feat(materials): Support Gitlab security report materials #1339
Conversation
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
| @@ -0,0 +1,68 @@ | |||
| // | |||
| // Copyright 2023 The Chainloop Authors. | |||
| } | ||
|
|
||
| var glReport report.Report | ||
| if err = json.Unmarshal(data, &glReport); err != nil { |
There was a problem hiding this comment.
in a follow up patch we could validate the document against their json schema similarly to what we have done for cyclonedx? Do you mind creating an issue for that?
There was a problem hiding this comment.
I decided doing it this way because they don't have a "base" schema, so we'd need to take one and remove the specifics from all the variants. Those differences are well located, though, we can do it anyways.
| return fmt.Errorf("error unmarshalling report file: %w", err) | ||
| } | ||
|
|
||
| if glReport.Scan.Type == "" { |
There was a problem hiding this comment.
you might want to also make sure that Scan is not nil
There was a problem hiding this comment.
In his case Scan is not a pointer, so always has a value.
|
|
||
| var glReport report.Report | ||
| if err = json.Unmarshal(data, &glReport); err != nil { | ||
| return fmt.Errorf("error unmarshalling report file: %w", err) |
There was a problem hiding this comment.
what error do you get if you try to pass a random file as --kind GITLAB_SECURITY_REPORT` ?
There was a problem hiding this comment.
Here, nothing. json.Unmarshal by default ignores all unknown fields. We'd need to create a custom decoder to fail on ignored fields. I'll try that before merging.
javirln
left a comment
javirln
left a comment
There was a problem hiding this comment.
Once validating against the json schemas we might need to rethink if the golang library is still needed.
Awesome Jose thanks 😬
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
3 participants
This PR adds support for Gitlab security reports.
The implementation uses the Gitlab report Go bindings, so that all schemas are supported:
Closes #1335