.object({
|
||||
version: z.literal("2.1.0"),
|
||||
$schema: z.literal("https://json.schemastore.org/sarif-2.1.0.json"),
|
||||
runs: z
|
||||
.array(
|
||||
z
|
||||
.object({
|
||||
tool: z
|
||||
.object({
|
||||
driver: z
|
||||
.object({
|
||||
name: z.literal("ca-frontend-secret-scan"),
|
||||
rules: z.array(sarifRuleSchema),
|
||||
})
|
||||
.strict(),
|
||||
})
|
||||
.strict(),
|
||||
results: z.array(sarifResultSchema),
|
||||
})
|
||||
.strict(),
|
||||
)
|
||||
.length(1),
|
||||
})
|
||||
.strict();
|
||||
|
||||
type AllowlistEntry = SecretAllowlistEntry &
|
||||
Readonly<{ owner: string; reason: string }>;
|
||||
export type SecretScanPolicy = Readonly<{
|
||||
excludedPaths: readonly string[];
|
||||
trackedRoots: readonly string[];
|
||||
generatedRoots: readonly string[];
|
||||
optionalRoots: readonly string[];
|
||||
includedPaths: readonly string[] | null;
|
||||
allowlist: readonly AllowlistEntry[];
|
||||
}>;
|
||||
|
||||
export function parseSecretScanPolicy(value: unknown): SecretScanPolicy {
|
||||
const document = isRecord(value) ? value : {};
|
||||
const inventoryPolicy = parseRepositoryFileInventoryPolicy(value);
|
||||
const allowlist = Array.isArray(document.allowlist)
|
||||
? document.allowlist.map((rawEntry) => {
|
||||
const entry = isRecord(rawEntry) ? rawEntry : {};
|
||||
return Object.freeze({
|
||||
path: typeof entry.path === "string" ? entry.path : "",
|
||||
ruleId: typeof entry.ruleId === "string" ? entry.ruleId : "",
|
||||
owner: typeof entry.owner === "string" ? entry.owner : "",
|
||||
reason: typeof entry.reason === "string" ? entry.reason : "",
|
||||
expiresAt:
|
||||
typeof entry.expiresAt === "string" ? entry.expiresAt : "",
|
||||
});
|
||||
})
|
||||
: [];
|
||||
return Object.freeze({
|
||||
excludedPaths: Object.freeze(strings(document.excludedPaths)),
|
||||
trackedRoots: inventoryPolicy.trackedRoots,
|
||||
generatedRoots: inventoryPolicy.generatedRoots,
|
||||
optionalRoots: inventoryPolicy.optionalRoots,
|
||||
includedPaths: parseSecretScanIncludedPaths(document.includedPaths),
|
||||
allowlist: Object.freeze(allowlist),
|
||||
});
|
||||
}
|
||||
|
||||
export async function evaluateRepositorySecretScan(input: Readonly<{
|
||||
repositoryRoot?: string;
|
||||
policyPath?: string;
|
||||
now?: number;
|
||||
}>) {
|
||||
const repositoryRoot = path.resolve(input.repositoryRoot ?? process.cwd());
|
||||
const policy = parseSecretScanPolicy(
|
||||
JSON.parse(
|
||||
await readFile(
|
||||
path.resolve(
|
||||
repositoryRoot,
|
||||
input.policyPath ?? "config/security/secret-scan-policy.json",
|
||||
),
|
||||
"utf8",
|
||||
),
|
||||
) as unknown,
|
||||
);
|
||||
const inventory = await buildRepositoryFileInventory({
|
||||
repositoryRoot,
|
||||
trackedRoots: policy.trackedRoots,
|
||||
generatedRoots: policy.generatedRoots,
|
||||
optionalRoots: policy.optionalRoots,
|
||||
});
|
||||
return evaluateSecretScan({
|
||||
policy,
|
||||
inventoryFiles: inventory.files,
|
||||
readText: (file) => readFile(path.join(repositoryRoot, file), "utf8"),
|
||||
now: input.now,
|
||||
});
|
||||
}
|
||||
|
||||
export async function evaluateSecretScan(input: Readonly<{
|
||||
policy: SecretScanPolicy;
|
||||
inventoryFiles: readonly string[];
|
||||
readText: (file: string) => Promise<string>;
|
||||
now?: number;
|
||||
}>) {
|
||||
const now = input.now ?? Date.now();
|
||||
const findings: SecretFinding[] = [];
|
||||
const policyFailures: string[] = [];
|
||||
for (const entry of input.policy.allowlist) {
|
||||
const expiry = Date.parse(entry.expiresAt);
|
||||
if (
|
||||
!entry.path.startsWith("tests/") ||
|
||||
!entry.owner.trim() ||
|
||||
!entry.reason.trim() ||
|
||||
!Number.isFinite(expiry) ||
|
||||
expiry <= now
|
||||
) {
|
||||
policyFailures.push(
|
||||
`invalid or expired secret allowlist entry: ${entry.path}:${entry.ruleId}`,
|
||||
);
|
||||
}
|
||||
}
|
||||
const scanFiles = selectIncludedInventoryFiles(
|
||||
input.inventoryFiles,
|
||||
input.policy.includedPaths,
|
||||
);
|
||||
const excluded = new Set(
|
||||
input.policy.excludedPaths.map((entry) => entry.replaceAll("\\", "/")),
|
||||
);
|
||||
for (const scanFile of [...new Set(scanFiles)].sort()) {
|
||||
const normalized = scanFile.replaceAll("\\", "/");
|
||||
if (
|
||||
[...excluded].some(
|
||||
(entry) =>
|
||||
normalized === entry || normalized.startsWith(`${entry}/`),
|
||||
) ||
|
||||
/\.(?:png|jpe?g|gif|webp|woff2?|zip|gz|sarif)$/iu.test(normalized)
|
||||
) {
|
||||
continue;
|
||||
}
|
||||
findings.push(
|
||||
...findSecretMatches(normalized, await input.readText(scanFile), {
|
||||
allowlist: input.policy.allowlist,
|
||||
now,
|
||||
}),
|
||||
);
|
||||
}
|
||||
const sarif = secretScanSarifSchema.parse({
|
||||
version: "2.1.0",
|
||||
$schema: "https://json.schemastore.org/sarif-2.1.0.json",
|
||||
runs: [
|
||||
{
|
||||
tool: {
|
||||
driver: {
|
||||
name: "ca-frontend-secret-scan",
|
||||
rules: secretScanRules().map((pattern) => ({
|
||||
id: pattern.id,
|
||||
shortDescription: { text: "Potential credential material" },
|
||||
})),
|
||||
},
|
||||
},
|
||||
results: [
|
||||
...findings.map((finding) => ({
|
||||
ruleId: finding.ruleId,
|
||||
message: { text: "Potential secret material must be removed." },
|
||||
partialFingerprints: {
|
||||
primaryLocationLineHash: finding.fingerprint,
|
||||
},
|
||||
locations: [
|
||||
{
|
||||
physicalLocation: {
|
||||
artifactLocation: { uri: finding.file },
|
||||
region: { startLine: finding.line },
|
||||
},
|
||||
},
|
||||
],
|
||||
})),
|
||||
...policyFailures.map((failure) => ({
|
||||
ruleId: "invalid-allowlist",
|
||||
message: { text: failure },
|
||||
})),
|
||||
],
|
||||
},
|
||||
],
|
||||
});
|
||||
return Object.freeze({
|
||||
findings: Object.freeze(findings),
|
||||
policyFailures: Object.freeze(policyFailures),
|
||||
scanFiles: Object.freeze([...scanFiles]),
|
||||
sarif,
|
||||
});
|
||||
}
|
||||
|
||||
export function verifyStoredSecretScan(
|
||||
evaluation: Awaited<ReturnType<typeof evaluateSecretScan>>,
|
||||
stored: unknown,
|
||||
): string[] {
|
||||
const failures: string[] = [];
|
||||
const blockingCount =
|
||||
evaluation.findings.length + evaluation.policyFailures.length;
|
||||
if (blockingCount > 0) {
|
||||
failures.push(
|
||||
`recomputed secret scan contains ${blockingCount} blocking result(s)`,
|
||||
);
|
||||
}
|
||||
const parsed = secretScanSarifSchema.safeParse(stored);
|
||||
if (
|
||||
!parsed.success ||
|
||||
supplyChainDigest(parsed.data) !== supplyChainDigest(evaluation.sarif)
|
||||
) {
|
||||
failures.push("stored secret scan SARIF does not match recomputed results");
|
||||
}
|
||||
return failures;
|
||||
}
|
||||
|
||||
function strings(value: unknown): string[] {
|
||||
return Array.isArray(value)
|
||||
? value.filter((entry): entry is string => typeof entry === "string")
|
||||
: [];
|
||||
}
|
||||
|
||||
function isRecord(value: unknown): value is Record<string, unknown> {
|
||||
return Boolean(value) && typeof value === "object" && !Array.isArray(value);
|
||||
}
|
||||
Reference in New Issue
Block a user