Add OSPS-LE-02 and OSPS-LE-03.

Co-authored-by: Michelangelo Mori <[email protected]>
Signed-off-by: Adolfo García Veytia (puerco) <[email protected]>

resources/minder/data-sources/ghapi.yaml

@@ -0,0 +1,16 @@
+version: v1
+type: data-source
+name: ghapi
+context: {}
+rest:
+  def:
+    license:
+      endpoint: https://api.github.com/repos/{owner}/{repo}/license
+      parse: json
+      input_schema:
+        type: object
+        properties:
+          owner:
+            type: string
+          repo:
+            type: string

resources/minder/data-sources/spdx-license-list.yaml

@@ -0,0 +1,10 @@
+version: v1
+type: data-source
+name: spdx-license-list
+context: {}
+rest:
+  def:
+    licenses:
+      endpoint: https://raw.githubusercontent.com/spdx/license-list-data/refs/heads/main/json/licenses.json
+      parse: json
+      input_schema: {}

resources/minder/osps-baseline-level1.yaml

@@ -101,6 +101,26 @@ repository:
     type: OSPS-DO-02
     def: {}
 
+  - name: OSPS-LE-02
+  #   The license for the source code MUST meet the OSI Open Source
+  #   Definition or the FSF Free Software Definition.
+  #
+  #   [X] Check repo detected license against OSI and FSF approved ones
+  #
+    type: OSPS-LE-02
+    def: {}
+
+  - name: OSPS-LE-03
+  #   The license for the source code MUST be maintained in a standard
+  #   location within the project’s repository.
+  #
+  #   [X] Check repo for LICENSE file
+  #   [X] Check repo for COPYING file
+  #   [X] Check repo for LICENSE/ folder
+  #
+    type: OSPS-LE-03
+    def: {}
+
   # - name: OSPS-QA-01
   #   Source code MUST be publicly readable and have a static URL
   #

resources/minder/rules/OSPS-LE-02.yaml

@@ -0,0 +1,46 @@
+version: v1
+release_phase: alpha
+type: rule-type
+name: OSPS-LE-02
+display_name: The project's license is an OSI or FSF approved license
+short_failure_message: License not found or is not an OSI or FSF approved license.
+severity:
+  value: info
+context:
+  provider: github
+description: |
+  Ensure that the project's source code is distributed under a recognized and legally enforceable open source software license.
+guidance: |
+  Ensure that the project's source code is distributed under a recognized and legally enforceable open source software license, providing clarity on how the code can be used and shared by others.
+def:
+  in_entity: repository
+  rule_schema: {}
+  ingest:
+    type: git
+  eval:
+    type: rego
+    data_sources:
+      - name: ghapi
+      - name: "spdx-license-list"
+    rego:
+      type: constraints
+      def: |
+        package minder
+
+        import future.keywords.every
+        import future.keywords.if
+
+        violations[{"msg": msg}] {
+          resp := minder.datasource.ghapi.license({"owner": "mindersec", "repo": "minder"})
+          license := resp.body.license.spdx_id
+
+          resp2 := minder.datasource["spdx-license-list"].licenses({})
+          licenses := resp2.body.licenses
+          osi := { license.licenseId | license := licenses[_]; license.isOsiApproved }
+          fsf := { license.licenseId | license := licenses[_]; license.isFsfLibre }
+          approved_licenses := osi | fsf
+
+          not license in approved_licenses          
+
+          msg := sprintf("License '%s' is not approved", [license])
+        }

resources/minder/rules/OSPS-LE-03.yaml

@@ -0,0 +1,55 @@
+version: v1
+release_phase: alpha
+type: rule-type
+name: OSPS-LE-03
+display_name: LICENSE or COPYING files are available available
+short_failure_message: No LICENSE or COPYING file found.
+severity:
+  value: info
+context:
+  provider: github
+description: |
+  Ensure that either LICENSE file, COPYING file, or LICENSE/ folder are available.
+guidance: |
+  Source code must be accompanied by a `LICENSE` or `COPYING` file, or a `LICENSE/` folder at the root of the project source tree.
+def:
+  in_entity: repository
+  rule_schema: {}
+  ingest:
+    type: git
+    git: {}
+  eval:
+    type: rego
+    rego:
+      type: deny-by-default
+      def: |
+        package minder
+
+        import future.keywords.every
+        import future.keywords.if
+
+        default allow := false
+
+        allow if {
+          files := file.ls_glob("./LICENSE*")
+
+          some name
+          content := file.read(files[name])
+          "" != content
+        }
+
+        allow if {
+          files := file.ls_glob("./COPYING*")
+
+          some name
+          content := file.read(files[name])
+          "" != content
+        }
+
+        allow if {
+          files := file.ls_glob("./LICENSE/*")
+
+          some name
+          content := file.read(files[name])
+          "" != content
+        }