Add allowed package sources policy #1212
Conversation
kosciCZ
force-pushed
the
add-allowed-package-sources
branch
from
e55ca4a
to
b68cef6
Compare
|
@ralphbean could I get your eyes on this as general concept as well as the |
| @@ -266,3 +266,5 @@ rule_data_attributes_key := "disallowed_attributes" | |||
| rule_data_allowed_external_references_key := "allowed_external_references" | |||
|
|
|||
| rule_data_disallowed_external_references_key := "disallowed_external_references" | |||
|
|
|||
| rule_data_allowed_package_sources_key := "allowed_package_sources" | |||
There was a problem hiding this comment.
See the rule_data_errors rules above. Let's add a new one that verifies the consistency of this new rule data key. This helps us determine if the rule data provided has any problems.
There was a problem hiding this comment.
Holding out on this until the the comment about rule data format is settled.
There was a problem hiding this comment.
Since the rule is specific for cachi2, should it maybe be "cachi2_allowed_sources"?
|
|
||
| parsed_purl := ec.purl.parse(component.purl) | ||
|
|
||
| # only look at components fetched by cachi2 that define an externalReferences |
There was a problem hiding this comment.
I do wonder if this rule can be a bit more data driven. For example, what if we allowed the rule data to be something like this:
- type: maven
properties:
- name: cachi2:found_by
value: cachi2
reference:
type: distribution
allowed_references:
- ".*apache.org.*"
- ".*example.com.*"Or some variation of that. WDYT?
There was a problem hiding this comment.
I'm not sure if that brings any additional value, because cachi2 will always produce just the one type of externalReference. However, this might be useful in the case of cachi2 changing its name, which will likely occur.
I think that this also has a downside of making the rules less transparent with regards to what is actually allowed, because you get two additional parameters to control that. I think we should strike a balance between extensible and readable.
There was a problem hiding this comment.
(Also I think we should settle this first before I get to some of the other comments)
| @@ -148,6 +148,63 @@ deny contains result if { | |||
| result := lib.result_helper_with_term(rego.metadata.chain(), [id, reference.url, reference.type, msg], id) | |||
| } | |||
|
|
|||
| # METADATA | |||
There was a problem hiding this comment.
We also need corresponding changes in sbom_spdx.rego 😭
There was a problem hiding this comment.
Cachi2 currently does not produce an SPDX SBOM, so there's not yet anything to latch onto (as in to the externalReference of type distribution in CycloneDX). Holding out on this until the the comment about rule data format is settled.
Signed-off-by: Jan Koscielniak <[email protected]>
kosciCZ
force-pushed
the
add-allowed-package-sources
branch
from
b68cef6
to
121c63e
Compare
| purl := component.purl | ||
| parsed_purl := ec.purl.parse(purl) | ||
|
|
||
| # patterns are either those defined by the rule for a give purl type, or empty by default |
There was a problem hiding this comment.
| # patterns are either those defined by the rule for a give purl type, or empty by default | |
| # patterns are either those defined by the rule for a given purl type, or empty by default |
|
It would be nice to add some explanation to the commit message, and also include a Jira reference, e.g.: (I know it's explained in the PR, but having it in the git history is preferable IMO.) Nice PR btw! |
| # description: >- | ||
| # For each of the components fetched by Cachi2 which define externalReferences of type | ||
| # distribution, verify they are allowed based on the allowed_package_sources rule data | ||
| # key. By default, allowed_package_sources is empty which means no components with such |
There was a problem hiding this comment.
| # key. By default, allowed_package_sources is empty which means no components with such | |
| # key. By default, allowed_package_sources is empty, which means no components with such |
🤷
This adds a new
allowed_package_sourcespolicy that can gate content fetched by cachi2. This rule take a lot from theallowed_external_references, but makes it specific to content fetched by cachi2, because it is not uncommon for dependencies fetched by other means to define externalReferences of typedistribution. Cachi2 currently produces the mentioned external reference only for packages fetched with the generic fetcher (docs WIP) that always produces apkg:genericpurl, but it is possible it will be extended to other package managers supported by cachi2 as well.The rule data for this policy are structured as a list of regex patterns for a given purl type. Examples in tests.
Finally, this is my first contribution to EC (and rego) so please excuse any antipatterns I might have invented, feedback very much welcomed.
Resolves ISV-5342