Fixes to annotations

cmarulas · cmarulas · commit 27fe61d7b351 · 2026-04-15T18:14:08.000+02:00
Add solution to deny_unpermitted_urls rule
Move custom collections to rules from package
and some minor cleanups.
diff --git a/antora/docs/modules/ROOT/pages/packages/release_maven_repos.adoc b/antora/docs/modules/ROOT/pages/packages/release_maven_repos.adoc
@@ -13,11 +13,13 @@ Each Maven package listed in an SBOM must specify the repository URL that it com
 
 Each Maven package listed in an SBOM must specify the repository URL that it comes from, and that URL must be present in the list of known and permitted Maven repositories. If no URL is specified, the package is assumed to come from Maven Central.
 
+*Solution*: The Maven artifact originates from an untrusted or unpermitted repository. To resolve this, ensure the dependency is sourced from a repository defined in the 'allowed_maven_repositories' list in your policy configuration. If the repository is internal, add its URL to the allowed list in rule_data.
+
 * Rule type: [rule-type-indicator failure]#FAILURE#
 * FAILURE message: `%s`
 * Code: `maven_repos.deny_unpermitted_urls`
 * Effective from: `2026-05-10T00:00:00Z`
-* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/maven_repos/maven_repos.rego#L41[Source, window="_blank"]
+* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/maven_repos/maven_repos.rego#L36[Source, window="_blank"]
 
 [#maven_repos__policy_data_missing]
 === link:#maven_repos__policy_data_missing[Policy data validation]
@@ -29,4 +31,4 @@ Ensures the required allowed_maven_repositories list is provided.
 * Rule type: [rule-type-indicator failure]#FAILURE#
 * FAILURE message: `Policy data is missing the required "%s" list`
 * Code: `maven_repos.policy_data_missing`
-* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/maven_repos/maven_repos.rego#L23[Source, window="_blank"]
+* https://github.com/conforma/policy/blob/{page-origin-refhash}/policy/release/maven_repos/maven_repos.rego#L17[Source, window="_blank"]
diff --git a/antora/docs/modules/ROOT/pages/release_policy.adoc b/antora/docs/modules/ROOT/pages/release_policy.adoc
@@ -105,7 +105,7 @@ a| Include the set of policy rules required for Red Hat products.
 
 Rules included:
         
-* xref:packages/release_maven_repos.adoc#maven_repos_package[All maven artifacts have known repository URLs: All maven artifacts have known repository URLs]        
+* xref:packages/release_maven_repos.adoc#maven_repos__policy_data_missing[All maven artifacts have known repository URLs: Policy data validation]        
 * xref:packages/release_attestation_type.adoc#attestation_type__deprecated_policy_attestation_format[Attestation type: Deprecated policy attestation format]        
 * xref:packages/release_attestation_type.adoc#attestation_type__known_attestation_type[Attestation type: Known attestation type found]        
 * xref:packages/release_attestation_type.adoc#attestation_type__known_attestation_types_provided[Attestation type: Known attestation types provided]        
@@ -243,7 +243,8 @@ a| Ruleset for validating artifacts built via Red Hat Maven repositories.
 
 Rules included:
         
-* xref:packages/release_maven_repos.adoc#maven_repos_package[All maven artifacts have known repository URLs: All maven artifacts have known repository URLs]
+* xref:packages/release_maven_repos.adoc#maven_repos__deny_unpermitted_urls[All maven artifacts have known repository URLs: Known Repository URLs]        
+* xref:packages/release_maven_repos.adoc#maven_repos__policy_data_missing[All maven artifacts have known repository URLs: Policy data validation]
 
 | [#redhat_rpms]`redhat_rpms`
 a| Include the set of policy rules required for building Red Hat RPMs.
diff --git a/policy/lib/sbom/maven_test.rego b/policy/lib/sbom/maven_test.rego
@@ -2,8 +2,6 @@ package lib.sbom_test
 
 import data.lib
 import data.lib.sbom
-import future.keywords.if
-import future.keywords.in
 
 test_cyclonedx_maven_extraction if {
 	mock_components := [{
diff --git a/policy/release/maven_repos/maven_repos.rego b/policy/release/maven_repos/maven_repos.rego
@@ -5,18 +5,12 @@
 #   comes from, and that URL must be present in the list of known and permitted
 #   Maven repositories. If no URL is specified, the package is assumed to come
 #   from Maven Central.
-# custom:
-#   collections:
-#   - redhat
-#   - redhat_maven
-#
 package release.maven_repos
 
-import future.keywords.contains
-import future.keywords.if
-import future.keywords.in
+import rego.v1
 
 import data.lib
+import data.lib.metadata
 import data.lib.rule_data
 import data.lib.sbom
 
@@ -31,8 +25,9 @@ import data.lib.sbom
 #     provided to the policy, and that it contains a list of authorized
 #     repository URLs.
 #   collections:
+#     - redhat
+#     - redhat_maven
 #     - policy_data
-#   severity: failure
 deny contains result if {
 	some key in _rule_data_errors
 	result := lib.result_helper(rego.metadata.chain(), [key])
@@ -45,15 +40,20 @@ deny contains result if {
 #   comes from, and that URL must be present in the list of known and permitted
 #   Maven repositories. If no URL is specified, the package is assumed to come
 #   from Maven Central.
-# scope: rule
 # custom:
 #    short_name: deny_unpermitted_urls
 #    failure_msg: '%s'
+#    solution: >-
+#      The Maven artifact originates from an untrusted or unpermitted repository.
+#      To resolve this, ensure the dependency is sourced from a repository defined
+#      in the 'allowed_maven_repositories' list in your policy configuration.
+#      If the repository is internal, add its URL to the allowed list in rule_data.
 #    effective_on: 2026-05-10T00:00:00Z
+#    collections:
+#      - redhat_maven
 deny contains result if {
 	some err in _repo_url_errors
-	base := lib.result_helper(rego.metadata.chain(), [err.msg])
-	result := object.union(base, {"term": err.purl})
+	result := metadata.result_helper_with_term(rego.metadata.chain(), [err.msg], err.purl)
 }
 
 _repo_url_errors contains err if {
diff --git a/policy/release/maven_repos/maven_repos_test.rego b/policy/release/maven_repos/maven_repos_test.rego
@@ -1,9 +1,8 @@
 package release.maven_repos_test
 
-import data.lib
+import data.lib.assertions
 import data.lib.sbom
 import data.release.maven_repos
-import future.keywords.if
 
 mock_data := {"allowed_maven_repositories": [
 	"https://repo.maven.apache.org/maven2/",
@@ -17,7 +16,7 @@ test_cyclonedx_permitted if {
 		"externalRefs": [{"type": "distribution", "url": "https://repo.maven.apache.org/maven2/"}],
 	}]}
 
-	lib.assertions.assert_empty(maven_repos.deny) with data.rule_data as mock_data
+	assertions.assert_empty(maven_repos.deny) with data.rule_data as mock_data
 		with sbom.cyclonedx_sboms as [cdx_input]
 }
 
@@ -31,7 +30,7 @@ test_spdx_permitted if {
 		}],
 	}]}
 
-	lib.assertions.assert_empty(maven_repos.deny) with data.rule_data as mock_data
+	assertions.assert_empty(maven_repos.deny) with data.rule_data as mock_data
 		with sbom.spdx_sboms as [spdx_input]
 }
 
@@ -42,7 +41,7 @@ test_default_maven_central_pass if {
 		"externalRefs": [],
 	}]}
 
-	lib.assertions.assert_empty(maven_repos.deny) with data.rule_data as mock_data
+	assertions.assert_empty(maven_repos.deny) with data.rule_data as mock_data
 		with sbom.cyclonedx_sboms as [cdx_input]
 }
 
@@ -63,11 +62,12 @@ test_default_cdx_fail if {
 	expected := {{
 		"code": "release.maven_repos.deny_unpermitted_urls",
 		"msg": expected_msg,
+		"collections": ["redhat_maven"],
 		"effective_on": "2026-05-10T00:00:00Z",
 		"term": "pkg:maven/org.base/no-url@1.0",
 	}}
 
-	lib.assertions.assert_equal(maven_repos.deny, expected) with data.rule_data as restricted_data
+	assertions.assert_equal(maven_repos.deny, expected) with data.rule_data as restricted_data
 		with sbom.cyclonedx_sboms as [mock_cdx]
 }
 
@@ -86,11 +86,11 @@ test_spdx_default_fail if {
 test_missing_rule_data if {
 	expected := {{
 		"code": "release.maven_repos.policy_data_missing",
-		"collections": ["policy_data"],
+		"collections": ["redhat", "redhat_maven", "policy_data"],
 		"effective_on": "2022-01-01T00:00:00Z",
 		"msg": "Policy data is missing the required \"allowed_maven_repositories\" list",
 	}}
-	lib.assertions.assert_equal(maven_repos.deny, expected) with data.rule_data as {}
+	assertions.assert_equal(maven_repos.deny, expected) with data.rule_data as {}
 }
 
 test_get_effective_url_provided if {
@@ -170,12 +170,14 @@ test_repo_url_errors_collision_from_mixed_sources if {
 		{
 			"code": "release.maven_repos.deny_unpermitted_urls",
 			"effective_on": "2026-05-10T00:00:00Z",
+			"collections": ["redhat_maven"],
 			"msg": "Package \"pkg:maven/org.example/shared@1.0\" (source: \"https://untrusted-cdx.com\") is not in the permitted list",
 			"term": "pkg:maven/org.example/shared@1.0",
 		},
 		{
 			"code": "release.maven_repos.deny_unpermitted_urls",
 			"effective_on": "2026-05-10T00:00:00Z",
+			"collections": ["redhat_maven"],
 			"msg": "Package \"pkg:maven/org.example/shared@1.0\" (source: \"https://untrusted-spdx.com\") is not in the permitted list",
 			"term": "pkg:maven/org.example/shared@1.0",
 		},
@@ -185,7 +187,7 @@ test_repo_url_errors_collision_from_mixed_sources if {
 		with sbom.spdx_sboms as [mock_spdx]
 		with data.rule_data as mock_data
 
-	lib.assertions.assert_equal(expected, result)
+	assertions.assert_equal(expected, result)
 }
 
 test_repo_url_errors_mixed_permitted_and_unpermitted if {
@@ -204,6 +206,7 @@ test_repo_url_errors_mixed_permitted_and_unpermitted if {
 	expected := {{
 		"code": "release.maven_repos.deny_unpermitted_urls",
 		"effective_on": "2026-05-10T00:00:00Z",
+		"collections": ["redhat_maven"],
 		"msg": "Package \"pkg:maven/org.example/shared@1.0\" (source: \"https://untrusted-spdx.com\") is not in the permitted list",
 		"term": "pkg:maven/org.example/shared@1.0",
 	}}
@@ -212,5 +215,5 @@ test_repo_url_errors_mixed_permitted_and_unpermitted if {
 		with sbom.spdx_sboms as [mock_spdx]
 		with data.rule_data as mock_data
 
-	lib.assertions.assert_equal(expected, result)
+	assertions.assert_equal(expected, result)
 }
