Update for policy checks

Author: ChronosMasterOfAllTime

.goenv-policy.yaml

@@ -0,0 +1,86 @@
+# yaml-language-server: $schema=./schemas/policy-schema.json
+# goenv SBOM Policy Configuration
+# Version: 1.0
+# Description: Example policy for validating Go project SBOMs
+
+version: "1"
+
+# Policy options
+options:
+  fail_on_error: true
+  fail_on_warning: false
+  verbose: false
+
+# Validation rules
+rules:
+  # Supply Chain Security Rules
+  - name: no-local-replaces
+    type: supply-chain
+    severity: error
+    description: Prevent local path replace directives that bypass checksum verification
+    check: replace-directives
+    blocked:
+      - local-path
+
+  - name: no-vendoring
+    type: supply-chain
+    severity: warning
+    description: Discourage vendored dependencies (optional - adjust per org policy)
+    check: vendoring-status
+    blocked:
+      - vendored
+
+  # Security Rules
+  - name: block-retracted-versions
+    type: security
+    severity: error
+    description: Prevent use of retracted module versions
+    check: retracted-versions
+
+  - name: require-cgo-disabled
+    type: security
+    severity: warning
+    description: Recommend disabling CGO for reduced attack surface
+    check: cgo-disabled
+    required:
+      - "false"
+
+  # Completeness Rules
+  - name: require-stdlib-component
+    type: completeness
+    severity: warning
+    description: Ensure standard library component is included in SBOM
+    check: required-components
+    required:
+      - golang-stdlib
+
+  - name: require-goenv-metadata
+    type: completeness
+    severity: info
+    description: Ensure Go-aware metadata is present
+    check: required-metadata
+    required:
+      - goenv:go_version
+      - goenv:platform
+      - goenv:build_context.goos
+      - goenv:build_context.goarch
+
+  # License Compliance Rules
+  - name: block-gpl-licenses
+    type: license
+    severity: error
+    description: Block copyleft licenses (adjust per org policy)
+    check: license-compliance
+    blocked:
+      - GPL-2.0
+      - GPL-3.0
+      - AGPL-3.0
+
+  - name: warn-lgpl-licenses
+    type: license
+    severity: warning
+    description: Warn on LGPL licenses requiring disclosure
+    check: license-compliance
+    blocked:
+      - LGPL-2.1
+      - LGPL-3.0

.vscode/settings.json

@@ -3,5 +3,18 @@
   "makefile.configureOnOpen": false,
   "go.toolsGopath": "${env:HOME}/go/tools",
   "go.goroot": "${env:HOME}/.goenv/versions/1.23.2",
-  "go.gopath": "${env:HOME}/go/1.23.2"
+  "go.gopath": "${env:HOME}/go/1.23.2",
+  "yaml.schemas": {
+    "https://json.schemastore.org/github-workflow.json": ".github/workflows/*.yml",
+    "https://json.schemastore.org/github-action.json": ".github/actions/*/action.yml"
+  },
+  "yaml.customTags": [
+    "!Policy scalar"
+  ],
+  "yaml.validate": true,
+  "files.associations": {
+    "*-policy.yaml": "yaml",
+    ".goenv-policy.yaml": "yaml",
+    "examples/policies/*.yaml": "yaml"
+  }
 }

cmd/compliance/sbom.go

@@ -104,6 +104,7 @@ func init() {
 	sbomCmd.AddCommand(sbomProjectCmd)
 	sbomCmd.AddCommand(sbomHashCmd)
 	sbomCmd.AddCommand(sbomVerifyCmd)
+	sbomCmd.AddCommand(sbomValidateCmd)
 	cmdpkg.RootCmd.AddCommand(sbomCmd)
 }
 
@@ -152,14 +153,44 @@ Examples:
 	RunE: runSBOMVerify,
 }
 
+var sbomValidateCmd = &cobra.Command{
+	Use:   "validate <sbom-file>",
+	Short: "Validate SBOM against policy rules",
+	Long: `Validate an SBOM file against defined policy rules.
+
+Policy files are YAML documents that define validation rules for:
+- Supply chain security (replace directives, vendoring)
+- Security requirements (CGO status, retracted versions)
+- Completeness checks (required components, metadata)
+- License compliance (allowed/blocked licenses)
+
+Examples:
+  # Validate with default policy
+  goenv sbom validate sbom.json --policy=.goenv-policy.yaml
+
+  # Validate and fail on warnings
+  goenv sbom validate sbom.json --policy=policy.yaml --fail-on-warning
+
+  # Validate with verbose output
+  goenv sbom validate sbom.json --policy=policy.yaml --verbose`,
+	Args: cobra.ExactArgs(1),
+	RunE: runSBOMValidate,
+}
+
 var (
-	hashAlgorithm string
-	verifyDiff    bool
+	hashAlgorithm   string
+	verifyDiff      bool
+	policyFile      string
+	failOnWarning   bool
+	verboseValidate bool
 )
 
 func init() {
 	sbomHashCmd.Flags().StringVar(&hashAlgorithm, "algorithm", "sha256", "Hash algorithm (sha256, sha512)")
 	sbomVerifyCmd.Flags().BoolVar(&verifyDiff, "diff", false, "Show detailed differences if SBOMs don't match")
+	sbomValidateCmd.Flags().StringVarP(&policyFile, "policy", "p", ".goenv-policy.yaml", "Path to policy configuration file")
+	sbomValidateCmd.Flags().BoolVar(&failOnWarning, "fail-on-warning", false, "Treat warnings as failures")
+	sbomValidateCmd.Flags().BoolVar(&verboseValidate, "verbose", false, "Show detailed validation output")
 }
 
 func runSBOMHash(cmd *cobra.Command, args []string) error {
@@ -223,6 +254,91 @@ func runSBOMVerify(cmd *cobra.Command, args []string) error {
 	return fmt.Errorf("SBOMs are not reproducibly identical")
 }
 
+func runSBOMValidate(cmd *cobra.Command, args []string) error {
+	sbomPath := args[0]
+
+	// Verify SBOM file exists
+	if !utils.FileExists(sbomPath) {
+		return fmt.Errorf("SBOM file not found: %s", sbomPath)
+	}
+
+	// Verify policy file exists
+	if !utils.FileExists(policyFile) {
+		return fmt.Errorf("policy file not found: %s (use --policy to specify)", policyFile)
+	}
+
+	cfg, _ := cmdutil.SetupContext()
+
+	// Load policy engine
+	engine, err := sbom.NewPolicyEngine(policyFile)
+	if err != nil {
+		return errors.FailedTo("load policy", err)
+	}
+
+	if cfg.Debug || verboseValidate {
+		fmt.Fprintf(cmd.ErrOrStderr(), "goenv: Validating %s against policy %s\n", sbomPath, policyFile)
+	}
+
+	// Run validation
+	result, err := engine.Validate(sbomPath)
+	if err != nil {
+		return errors.FailedTo("validate SBOM", err)
+	}
+
+	// Output results
+	if verboseValidate {
+		fmt.Fprint(cmd.OutOrStdout(), result.Summary)
+
+		// Show detailed violations
+		if len(result.Violations) > 0 {
+			fmt.Fprintf(cmd.OutOrStdout(), "\nViolations:\n")
+			for i, v := range result.Violations {
+				fmt.Fprintf(cmd.OutOrStdout(), "\n%d. %s\n", i+1, v.Rule)
+				fmt.Fprintf(cmd.OutOrStdout(), "   Severity: %s\n", v.Severity)
+				fmt.Fprintf(cmd.OutOrStdout(), "   Component: %s\n", v.Component)
+				fmt.Fprintf(cmd.OutOrStdout(), "   Message: %s\n", v.Message)
+				if v.Remediation != "" {
+					fmt.Fprintf(cmd.OutOrStdout(), "   Remediation: %s\n", v.Remediation)
+				}
+			}
+		}
+
+		if len(result.Warnings) > 0 {
+			fmt.Fprintf(cmd.OutOrStdout(), "\nWarnings:\n")
+			for i, w := range result.Warnings {
+				fmt.Fprintf(cmd.OutOrStdout(), "\n%d. %s\n", i+1, w.Rule)
+				fmt.Fprintf(cmd.OutOrStdout(), "   Severity: %s\n", w.Severity)
+				fmt.Fprintf(cmd.OutOrStdout(), "   Component: %s\n", w.Component)
+				fmt.Fprintf(cmd.OutOrStdout(), "   Message: %s\n", w.Message)
+				if w.Remediation != "" {
+					fmt.Fprintf(cmd.OutOrStdout(), "   Remediation: %s\n", w.Remediation)
+				}
+			}
+		}
+	} else {
+		// Concise output
+		if result.Passed {
+			fmt.Fprintf(cmd.OutOrStdout(), "✓ SBOM validation passed\n")
+		} else {
+			fmt.Fprintf(cmd.ErrOrStderr(), "✗ SBOM validation failed\n")
+			fmt.Fprintf(cmd.ErrOrStderr(), "  %d violations, %d warnings\n",
+				len(result.Violations), len(result.Warnings))
+			fmt.Fprintf(cmd.ErrOrStderr(), "  Run with --verbose for details\n")
+		}
+	}
+
+	// Return error if validation failed
+	if !result.Passed {
+		if failOnWarning && len(result.Warnings) > 0 {
+			return fmt.Errorf("validation failed with %d violations and %d warnings",
+				len(result.Violations), len(result.Warnings))
+		}
+		return fmt.Errorf("validation failed with %d violations", len(result.Violations))
+	}
+
+	return nil
+}
+
 func runSBOMProject(cmd *cobra.Command, args []string) error {
 	cfg, mgr := cmdutil.SetupContext()