Merge pull request #8 from isaquepinheiro/fix/review-round3

fix: close every finding from the independent review

Author: isaquepinheiro

README.md

@@ -4,7 +4,6 @@
 
 [![Go Report Card][goReportBadge]][goReportLink]
 [![GitHub release (latest by date)][latestReleaseBadge]](https://github.com/HashLoad/boss/releases/latest)
-[![CRA Compliance][craBadge]][securityPolicyLink]
 [![SBOM Badge][sbomBadge]](https://www.pubpascal.dev)
 [![GitHub Release Date][releaseDateBadge]](https://github.com/HashLoad/boss/releases)
 [![GitHub repo size][repoSizeBadge]](https://github.com/HashLoad/boss/archive/refs/heads/main.zip)
@@ -130,28 +129,17 @@ These commands add modern project creation, compiling, and script running capabi
 #### > new
 Generate a fully structured Delphi or Lazarus project template (skeleton) in the current directory:
 ```sh
-boss new delphi
-boss new lazarus
+boss new my_project
+boss new my_project --ide lazarus
+boss new my_package --type pkg --ide lazarus
 ```
 
 #### > pkg
-Perform Delphi package operations including packaging, signing, and verification.
+Perform Delphi package manifest operations.
 * **`pkg spec`**: Scaffolds a starter `pubpascal.json` manifest file for the package:
   ```sh
   boss pkg spec --id my-package --pkgversion 1.0.0
   ```
-* **`pkg pack`**: Build a redistributable package bundle (`.dpkg`):
-  ```sh
-  boss pkg pack --spec pubpascal.json --output ./dist
-  ```
-* **`pkg sign`**: Statically sign a package bundle using a PFX certificate:
-  ```sh
-  boss pkg sign --package mypkg.dpkg --pfx cert.pfx --pfx-password-env CERT_PASSWORD
-  ```
-* **`pkg verify`**: Verify a package bundle's signature and integrity:
-  ```sh
-  boss pkg verify --package mypkg.dpkg
-  ```
 
 #### > run
 Execute a custom shell script defined in the `scripts` section of your `boss.json` file:
@@ -179,9 +167,6 @@ Authenticate your local environment with the PubPascal portal using a Personal A
 ```sh
 # Authenticate using a personal access token
 boss login --token <pat>
-
-# Or start interactive login (prompts for the token)
-boss login portal
 ```
 #### > contribute
 Contribute to a third-party package by automating repository forking and Pull Request creation.
@@ -196,7 +181,7 @@ Contribute to a third-party package by automating repository forking and Pull Re
 
 #### > workspace
 Manage multi-repository PubPascal workspaces locally.
-* **`workspace clone`**: Clones a workspace and all its member repositories, setting up writable forks:
+* **`workspace clone`**: Clones a workspace and all its member repositories, checking out the reference each one is pinned to:
   ```sh
   boss workspace clone <workspace-id>
   boss workspace clone <workspace-id> --codename my-branch
@@ -205,11 +190,11 @@ Manage multi-repository PubPascal workspaces locally.
   ```sh
   boss workspace status
   ```
-* **`workspace update`**: Fast-forward all repositories to their pinned reference branch/commit:
+* **`workspace update`**: Fast-forward each repository on its current branch:
   ```sh
   boss workspace update
   ```
-* **`workspace push`**: Push committed changes across all writable repositories in the workspace:
+* **`workspace push`**: Push committed changes for each repository that has an upstream branch:
   ```sh
   boss workspace push
   ```
@@ -222,7 +207,7 @@ These native commands help you achieve 100% Cyber Resilience Act (CRA) complianc
 
 #### > cra
 Check your project's CRA compliance status or initialize required files automatically.
-* **`cra` (Diagnose)**: Scan the local project for required CRA signals (Security Policy, SBOM):
+* **`cra` (Diagnose)**: Scan the local project for required CRA signals (Security Policy, SBOM). It exits with status `1` when a signal is missing, so it can be used as a CI gate:
   ```sh
   boss cra
   ```
@@ -235,7 +220,7 @@ Check your project's CRA compliance status or initialize required files automati
 #### > sbom
 Generate a standard CycloneDX or SPDX Software Bill of Materials (SBOM) for your Delphi project:
 ```sh
-# Generate CycloneDX SBOM (outputs to ./sbom/sbom.cdx.json)
+# Generate CycloneDX SBOM (outputs to ./sbom/<ProjectName>.cdx.json)
 boss sbom
 
 # Specify custom project file and output path
@@ -245,19 +230,6 @@ boss sbom --project ./src/MyProj.dproj --output ./custom-sbom-folder
 boss sbom --format spdx
 ```
 
-#### > scan
-Scan a generated SBOM against the OSV.dev database for known vulnerabilities:
-```sh
-boss scan
-boss scan --sbom ./sbom/sbom.cdx.json
-```
-
-#### > publish-sbom
-Upload a generated SBOM to the PubPascal portal for remote compliance badge rendering:
-```sh
-boss publish-sbom --slug my-pkg-slug --pkgversion 1.0.0 --file ./sbom/sbom.cdx.json
-```
-
 ---
 
 ### 5. Additional Commands
@@ -584,6 +556,4 @@ boss init -q
 [telegramBadge]: https://img.shields.io/badge/telegram-join%20channel-7289DA?style=flat-square
 [telegramLink]: https://t.me/hashload
 [repoStarsBadge]: https://img.shields.io/github/stars/hashload/boss?style=social
-[craBadge]: https://img.shields.io/badge/CRA-100%25%20compliant-brightgreen
-[securityPolicyLink]: SECURITY.md
 [sbomBadge]: https://img.shields.io/badge/SBOM-compliant-brightgreen

SECURITY.md

@@ -206,10 +206,7 @@ func TestPubPascalCommands(t *testing.T) {
 	if findCommand(root, "sbom") == nil {
 		t.Error("Root command 'sbom' not found")
 	}
-	if findCommand(root, "publish-sbom") == nil {
-		t.Error("Root command 'publish-sbom' not found")
-	}
 
 	// Check pkg subcommands
-	assertSubcommands(t, pkgCmd, "Pkg", []string{"spec", "pack"})
+	assertSubcommands(t, pkgCmd, "Pkg", []string{"spec"})
 }

internal/adapters/primary/cli/cmd_test.go

@@ -85,7 +85,7 @@ func handleForkSetupFlow(ctx context.Context, packageSlug string, pkgDir string,
 	msg.Info("🍴 Requesting Fork from portal for %s...", packageSlug)
 
 	// Call Portal API to fork
-	url := fmt.Sprintf("%s/api/packages/contribute/fork", config.PortalBaseURL)
+	url := fmt.Sprintf("%s/api/packages/contribute/fork", strings.TrimSuffix(config.PortalBaseURL, "/"))
 	requestBody, _ := json.Marshal(map[string]string{
 		"packageSlug": packageSlug,
 	})
@@ -104,11 +104,12 @@ func handleForkSetupFlow(ctx context.Context, packageSlug string, pkgDir string,
 	}
 	defer func() { _ = resp.Body.Close() }()
 
-	bodyBytes, _ := io.ReadAll(resp.Body)
+	bodyBytes, err := readPortalBody(resp)
+	if err != nil {
+		msg.Die("❌ Failed to read portal response: %s", err)
+	}
 	if resp.StatusCode != http.StatusOK {
-		var errRes map[string]string
-		_ = json.Unmarshal(bodyBytes, &errRes)
-		msg.Die("❌ Fork failed: %s", errRes["error"])
+		msg.Die("❌ Fork failed (HTTP %d): %s", resp.StatusCode, portalErrorMessage(bodyBytes))
 	}
 
 	var res struct {
@@ -226,7 +227,7 @@ func submitPullRequest(
 	body string,
 ) {
 	// Call Portal API to create PR
-	url := fmt.Sprintf("%s/api/packages/contribute/pr", config.PortalBaseURL)
+	url := fmt.Sprintf("%s/api/packages/contribute/pr", strings.TrimSuffix(config.PortalBaseURL, "/"))
 	requestBody, _ := json.Marshal(map[string]string{
 		"packageSlug": packageSlug,
 		"branch":      branch,
@@ -248,11 +249,13 @@ func submitPullRequest(
 	}
 	defer func() { _ = resp.Body.Close() }()
 
-	bodyBytes, _ := io.ReadAll(resp.Body)
+	bodyBytes, err := readPortalBody(resp)
+	if err != nil {
+		msg.Die("❌ Failed to read portal response: %s", err)
+	}
 	if resp.StatusCode != http.StatusOK {
-		var errRes map[string]string
-		_ = json.Unmarshal(bodyBytes, &errRes)
-		msg.Die("❌ Pull Request creation failed: %s", errRes["error"])
+		msg.Die("❌ Pull Request creation failed (HTTP %d): %s",
+			resp.StatusCode, portalErrorMessage(bodyBytes))
 	}
 
 	var res struct {
@@ -269,6 +272,44 @@ func submitPullRequest(
 	msg.Info("🔗 Access your PR here: %s", res.PrURL)
 }
 
+// maxPortalResponseBytes caps how much of a portal response is read into
+// memory. The payloads this command consumes are a handful of fields; anything
+// larger is a misbehaving or hostile endpoint, and io.ReadAll would happily
+// keep allocating for it.
+const maxPortalResponseBytes = 1 << 20 // 1 MiB
+
+// readPortalBody reads a bounded portal response body.
+func readPortalBody(resp *http.Response) ([]byte, error) {
+	return io.ReadAll(io.LimitReader(resp.Body, maxPortalResponseBytes))
+}
+
+// portalErrorMessage extracts the message of a portal error response.
+//
+// Decoding into map[string]string used to fail as a whole as soon as any value
+// of the object was not a string -- a status code, a details object -- and the
+// user was shown an empty reason. Only the field that matters is decoded now,
+// and an unexpected payload falls back to the raw body instead of to nothing.
+func portalErrorMessage(body []byte) string {
+	var errRes struct {
+		Error   string `json:"error"`
+		Message string `json:"message"`
+	}
+	if err := json.Unmarshal(body, &errRes); err == nil {
+		if errRes.Error != "" {
+			return errRes.Error
+		}
+		if errRes.Message != "" {
+			return errRes.Message
+		}
+	}
+
+	if raw := strings.TrimSpace(string(body)); raw != "" {
+		return raw
+	}
+
+	return "the portal returned no details"
+}
+
 // Helper to run git commands.
 func runGitCmd(ctx context.Context, dir string, args ...string) (string, error) {
 	// #nosec G204 -- fixed git binary; arguments are built by this CLI

internal/adapters/primary/cli/contribute.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
+	"path/filepath"
 	"strings"
 
 	"github.com/hashload/boss/pkg/msg"
@@ -27,7 +28,8 @@ func craCmdRegister(root *cobra.Command) {
 		Use:   cmdNameCRA,
 		Short: "Cyber Resilience Act (CRA) compliance checker and assistant",
 		Long: `Diagnose and automate Cyber Resilience Act (CRA) compliance for your Delphi project.
-Run without arguments to perform a local compliance check, or use 'cra init' to generate required files.`,
+Run without arguments to perform a local compliance check, or use 'cra init' to generate required files.
+The check exits with status 1 when a required signal is missing, so it can gate a CI job.`,
 		Run: func(_ *cobra.Command, _ []string) {
 			runCraCheck()
 		},
@@ -70,7 +72,13 @@ func runCraCheck() {
 	}
 
 	hasSbom := false
-	sbomCandidates := []string{sbomFileName, "sbom.spdx.json", "bom.json", "sbom/" + sbomFileName}
+	// boss sbom writes sbom/<ProjectName>.cdx.json, so a glob is needed on top
+	// of the fixed names: matching only "sbom/sbom.cdx.json" meant the check
+	// never saw the file the generator had just produced.
+	sbomCandidates := []string{sbomFileName, "sbom.spdx.json", "bom.json"}
+	if globbed, err := filepath.Glob(filepath.Join(sbomBaseName, "*.cdx.json")); err == nil {
+		sbomCandidates = append(sbomCandidates, globbed...)
+	}
 	for _, c := range sbomCandidates {
 		if _, err := os.Stat(c); err == nil {
 			hasSbom = true
@@ -91,11 +99,18 @@ func runCraCheck() {
 	if hasSecurity && hasSbom {
 		msg.Info("\n🎉 Your local project is 100%% CRA compliant! Commit and push these files " +
 			"to GitHub to get the Gold badge in the portal.")
-	} else {
-		msg.Info("\n💡 Tips to get 100%% CRA badge:")
-		msg.Info("1. Run 'boss cra init' to let Boss generate the SECURITY.md and SBOM automatically.")
-		msg.Info("2. Commit and push the files to your repository.")
+
+		return
 	}
+
+	msg.Info("\n💡 Tips to get 100%% CRA badge:")
+	msg.Info("1. Run 'boss cra init' to let Boss generate the SECURITY.md and SBOM automatically.")
+	msg.Info("2. Commit and push the files to your repository.")
+
+	// A checker that always exits 0 cannot gate anything: a CI job would
+	// report success on a project that has neither a security policy nor an
+	// SBOM. Non-compliant is a failure, so the exit status has to say so.
+	os.Exit(1)
 }
 
 // runCraInit runs the interactive wizard to generate compliance files.

internal/adapters/primary/cli/cra.go

@@ -31,7 +31,7 @@ func loginCmdRegister(root *cobra.Command) {
 		Aliases: []string{"adduser", "add-user"},
 		Run: func(_ *cobra.Command, args []string) {
 			if portalToken != "" {
-				runPortalLogin(portalToken, args)
+				runPortalLogin(portalToken)
 				return
 			}
 			login(removeLogin, useSSH, privateKey, userName, password, args)