Skip to content

Commit f506877

Browse files
trumanttrumant
committed
chore: integrate against new version of si-tooling
Signed-off-by: Travis Truman <trumant@gmail.com>
1 parent ea46004 commit f506877

File tree

9 files changed

+77
-82
lines changed

9 files changed

+77
-82
lines changed

‎evaluation_plans/osps/build_release/steps.go‎

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -177,37 +177,37 @@ func releaseHasUniqueIdentifier(payloadData interface{}, _ map[string]*layer4.Ch
177177
func getLinks(data data.Payload) []string {
178178
si := data.Insights
179179
links := []string{
180-
si.Header.URL,
181-
si.Header.ProjectSISource,
182-
si.Project.Homepage,
183-
si.Project.Roadmap,
184-
si.Project.Funding,
185-
si.Project.Documentation.DetailedGuide,
186-
si.Project.Documentation.CodeOfConduct,
187-
si.Project.Documentation.QuickstartGuide,
188-
si.Project.Documentation.ReleaseProcess,
189-
si.Project.Documentation.SignatureVerification,
190-
si.Project.Vulnerability.BugBountyProgram,
191-
si.Project.Vulnerability.SecurityPolicy,
192-
si.Repository.URL,
193-
si.Repository.License.URL,
194-
si.Repository.Security.Assessments.Self.Evidence,
180+
si.Header.URL.String(),
181+
si.Header.ProjectSISource.String(),
182+
si.Project.Homepage.String(),
183+
si.Project.Roadmap.String(),
184+
si.Project.Funding.String(),
185+
si.Project.Documentation.DetailedGuide.String(),
186+
si.Project.Documentation.CodeOfConduct.String(),
187+
si.Project.Documentation.QuickstartGuide.String(),
188+
si.Project.Documentation.ReleaseProcess.String(),
189+
si.Project.Documentation.SignatureVerification.String(),
190+
si.Project.VulnerabilityReporting.BugBountyProgram.String(),
191+
si.Project.VulnerabilityReporting.SecurityPolicy.String(),
192+
si.Repository.Url.String(),
193+
si.Repository.License.Url.String(),
194+
si.Repository.Security.Assessments.Self.Evidence.String(),
195195
}
196196
if data.RepositoryMetadata.OrganizationBlogURL() != nil {
197197
links = append(links, *data.RepositoryMetadata.OrganizationBlogURL())
198198
}
199199
for _, repo := range si.Project.Repositories {
200-
links = append(links, repo.URL)
200+
links = append(links, repo.Url.String())
201201
}
202202

203-
for _, repo := range si.Repository.Security.Assessments.ThirdParty {
204-
links = append(links, repo.Evidence)
203+
for _, repo := range si.Repository.Security.Assessments.ThirdPartyAssessment {
204+
links = append(links, repo.Evidence.String())
205205
}
206206

207207
for _, tool := range si.Repository.Security.Tools {
208-
links = append(links, tool.Results.Adhoc.Location)
209-
links = append(links, tool.Results.CI.Location)
210-
links = append(links, tool.Results.Release.Location)
208+
links = append(links, tool.Results.Adhoc.Location.String())
209+
links = append(links, tool.Results.Ci.Location.String())
210+
links = append(links, tool.Results.Release.Location.String())
211211
}
212212
return links
213213
}
@@ -284,8 +284,8 @@ func distributionPointsUseHTTPS(payloadData interface{}, _ map[string]*layer4.Ch
284284

285285
var badURIs []string
286286
for _, point := range distributionPoints {
287-
if insecureURI(point.URI) {
288-
badURIs = append(badURIs, point.URI)
287+
if insecureURI(point.Uri) {
288+
badURIs = append(badURIs, point.Uri)
289289
}
290290
}
291291
if len(badURIs) > 0 {

‎evaluation_plans/osps/docs/steps.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ func acceptsVulnReports(payloadData interface{}, _ map[string]*layer4.Change) (r
3939
return layer4.Unknown, message
4040
}
4141

42-
if data.Insights.Project.Vulnerability.ReportsAccepted {
42+
if data.Insights.Project.VulnerabilityReporting.ReportsAccepted {
4343
return layer4.Passed, "Repository accepts vulnerability reports"
4444
}
4545

@@ -65,7 +65,7 @@ func hasDependencyManagementPolicy(payloadData interface{}, _ map[string]*layer4
6565
return layer4.Unknown, message
6666
}
6767

68-
if data.Insights.Repository.Documentation.DependencyManagement == "" {
68+
if data.Insights.Repository.Documentation.DependencyManagementPolicy.String() == "" {
6969
return layer4.Failed, "Dependency management policy was NOT specified in Security Insights data"
7070
}
7171

‎evaluation_plans/osps/governance/steps.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ func hasContributionGuide(payloadData interface{}, _ map[string]*layer4.Change)
5050
return layer4.Unknown, message
5151
}
5252

53-
if data.Insights.Project.Documentation.CodeOfConduct != "" && data.Insights.Repository.Documentation.Contributing != "" {
53+
if data.Insights.Project.Documentation.CodeOfConduct != "" && data.Insights.Repository.Documentation.ContributingGuide.String() != "" {
5454
return layer4.Passed, "Contributing guide specified in Security Insights data (Bonus: code of conduct location also specified)"
5555
}
5656

‎evaluation_plans/osps/vuln_management/steps.go‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ func hasSecContact(payloadData interface{}, _ map[string]*layer4.Change) (result
1616

1717
// TODO: Check for a contact email in SECURITY.md
1818

19-
if data.Insights.Project.Vulnerability.Contact.Email != "" {
19+
if data.Insights.Project.VulnerabilityReporting.Contact != nil && data.Insights.Project.VulnerabilityReporting.Contact.Email.String() != "" {
2020
return layer4.Passed, "Security contacts were specified in Security Insights data"
2121
}
2222
for _, champion := range data.Insights.Repository.Security.Champions {
@@ -28,18 +28,17 @@ func hasSecContact(payloadData interface{}, _ map[string]*layer4.Change) (result
2828
return layer4.Failed, "Security contacts were not specified in Security Insights data"
2929
}
3030

31-
3231
func sastToolDefined(payloadData interface{}, _ map[string]*layer4.Change) (result layer4.Result, message string) {
3332
data, message := reusable_steps.VerifyPayload(payloadData)
3433
if message != "" {
3534
return layer4.Unknown, message
3635
}
3736

38-
for _,tool := range data.Insights.Repository.Security.Tools {
37+
for _, tool := range data.Insights.Repository.Security.Tools {
3938
if tool.Type == "SAST" {
40-
41-
enabled := []bool { tool.Integration.Adhoc, tool.Integration.CI, tool.Integration.Release }
42-
39+
40+
enabled := []bool{tool.Integration.Adhoc, tool.Integration.Ci, tool.Integration.Release}
41+
4342
if slices.Contains(enabled, true) {
4443
return layer4.Passed, "Static Application Security Testing documented in Security Insights"
4544
}

‎evaluation_plans/osps/vuln_management/steps_test.go‎

Lines changed: 25 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -10,24 +10,23 @@ import (
1010
)
1111

1212
type testingData struct {
13-
expectedResult layer4.Result
14-
expectedMessage string
15-
payloadData interface{}
13+
expectedResult layer4.Result
14+
expectedMessage string
15+
payloadData interface{}
1616
assertionMessage string
1717
}
1818

19-
2019
func TestSastToolDefined(t *testing.T) {
21-
20+
2221
testData := []testingData{
2322
{
24-
expectedResult: layer4.Passed,
25-
expectedMessage: "Static Application Security Testing documented in Security Insights",
23+
expectedResult: layer4.Passed,
24+
expectedMessage: "Static Application Security Testing documented in Security Insights",
2625
assertionMessage: "Test for SAST integration enabled",
27-
payloadData: data.Payload{
28-
RestData: &data.RestData {
26+
payloadData: data.Payload{
27+
RestData: &data.RestData{
2928
Insights: si.SecurityInsights{
30-
Repository: si.Repository{
29+
Repository: &si.Repository{
3130
Security: si.SecurityInfo{
3231
Tools: []si.Tool{
3332
{
@@ -42,14 +41,13 @@ func TestSastToolDefined(t *testing.T) {
4241
},
4342
},
4443
},
45-
4644
},
4745
{
48-
expectedResult: layer4.Failed,
49-
expectedMessage: "No Static Application Security Testing documented in Security Insights",
46+
expectedResult: layer4.Failed,
47+
expectedMessage: "No Static Application Security Testing documented in Security Insights",
5048
assertionMessage: "Test for SAST integration present but not explicitly enabled",
51-
payloadData: data.Payload{
52-
RestData: &data.RestData {
49+
payloadData: data.Payload{
50+
RestData: &data.RestData{
5351
Insights: si.SecurityInsights{
5452
Repository: si.Repository{
5553
Security: si.SecurityInfo{
@@ -63,14 +61,13 @@ func TestSastToolDefined(t *testing.T) {
6361
},
6462
},
6563
},
66-
6764
},
6865
{
69-
expectedResult: layer4.Failed,
70-
expectedMessage: "No Static Application Security Testing documented in Security Insights",
66+
expectedResult: layer4.Failed,
67+
expectedMessage: "No Static Application Security Testing documented in Security Insights",
7168
assertionMessage: "Test for Non SAST tool defined",
72-
payloadData: data.Payload{
73-
RestData: &data.RestData {
69+
payloadData: data.Payload{
70+
RestData: &data.RestData{
7471
Insights: si.SecurityInsights{
7572
Repository: si.Repository{
7673
Security: si.SecurityInfo{
@@ -84,31 +81,28 @@ func TestSastToolDefined(t *testing.T) {
8481
},
8582
},
8683
},
87-
8884
},
8985
{
90-
expectedResult: layer4.Failed,
91-
expectedMessage: "No Static Application Security Testing documented in Security Insights",
86+
expectedResult: layer4.Failed,
87+
expectedMessage: "No Static Application Security Testing documented in Security Insights",
9288
assertionMessage: "Test for no tools defined",
93-
payloadData: data.Payload{
94-
RestData: &data.RestData {
89+
payloadData: data.Payload{
90+
RestData: &data.RestData{
9591
Insights: si.SecurityInsights{
9692
Repository: si.Repository{
97-
Security: si.SecurityInfo{
98-
},
93+
Security: si.SecurityInfo{},
9994
},
10095
},
10196
},
10297
},
103-
10498
},
10599
}
106-
100+
107101
for _, test := range testData {
108102
result, message := sastToolDefined(test.payloadData, nil)
109103

110104
assert.Equal(t, test.expectedResult, result, test.assertionMessage)
111105
assert.Equal(t, test.expectedMessage, message, test.assertionMessage)
112106
}
113-
114-
}
107+
108+
}

‎evaluation_plans/reusable_steps/evaluations.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ func HasDependencyManagementPolicy(payloadData interface{}, _ map[string]*layer4
9898
return layer4.Unknown, message
9999
}
100100

101-
if len(payload.Insights.Repository.Documentation.DependencyManagement) > 0 {
101+
if len(payload.Insights.Repository.Documentation.DependencyManagementPolicy) > 0 {
102102
return layer4.Passed, "Found dependency management policy in documentation"
103103
}
104104

‎evaluation_plans/reusable_steps/evaluations_test.go‎

Lines changed: 14 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,9 @@ import (
1010
)
1111

1212
type testingData struct {
13-
expectedResult layer4.Result
14-
expectedMessage string
15-
payloadData interface{}
13+
expectedResult layer4.Result
14+
expectedMessage string
15+
payloadData interface{}
1616
assertionMessage string
1717
}
1818

@@ -21,12 +21,12 @@ func TestHasDependencyManagementPolicySomethin(t *testing.T) {
2121
//Ick, remind me to never use anonymous structs in my code
2222
testData := []testingData{
2323
{
24-
expectedResult: layer4.Passed,
24+
expectedResult: layer4.Passed,
2525
expectedMessage: "Found dependency management policy in documentation",
26-
payloadData: data.Payload{
27-
RestData: &data.RestData {
26+
payloadData: data.Payload{
27+
RestData: &data.RestData{
2828
Insights: si.SecurityInsights{
29-
Repository: si.Repository{
29+
Repository: &si.Repository{
3030
Documentation: struct {
3131
Contributing string `yaml:"contributing-guide"`
3232
DependencyManagement string `yaml:"dependency-management-policy"`
@@ -43,10 +43,10 @@ func TestHasDependencyManagementPolicySomethin(t *testing.T) {
4343
assertionMessage: "Happy Path failed",
4444
},
4545
{
46-
expectedResult: layer4.Failed,
46+
expectedResult: layer4.Failed,
4747
expectedMessage: "No dependency management file found",
48-
payloadData: data.Payload{
49-
RestData: &data.RestData {
48+
payloadData: data.Payload{
49+
RestData: &data.RestData{
5050
Insights: si.SecurityInsights{
5151
Repository: si.Repository{
5252
Documentation: struct {
@@ -65,10 +65,10 @@ func TestHasDependencyManagementPolicySomethin(t *testing.T) {
6565
assertionMessage: "Empty string check failed",
6666
},
6767
{
68-
expectedResult: layer4.Failed,
68+
expectedResult: layer4.Failed,
6969
expectedMessage: "No dependency management file found",
70-
payloadData: data.Payload{
71-
RestData: &data.RestData {
70+
payloadData: data.Payload{
71+
RestData: &data.RestData{
7272
Insights: si.SecurityInsights{
7373
Repository: si.Repository{
7474
Documentation: struct {
@@ -94,5 +94,4 @@ func TestHasDependencyManagementPolicySomethin(t *testing.T) {
9494
assert.Equal(t, test.expectedMessage, message, test.assertionMessage)
9595
}
9696

97-
98-
}
97+
}

‎go.mod‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ go 1.23.4
44

55
require (
66
github.com/google/go-github/v71 v71.0.0
7-
github.com/ossf/si-tooling/v2 v2.0.5-0.20250328034800-657dc9aa9920
7+
github.com/ossf/si-tooling/v2 v2.0.4
88
github.com/privateerproj/privateer-sdk v1.2.0
99
github.com/revanite-io/sci v0.3.4
1010
github.com/rhysd/actionlint v1.7.7
@@ -15,6 +15,7 @@ require (
1515
require (
1616
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
1717
github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
18+
github.com/goccy/go-yaml v1.17.1 // indirect
1819
github.com/google/go-querystring v1.1.0 // indirect
1920
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
2021
)
@@ -62,3 +63,5 @@ require (
6263
// replace github.com/privateerproj/privateer-sdk => ../../privateerproj/privateer-sdk
6364

6465
// replace github.com/revanite-io/sci => ../sci
66+
67+
replace github.com/ossf/si-tooling/v2 => ../si-tooling/v2

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@ github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
2020
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
2121
github.com/go-viper/mapstructure/v2 v2.2.1 h1:ZAaOCxANMuZx5RCeg0mBdEZk7DZasvvZIxtHqx8aGss=
2222
github.com/go-viper/mapstructure/v2 v2.2.1/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
23+
github.com/goccy/go-yaml v1.17.1 h1:LI34wktB2xEE3ONG/2Ar54+/HJVBriAGJ55PHls4YuY=
24+
github.com/goccy/go-yaml v1.17.1/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
2325
github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
2426
github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
2527
github.com/gomarkdown/markdown v0.0.0-20250311123330-531bef5e742b h1:EY/KpStFl60qA17CptGXhwfZ+k1sFNJIUNR8DdbcuUk=
@@ -61,8 +63,6 @@ github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebG
6163
github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
6264
github.com/oklog/run v1.1.0 h1:GEenZ1cK0+q0+wsJew9qUg/DyD8k3JzYsZAi5gYi2mA=
6365
github.com/oklog/run v1.1.0/go.mod h1:sVPdnTZT1zYwAJeCMu2Th4T21pA3FPOQRfWjQlk7DVU=
64-
github.com/ossf/si-tooling/v2 v2.0.5-0.20250328034800-657dc9aa9920 h1:iT96I36tXMHMPcSvxLtfi6970MAEK3xlDMZGSxuhJLA=
65-
github.com/ossf/si-tooling/v2 v2.0.5-0.20250328034800-657dc9aa9920/go.mod h1:LVl8Dz/65RjijQHXDxgfHn1h19nRNckswUDMjBB/pWY=
6666
github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
6767
github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc=
6868
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=

0 commit comments

Comments
 (0)