chore: refactor provenance available check

src/macaron/repo_finder/provenance_extractor.py

@@ -243,24 +243,18 @@ def _clean_spdx(uri: str) -> str:
     return url
 
 
-def check_if_input_repo_commit_provenance_conflict(
+def check_if_input_repo_provenance_conflict(
     repo_path_input: str | None,
-    digest_input: str | None,
     provenance_repo_url: str | None,
-    provenance_commit_digest: str | None,
 ) -> bool:
     """Test if the input repo and commit match the contents of the provenance.
 
     Parameters
     ----------
     repo_path_input: str | None
         The repo URL from input.
-    digest_input: str | None
-        The digest from input.
     provenance_repo_url: str | None
         The repo URL from provenance.
-    provenance_commit_digest: str | None
-        The commit digest from provenance.
 
     Returns
     -------
@@ -277,16 +271,6 @@ def check_if_input_repo_commit_provenance_conflict(
         )
         return True
 
-    # Check the provenance commit against the input commit.
-    if digest_input and provenance_commit_digest and digest_input != provenance_commit_digest:
-        logger.debug(
-            "The commit digest from input does not match what exists in the provenance. "
-            "Input Commit: %s, Provenance Commit: %s.",
-            digest_input,
-            provenance_commit_digest,
-        )
-        return True
-
     return False
 
 

src/macaron/slsa_analyzer/analyzer.py

@@ -38,7 +38,7 @@
 from macaron.repo_finder.commit_finder import find_commit
 from macaron.repo_finder.provenance_extractor import (
     check_if_input_purl_provenance_conflict,
-    check_if_input_repo_commit_provenance_conflict,
+    check_if_input_repo_provenance_conflict,
     extract_repo_and_commit_from_provenance,
 )
 from macaron.repo_finder.provenance_finder import ProvenanceFinder, find_provenance_from_ci
@@ -343,10 +343,8 @@ def run_single(
             except ProvenanceError as error:
                 logger.debug("Failed to extract repo or commit from provenance: %s", error)
 
-            # Try to validate the input repo and/or commit against provenance contents.
-            if (provenance_repo_url or provenance_commit_digest) and check_if_input_repo_commit_provenance_conflict(
-                repo_path_input, digest_input, provenance_repo_url, provenance_commit_digest
-            ):
+            # Try to validate the input repo against provenance contents.
+            if provenance_repo_url and check_if_input_repo_provenance_conflict(repo_path_input, provenance_repo_url):
                 return Record(
                     record_id=repo_id,
                     description="Input mismatch between repo and provenance.",
@@ -456,9 +454,9 @@ def run_single(
                 except ProvenanceError as error:
                     logger.debug("Failed to extract repo or commit from provenance: %s", error)
 
-                # Try to validate the input repo and/or commit against provenance contents.
-                if (provenance_repo_url or provenance_commit_digest) and check_if_input_repo_commit_provenance_conflict(
-                    repo_path_input, digest_input, provenance_repo_url, provenance_commit_digest
+                # Try to validate the input repo against provenance contents.
+                if provenance_repo_url and check_if_input_repo_provenance_conflict(
+                    repo_path_input, provenance_repo_url
                 ):
                     return Record(
                         record_id=repo_id,

tests/integration/cases/micronaut-projects_micronaut-test/micronaut-test.dl

@@ -9,13 +9,13 @@ Policy("test_policy", component_id, "") :-
     check_passed(component_id, "mcn_build_service_1"),
     check_passed(component_id, "mcn_version_control_system_1"),
     check_passed(component_id, "mcn_provenance_available_1"),
-    check_failed(component_id, "mcn_provenance_level_three_1"),
+    check_passed(component_id, "mcn_provenance_derived_repo_1"),
+    check_passed(component_id, "mcn_provenance_level_three_1"),
     check_failed(component_id, "mcn_infer_artifact_pipeline_1"),
     check_failed(component_id, "mcn_provenance_derived_commit_1"),
-    check_failed(component_id, "mcn_provenance_derived_repo_1"),
     check_failed(component_id, "mcn_provenance_witness_level_one_1"),
     check_failed(component_id, "mcn_trusted_builder_level_three_1"),
     is_repo_url(component_id, "https://github.com/micronaut-projects/micronaut-test").
 
 apply_policy_to("test_policy", component_id) :-
-    is_component(component_id, "pkg:github.com/micronaut-projects/micronaut-test@7679d10b4073a3b842b6c56877c35fa8cd10acff").
+    is_component(component_id, "pkg:github.com/micronaut-projects/micronaut-test@5b81340f319a2287cb2e81ddec0154c0ea2510cf").

tests/integration/cases/slsa-framework_slsa-verifier/policy.dl

@@ -10,12 +10,12 @@ Policy("test_policy", component_id, "") :-
     check_passed(component_id, "mcn_trusted_builder_level_three_1"),
     check_passed(component_id, "mcn_version_control_system_1"),
     check_passed(component_id, "mcn_provenance_available_1"),
-    check_failed(component_id, "mcn_provenance_expectation_1"),
+    check_passed(component_id, "mcn_provenance_derived_commit_1"),
+    check_passed(component_id, "mcn_provenance_derived_repo_1"),
+    check_passed(component_id, "mcn_provenance_expectation_1"),
     check_failed(component_id, "mcn_infer_artifact_pipeline_1"),
-    check_failed(component_id, "mcn_provenance_derived_commit_1"),
-    check_failed(component_id, "mcn_provenance_derived_repo_1"),
     check_failed(component_id, "mcn_provenance_witness_level_one_1"),
     is_repo_url(component_id, "https://github.com/slsa-framework/slsa-verifier").
 
 apply_policy_to("test_policy", component_id) :-
-    is_component(component_id, "pkg:github.com/slsa-framework/slsa-verifier@fc50b662fcfeeeb0e97243554b47d9b20b14efac").
+    is_component(component_id, "pkg:github.com/slsa-framework/slsa-verifier@e6428d7da594455a4c2b7f24907fec421a5e0e95").

tests/integration/cases/slsa-framework_slsa-verifier/test.yaml

@@ -15,8 +15,12 @@ steps:
     ini: config.ini
     expectation: expectation.cue
     command_args:
-    - -purl
-    - pkg:golang/slsa-framework/[email protected]
+    - -rp
+    - https://github.com/slsa-framework/slsa-verifier
+    - -b
+    - main
+    - -d
+    - e6428d7da594455a4c2b7f24907fec421a5e0e95
     - --skip-deps
 - name: Run macaron verify-policy to verify passed/failed checks
   kind: verify

tests/integration/cases/urllib3_expectation_dir/expectation/expectation.cue

@@ -1,5 +1,5 @@
 {
-    target: "pkg:github.com/urllib3/urllib3",
+    target: "pkg:pypi/urllib3",
     predicate: {
         invocation: {
             configSource: {

tests/integration/cases/urllib3_expectation_dir/policy.dl

@@ -9,14 +9,14 @@ Policy("test_policy", component_id, "") :-
     check_passed(component_id, "mcn_build_service_1"),
     check_passed(component_id, "mcn_version_control_system_1"),
     check_passed(component_id, "mcn_provenance_available_1"),
-    check_failed(component_id, "mcn_provenance_expectation_1"),
-    check_failed(component_id, "mcn_provenance_level_three_1"),
+    check_passed(component_id, "mcn_provenance_level_three_1"),
+    check_passed(component_id, "mcn_provenance_derived_commit_1"),
+    check_passed(component_id, "mcn_provenance_derived_repo_1"),
+    check_passed(component_id, "mcn_provenance_expectation_1"),
     check_failed(component_id, "mcn_infer_artifact_pipeline_1"),
-    check_failed(component_id, "mcn_provenance_derived_commit_1"),
-    check_failed(component_id, "mcn_provenance_derived_repo_1"),
     check_failed(component_id, "mcn_provenance_witness_level_one_1"),
     check_failed(component_id, "mcn_trusted_builder_level_three_1"),
     is_repo_url(component_id, "https://github.com/urllib3/urllib3").
 
 apply_policy_to("test_policy", component_id) :-
-    is_component(component_id, "pkg:github.com/urllib3/urllib3@87a0ecee6e691fe5ff93cd000c0158deebef763b").
+    is_component(component_id, "pkg:pypi/urllib3@2.0.0a1").

tests/integration/cases/urllib3_expectation_file/expectation.cue

@@ -1,5 +1,5 @@
 {
-    target: "pkg:github.com/urllib3/urllib3",
+    target: "pkg:pypi/urllib3",
     predicate: {
         invocation: {
             configSource: {

tests/integration/cases/urllib3_expectation_file/policy.dl

@@ -9,14 +9,14 @@ Policy("test_policy", component_id, "") :-
     check_passed(component_id, "mcn_build_service_1"),
     check_passed(component_id, "mcn_version_control_system_1"),
     check_passed(component_id, "mcn_provenance_available_1"),
-    check_failed(component_id, "mcn_provenance_expectation_1"),
-    check_failed(component_id, "mcn_provenance_level_three_1"),
+    check_passed(component_id, "mcn_provenance_derived_commit_1"),
+    check_passed(component_id, "mcn_provenance_derived_repo_1"),
+    check_passed(component_id, "mcn_provenance_expectation_1"),
+    check_passed(component_id, "mcn_provenance_level_three_1"),
     check_failed(component_id, "mcn_infer_artifact_pipeline_1"),
-    check_failed(component_id, "mcn_provenance_derived_commit_1"),
-    check_failed(component_id, "mcn_provenance_derived_repo_1"),
     check_failed(component_id, "mcn_provenance_witness_level_one_1"),
     check_failed(component_id, "mcn_trusted_builder_level_three_1"),
     is_repo_url(component_id, "https://github.com/urllib3/urllib3").
 
 apply_policy_to("test_policy", component_id) :-
-    is_component(component_id, "pkg:github.com/urllib3/urllib3@87a0ecee6e691fe5ff93cd000c0158deebef763b").
+    is_component(component_id, "pkg:pypi/urllib3@2.0.0a1").

tests/integration/cases/urllib3_invalid_expectation/policy.dl

@@ -9,13 +9,13 @@ Policy("test_policy", component_id, "") :-
     check_passed(component_id, "mcn_build_service_1"),
     check_passed(component_id, "mcn_version_control_system_1"),
     check_passed(component_id, "mcn_provenance_available_1"),
-    check_failed(component_id, "mcn_provenance_level_three_1"),
+    check_passed(component_id, "mcn_provenance_derived_commit_1"),
+    check_passed(component_id, "mcn_provenance_derived_repo_1"),
+    check_passed(component_id, "mcn_provenance_level_three_1"),
     check_failed(component_id, "mcn_infer_artifact_pipeline_1"),
-    check_failed(component_id, "mcn_provenance_derived_commit_1"),
-    check_failed(component_id, "mcn_provenance_derived_repo_1"),
     check_failed(component_id, "mcn_provenance_witness_level_one_1"),
     check_failed(component_id, "mcn_trusted_builder_level_three_1"),
     is_repo_url(component_id, "https://github.com/urllib3/urllib3").
 
 apply_policy_to("test_policy", component_id) :-
-    is_component(component_id, "pkg:github.com/urllib3/urllib3@87a0ecee6e691fe5ff93cd000c0158deebef763b").
+    is_component(component_id, "pkg:pypi/urllib3@2.0.0a1").