fix(provenance): verify every matched SPDX, not just the first - #11
Open
MarkAtwood wants to merge 2 commits into
Open
fix(provenance): verify every matched SPDX, not just the first#11MarkAtwood wants to merge 2 commits into
MarkAtwood wants to merge 2 commits into
Conversation
Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
verify() checked only sorted(glob)[0], so when the SPDX glob matched several documents a broken or tampered SPDX that sorted later passed CI unexamined -- a silent pass, the worst failure mode for a provenance verifier. Loop over all matched documents, accumulating problems so one run reports every broken file; object-store integrity still runs once. Adds regression tests: a later dangling SPDX now fails the run, and two valid documents both verify.
There was a problem hiding this comment.
Pull request overview
This PR fixes a provenance-verification blind spot where bomsh_verify.verify() only validated the first SPDX file matched by a glob, allowing later-matched (potentially tampered/broken) SPDX documents to go unchecked.
Changes:
- Update
provenance/bomsh_verify.pyto iterate over all matched SPDX files, accumulating errors and producing per-file verification messages. - Add regression tests ensuring later-matched broken SPDX files fail verification, and multiple valid SPDX files all pass with an aggregated summary.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| tests/test_gen_sbom.py | Adds regression/positive tests covering multi-SPDX glob matching behavior. |
| provenance/bomsh_verify.py | Verifies every matched SPDX file (not just the first) and aggregates results/messages. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| for spdx_path in spdx_paths: | ||
| try: | ||
| spdx_gitoids = load_spdx_gitoids(spdx_path) | ||
| except (json.JSONDecodeError, ValueError) as e: |
sameehj
force-pushed
the
master
branch
4 times, most recently
from
July 24, 2026 14:09
3ab77f9 to
9bdf5b7
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
bomsh_verify.verify()checked onlysorted(glob)[0], so when the SPDX glob matched several documents a broken or tampered SPDX that sorted later passed CI unexamined — a silent pass, the worst failure mode for a provenance verifier. Now loops over all matched documents (accumulating problems so one run reports every broken file); object-store integrity still runs once for the store.Regression tests: a later dangling SPDX now fails the run; two valid documents both verify. Full
test_gen_sbomsuite green (164 tests). Independent of the other open review PRs.Addresses SBOM-gpex.11.