CalvinBackup/OBLITERATUS
1
0
Fork 0
mirror of https://github.com/elder-plinius/OBLITERATUS.git synced 2026-08-30 06:30:37 +02:00
Code Issues Packages Projects Releases Wiki Activity

ci: release tested source snapshots only

Browse Source
This commit is contained in:
Joseph Magly
2026-08-22 11:28:30 -04:00
parent c546d30e9e
commit beb4707401
15 changed files with 104 additions and 181 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/check_supply_chain_policy.py
+7 -7
View File
@@ -291,8 +291,8 @@ def evaluate_secrets(
}
def bind_sbom(sbom: object, wheel: Path) -> dict[str, Any]:
"""Bind a CycloneDX SBOM to the exact built wheel by SHA-256."""
def bind_sbom(sbom: object, artifact: Path) -> dict[str, Any]:
"""Bind a CycloneDX SBOM to the exact promoted source artifact by SHA-256."""
if not isinstance(sbom, dict) or sbom.get("bomFormat") != "CycloneDX":
raise ValueError("SBOM must be a CycloneDX JSON object")
if sbom.get("specVersion") != "1.5":
@@ -303,12 +303,12 @@ def bind_sbom(sbom: object, wheel: Path) -> dict[str, Any]:
component = metadata.get("component")
if not isinstance(component, dict) or component.get("name") != "obliteratus":
raise ValueError("SBOM metadata must describe obliteratus")
digest = hashlib.sha256(wheel.read_bytes()).hexdigest()
digest = hashlib.sha256(artifact.read_bytes()).hexdigest()
component["hashes"] = [{"alg": "SHA-256", "content": digest}]
properties = component.setdefault("properties", [])
if not isinstance(properties, list):
raise ValueError("SBOM component properties must be a list")
properties.append({"name": "obliteratus:distribution-file", "value": wheel.name})
properties.append({"name": "obliteratus:release-artifact", "value": artifact.name})
return sbom
@@ -343,7 +343,7 @@ def _parser() -> argparse.ArgumentParser:
licenses.add_argument("--decision", type=Path, required=True)
sbom = commands.add_parser("sbom")
sbom.add_argument("--input", type=Path, required=True)
sbom.add_argument("--wheel", type=Path, required=True)
sbom.add_argument("--artifact", type=Path, required=True)
sbom.add_argument("--output", type=Path, required=True)
return parser
@@ -354,9 +354,9 @@ def main() -> int:
failures = validate_policy(_read_json(args.policy))
return _write_decision(Path("/dev/null"), {"passed": not failures, "failures": failures})
if args.command == "sbom":
bound = bind_sbom(_read_json(args.input), args.wheel)
bound = bind_sbom(_read_json(args.input), args.artifact)
args.output.write_text(json.dumps(bound, indent=2) + "\n", encoding="utf-8")
print(f"bound SBOM to {args.wheel.name}")
print(f"bound SBOM to {args.artifact.name}")
return 0
policy = _read_json(args.policy)