Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Conversation

puerco
Copy link
Member

@puerco puerco commented Jan 16, 2025

What kind of change does this PR introduce?

Feature

What is the current behavior?

Currently scorecard does not support generating in-toto statements.

What is the new behavior (if this is a feature change)?**

This PR adds support to generate the scorecard output in an in-toto statement. It introduces a new possible value for the format flag: --format=intoto.

The predicate format is open to discussion, right now is just a reformated version of JSONScorecardResultV2 with the repo removed (as it is now in the statement's subject section):

scorecard --format=intoto --checks=Maintained --repo=github.com/protobom/protobom
{
  "type": "https://in-toto.io/Statement/v1",
  "subject": [
    {
      "name": "github.com/protobom/protobom",
      "uri": "git+https://github.com/protobom/protobom@0aa9659c6dc7354c5c60945f44b35bb2ed457857",
      "digest": {
        "gitCommit": "0aa9659c6dc7354c5c60945f44b35bb2ed457857"
      }
    }
  ],
  "predicate_type": "https://scorecard.dev/result/v0.1",
  "predicate": {
    "date": "2025-02-19T11:32:25-06:00",
    "scorecard": {
      "version": "devel",
      "commit": "unknown"
    },
    "score": 10.0,
    "checks": [
      {
        "details": null,
        "score": 10,
        "reason": "30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10",
        "name": "Maintained",
        "documentation": {
          "url": "https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained",
          "short": "Determines if the project is \"actively maintained\"."
        }
      }
    ],
    "metadata": null
  }
}
  • Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

Fixes #3352

Special notes for your reviewer

Let me know if the predicate format should change (or if fields should be added or removed).

/cc @adityasaky as the original author of #3352
/cc @marcelamelara @mlieberman85

Does this PR introduce a user-facing change?

Scorecard can now generate its output as an in-toto statement by specifying --format=intoto 

@puerco puerco requested a review from a team as a code owner January 16, 2025 06:37
@puerco puerco requested review from justaugustus and raghavkaul and removed request for a team January 16, 2025 06:37
@puerco puerco temporarily deployed to integration-test January 16, 2025 06:37 — with GitHub Actions Inactive
Copy link

codecov bot commented Jan 16, 2025

Codecov Report

Attention: Patch coverage is 73.43750% with 17 lines in your changes missing coverage. Please review.

Project coverage is 68.38%. Comparing base (353ed60) to head (64bad6b).
Report is 125 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4491      +/-   ##
==========================================
+ Coverage   66.80%   68.38%   +1.57%     
==========================================
  Files         230      249      +19     
  Lines       16602    18820    +2218     
==========================================
+ Hits        11091    12870    +1779     
- Misses       4808     5097     +289     
- Partials      703      853     +150     

Copy link

@adityasaky adityasaky left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is neat, @puerco!

@puerco
Copy link
Member Author

puerco commented Jan 16, 2025

OK, I've updated the patch with changes addressing the statement suggestions (and updated the example in the PR body)

Copy link
Member

@spencerschrock spencerschrock left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a few trailing comments

Copy link

github-actions bot commented Feb 4, 2025

This pull request has been marked stale because it has been open for 10 days with no activity

@github-actions github-actions bot added Stale and removed Stale labels Feb 4, 2025
@puerco
Copy link
Member Author

puerco commented Feb 17, 2025

Oooh sorry I missed the latest reviews! I'm commenting to dismiss the state warning, but I'll handle the review comments tomorrow morning. Thanks!
'

@puerco
Copy link
Member Author

puerco commented Feb 19, 2025

OK, I've renamed the methods from *Statement to InToto, PTAL!

puerco and others added 3 commits February 28, 2025 12:43
Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
Signed-off-by: Adolfo Garcia Veytia (puerco) <[email protected]>
Signed-off-by: Adolfo Garcia Veytia (puerco) <[email protected]>
This adds the intoto predicate type and the private statement type.

Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
Adds a unit test for the attestation functions

Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
@puerco
Copy link
Member Author

puerco commented Feb 28, 2025

OK, hopefully, this is the final update that is needed. I've renamed the IntotoPredicate and IntotoPredicateType variables as suggested above in a39537c. I've also updated the first commit to pull in the latest intoto/attestaston release.

Copy link
Member

@spencerschrock spencerschrock left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

OK, hopefully, this is the final update that is needed

And thanks for your patience, this pkg/scorecard is the most important API surface for the project as a library, so I wanted to be careful about what was added. And sometimes changes required changes.

@spencerschrock spencerschrock merged commit e8f8465 into ossf:main Mar 3, 2025
38 checks passed
@puerco
Copy link
Member Author

puerco commented Mar 4, 2025

No problem at all, thank you for the thorough review! Happy to get it right :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Done
Development

Successfully merging this pull request may close these issues.

Output Scorecard results as in-toto attestation
4 participants