Skip to content

Commit 6eb4999

Browse files
mihaimaruseacmihaimaruseac
authored
Split CertifyScorecard, separating subject from object. (#502)
* Remove `mutation.gql` as it is included in `packages.gql` Signed-off-by: Mihai Maruseac <[email protected]> * Fix some empty lines Signed-off-by: Mihai Maruseac <[email protected]> * Separate backend interface functions Signed-off-by: Mihai Maruseac <[email protected]> * Use `scorecards` for the query instead of `CertifyScorecard` Since `CertifyScorecard` is a verb, using it for mutation instead. While here, also fix formatting, naming (start lowercase as that's the GraphQL convention), comments. Includes the generated code too, to ensure that code still builds. Signed-off-by: Mihai Maruseac <[email protected]> * Split `CertifyScorecard`, separating subject from object. This is because the ingestion will require these to be separate, creating the object only when certification exists. For now, I did not do the same split for the input spec, but it should be doable if we want a consistent interface, though it will make the query JSON nest one extra level. Signed-off-by: Mihai Maruseac <[email protected]> * Fix format Signed-off-by: Mihai Maruseac <[email protected]> --------- Signed-off-by: Mihai Maruseac <[email protected]>
1 parent 8c91af9 commit 6eb4999

File tree

11 files changed

+414
-288
lines changed

11 files changed

+414
-288
lines changed

‎pkg/assembler/backends/backends.go‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,35 +25,39 @@ import (
2525
// GraphQL interface. All backends must implement all queries specified by the
2626
// GraphQL interface and this is enforced by this interface.
2727
type Backend interface {
28-
// Retrieval read-only queries
28+
// Retrieval read-only queries for software trees
2929
Packages(ctx context.Context, pkgSpec *model.PkgSpec) ([]*model.Package, error)
3030
Sources(ctx context.Context, sourceSpec *model.SourceSpec) ([]*model.Source, error)
3131
Cve(ctx context.Context, cveSpec *model.CVESpec) ([]*model.Cve, error)
3232
Ghsa(ctx context.Context, ghsaSpec *model.GHSASpec) ([]*model.Ghsa, error)
3333
Osv(ctx context.Context, osvSpec *model.OSVSpec) ([]*model.Osv, error)
3434
Artifacts(ctx context.Context, artifactSpec *model.ArtifactSpec) ([]*model.Artifact, error)
3535
Builders(ctx context.Context, builderSpec *model.BuilderSpec) ([]*model.Builder, error)
36+
37+
// Retrieval read-only queries for evidence trees
3638
HashEqual(ctx context.Context, hashEqualSpec *model.HashEqualSpec) ([]*model.HashEqual, error)
3739
IsOccurrence(ctx context.Context, isOccurrenceSpec *model.IsOccurrenceSpec) ([]*model.IsOccurrence, error)
3840
HasSBOM(ctx context.Context, hasSBOMSpec *model.HasSBOMSpec) ([]*model.HasSbom, error)
3941
IsDependency(ctx context.Context, isDependencySpec *model.IsDependencySpec) ([]*model.IsDependency, error)
4042
CertifyPkg(ctx context.Context, certifyPkgSpec *model.CertifyPkgSpec) ([]*model.CertifyPkg, error)
4143
HasSourceAt(ctx context.Context, hasSourceAtSpec *model.HasSourceAtSpec) ([]*model.HasSourceAt, error)
4244
CertifyBad(ctx context.Context, certifyBadSpec *model.CertifyBadSpec) ([]*model.CertifyBad, error)
43-
CertifyScorecard(ctx context.Context, certifyScorecardSpec *model.CertifyScorecardSpec) ([]*model.CertifyScorecard, error)
45+
Scorecards(ctx context.Context, certifyScorecardSpec *model.CertifyScorecardSpec) ([]*model.CertifyScorecard, error)
4446
CertifyVuln(ctx context.Context, certifyVulnSpec *model.CertifyVulnSpec) ([]*model.CertifyVuln, error)
4547
IsVulnerability(ctx context.Context, isVulnerabilitySpec *model.IsVulnerabilitySpec) ([]*model.IsVulnerability, error)
4648
CertifyVEXStatement(ctx context.Context, certifyVEXStatementSpec *model.CertifyVEXStatementSpec) ([]*model.CertifyVEXStatement, error)
4749
HasSlsa(ctx context.Context, hasSLSASpec *model.HasSLSASpec) ([]*model.HasSlsa, error)
4850

49-
// Mutations (read-write queries)
51+
// Mutations for software trees (read-write queries)
5052
IngestPackage(ctx context.Context, pkg *model.PkgInputSpec) (*model.Package, error)
5153
IngestSource(ctx context.Context, source *model.SourceInputSpec) (*model.Source, error)
5254
IngestArtifact(ctx context.Context, artifact *model.ArtifactInputSpec) (*model.Artifact, error)
5355
IngestBuilder(ctx context.Context, builder *model.BuilderInputSpec) (*model.Builder, error)
5456
IngestCve(ctx context.Context, cve *model.CVEInputSpec) (*model.Cve, error)
5557
IngestGhsa(ctx context.Context, ghsa *model.GHSAInputSpec) (*model.Ghsa, error)
5658
IngestOsv(ctx context.Context, osv *model.OSVInputSpec) (*model.Osv, error)
59+
60+
// Mutations for evidence trees (read-write queries, assume software trees ingested)
5761
}
5862

5963
// BackendArgs interface allows each backend to specify the arguments needed to

‎pkg/assembler/backends/neo4j/certifyScorecard.go‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,7 @@ const (
3535
scorecardCommit string = "scorecardCommit"
3636
)
3737

38-
func (c *neo4jClient) CertifyScorecard(ctx context.Context, certifyScorecardSpec *model.CertifyScorecardSpec) ([]*model.CertifyScorecard, error) {
39-
38+
func (c *neo4jClient) Scorecards(ctx context.Context, certifyScorecardSpec *model.CertifyScorecardSpec) ([]*model.CertifyScorecard, error) {
4039
session := c.driver.NewSession(neo4j.SessionConfig{AccessMode: neo4j.AccessModeRead})
4140
defer session.Close()
4241

@@ -54,7 +53,6 @@ func (c *neo4jClient) CertifyScorecard(ctx context.Context, certifyScorecardSpec
5453

5554
result, err := session.ReadTransaction(
5655
func(tx neo4j.Transaction) (interface{}, error) {
57-
5856
result, err := tx.Run(sb.String(), queryValues)
5957
if err != nil {
6058
return nil, err
@@ -67,10 +65,12 @@ func (c *neo4jClient) CertifyScorecard(ctx context.Context, certifyScorecardSpec
6765
if result.Record().Values[4] != nil {
6866
commitString = result.Record().Values[4].(string)
6967
}
68+
7069
tagString := ""
7170
if result.Record().Values[3] != nil {
7271
tagString = result.Record().Values[3].(string)
7372
}
73+
7474
nameString := result.Record().Values[2].(string)
7575
namespaceString := result.Record().Values[1].(string)
7676
typeString := result.Record().Values[0].(string)
@@ -85,10 +85,12 @@ func (c *neo4jClient) CertifyScorecard(ctx context.Context, certifyScorecardSpec
8585
Namespace: namespaceString,
8686
Names: []*model.SourceName{srcName},
8787
}
88+
8889
src := model.Source{
8990
Type: typeString,
9091
Namespaces: []*model.SourceNamespace{srcNamespace},
9192
}
93+
9294
certifyScorecardNode := dbtype.Node{}
9395
if result.Record().Values[5] != nil {
9496
certifyScorecardNode = result.Record().Values[5].(dbtype.Node)
@@ -100,8 +102,8 @@ func (c *neo4jClient) CertifyScorecard(ctx context.Context, certifyScorecardSpec
100102
if err != nil {
101103
return nil, err
102104
}
103-
certifyScorecard := &model.CertifyScorecard{
104-
Source: &src,
105+
106+
scorecard := model.Scorecard{
105107
TimeScanned: certifyScorecardNode.Props[timeScanned].(string),
106108
AggregateScore: certifyScorecardNode.Props[aggregateScore].(float64),
107109
Checks: checks,
@@ -110,6 +112,12 @@ func (c *neo4jClient) CertifyScorecard(ctx context.Context, certifyScorecardSpec
110112
Origin: certifyScorecardNode.Props[origin].(string),
111113
Collector: certifyScorecardNode.Props[collector].(string),
112114
}
115+
116+
certifyScorecard := &model.CertifyScorecard{
117+
Source: &src,
118+
Scorecard: &scorecard,
119+
}
120+
113121
collectedCertifyScorecard = append(collectedCertifyScorecard, certifyScorecard)
114122
}
115123
if err = result.Err(); err != nil {

‎pkg/assembler/backends/testing/certifyScorecard.go‎

Lines changed: 26 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@ import (
2424
)
2525

2626
func registerAllCertifyScorecard(client *demoClient) error {
27-
2827
// "git", "github", "https://github.com/django/django", "tag=1.11.1"
2928
selectedSourceType := "git"
3029
selectedSourceNameSpace := "github"
@@ -44,7 +43,6 @@ func registerAllCertifyScorecard(client *demoClient) error {
4443

4544
// "git", "github", "https://github.com/vapor-ware/kubetest", "tag=0.9.5"
4645
// client.registerSource("git", "github", "https://github.com/vapor-ware/kubetest", "tag=0.9.5")
47-
4846
selectedSourceType = "git"
4947
selectedSourceNameSpace = "github"
5048
selectedSourceName = "https://github.com/vapor-ware/kubetest"
@@ -66,25 +64,29 @@ func registerAllCertifyScorecard(client *demoClient) error {
6664
// Ingest CertifyScorecard
6765

6866
func (c *demoClient) registerCertifyScorecard(selectedSource *model.Source, timeScanned time.Time, aggregateScore float64, collectedChecks []model.ScorecardCheckSpec, scorecardVersion, scorecardCommit string) error {
69-
7067
for _, h := range c.certifyScorecard {
71-
if h.AggregateScore == aggregateScore && h.ScorecardVersion == scorecardVersion &&
72-
h.ScorecardCommit == scorecardCommit && h.Source == selectedSource {
68+
if h.Source == selectedSource &&
69+
h.Scorecard.AggregateScore == aggregateScore &&
70+
h.Scorecard.ScorecardVersion == scorecardVersion &&
71+
h.Scorecard.ScorecardCommit == scorecardCommit {
7372
return nil
7473
}
7574
}
7675

7776
newCertifyScorecard := &model.CertifyScorecard{
78-
Source: selectedSource,
79-
TimeScanned: timeScanned.String(),
80-
AggregateScore: aggregateScore,
81-
Checks: buildScorecardChecks(collectedChecks),
82-
ScorecardVersion: scorecardVersion,
83-
ScorecardCommit: scorecardCommit,
84-
Origin: "testing backend",
85-
Collector: "testing backend",
77+
Source: selectedSource,
78+
Scorecard: &model.Scorecard{
79+
TimeScanned: timeScanned.String(),
80+
AggregateScore: aggregateScore,
81+
Checks: buildScorecardChecks(collectedChecks),
82+
ScorecardVersion: scorecardVersion,
83+
ScorecardCommit: scorecardCommit,
84+
Origin: "testing backend",
85+
Collector: "testing backend",
86+
},
8687
}
8788
c.certifyScorecard = append(c.certifyScorecard, newCertifyScorecard)
89+
8890
return nil
8991
}
9092

@@ -101,27 +103,31 @@ func buildScorecardChecks(checks []model.ScorecardCheckSpec) []*model.ScorecardC
101103

102104
// Query CertifyScorecard
103105

104-
func (c *demoClient) CertifyScorecard(ctx context.Context, certifyScorecardSpec *model.CertifyScorecardSpec) ([]*model.CertifyScorecard, error) {
105-
106+
func (c *demoClient) Scorecards(ctx context.Context, certifyScorecardSpec *model.CertifyScorecardSpec) ([]*model.CertifyScorecard, error) {
106107
var collectedHasSourceAt []*model.CertifyScorecard
107108

108109
for _, h := range c.certifyScorecard {
109110
matchOrSkip := true
110111

111-
if certifyScorecardSpec.ScorecardVersion != nil && h.ScorecardVersion != *certifyScorecardSpec.ScorecardVersion {
112+
if certifyScorecardSpec.ScorecardVersion != nil &&
113+
h.Scorecard.ScorecardVersion != *certifyScorecardSpec.ScorecardVersion {
112114
matchOrSkip = false
113115
}
114-
if certifyScorecardSpec.ScorecardCommit != nil && h.ScorecardCommit != *certifyScorecardSpec.ScorecardCommit {
116+
if certifyScorecardSpec.ScorecardCommit != nil &&
117+
h.Scorecard.ScorecardCommit != *certifyScorecardSpec.ScorecardCommit {
115118
matchOrSkip = false
116119
}
117-
if certifyScorecardSpec.Collector != nil && h.Collector != *certifyScorecardSpec.Collector {
120+
if certifyScorecardSpec.Collector != nil &&
121+
h.Scorecard.Collector != *certifyScorecardSpec.Collector {
118122
matchOrSkip = false
119123
}
120-
if certifyScorecardSpec.Origin != nil && h.Origin != *certifyScorecardSpec.Origin {
124+
if certifyScorecardSpec.Origin != nil &&
125+
h.Scorecard.Origin != *certifyScorecardSpec.Origin {
121126
matchOrSkip = false
122127
}
123128

124-
if certifyScorecardSpec.Source != nil && h.Source != nil {
129+
if certifyScorecardSpec.Source != nil &&
130+
h.Source != nil {
125131
if certifyScorecardSpec.Source.Type == nil || h.Source.Type == *certifyScorecardSpec.Source.Type {
126132
newSource, err := filterSourceNamespace(h.Source, certifyScorecardSpec.Source)
127133
if err != nil {

‎pkg/assembler/graphql/examples/mutation.gql‎

Lines changed: 0 additions & 29 deletions
This file was deleted.

‎pkg/assembler/graphql/examples/source.gql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,6 @@ query SrcQ3 {
3333
}
3434
}
3535

36-
3736
query SrcQ4 {
3837
sources(sourceSpec: {name: "github.com/guacsec/guac"}) {
3938
...allSrcTree
@@ -53,6 +52,7 @@ query SrcQ6 {
5352
...allSrcTree
5453
}
5554
}
55+
5656
query SrcQ7 {
5757
sources(sourceSpec: {type: "svn"}) {
5858
...allSrcTree

‎pkg/assembler/graphql/generated/artifact.generated.go‎

Lines changed: 25 additions & 37 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)