Skip to content

v0.2.2 — Fix acc SBOM workflow and decision consistency (no policy changes)

Choose a tag to compare

View all tags
@cloudcwfranck cloudcwfranck released this 20 Dec 16:52
· 141 commits to main since this release
v0.2.2
ee4a613
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Fixed - Final Gate Consistency & SBOM Workflow

This release implements a single authoritative final gate for verify decision consistency.

Critical Fixes:

  1. Final gate consistency - Implemented single authoritative decision gate

    • Bug: status:"fail" could occur while PolicyResult.allow:true due to early status assignments
    • Root Cause: Multiple places set status = "fail", but final gate only set "fail" if still not failed
    • Fix: Single authoritative finalAllow variable that ALWAYS determines final status, overriding all earlier assignments
    • Impact: Guarantees status and exit code derive from PolicyResult.Allow (the final decision after profile filtering)
    • Code: internal/verify/verify.go:255-286 - Authoritative final gate

  2. SBOM workflow guidance - Improved error messages and documentation

    • Bug: SBOM-required error lacked actionable workflow guidance
    • Fix: Error message now includes step-by-step workflow:
      • Option 1: docker build → syft → acc verify
      • Option 2: acc build (automatic SBOM generation)
    • Impact: Users know exactly how to generate SBOMs
    • Code: internal/verify/verify.go:75-97 - Enhanced error message

  3. README SBOM Workflows section - Comprehensive workflow documentation

    • Added: Dedicated "SBOM Workflows" section with 3 workflows:
      • Workflow 1: acc build (recommended, automatic)
      • Workflow 2: docker build + manual SBOM generation
      • Workflow 3: CI/CD integration example
    • Added: SBOM troubleshooting guide
    • Impact: Clear documentation for all use cases

Regression Tests Added:

  • TestVerify_FinalGateConsistency - Verifies status MUST match allow field
  • TestVerify_SBOMMissingErrorMessage - Verifies error includes workflow guidance

Design Principle:

// Single authoritative final gate (v0.2.2)
var finalAllow bool
if result.PolicyResult != nil {
    finalAllow = result.PolicyResult.Allow
} else {
    finalAllow = false
}

// Status ALWAYS derives from final gate
if finalAllow {
    result.Status = "pass"
} else {
    result.Status = "fail"
}

Files Changed:

  • internal/verify/verify.go - Single authoritative final gate, improved SBOM error
  • internal/verify/verify_test.go - Added regression tests, added strings import
  • README.md - Added comprehensive SBOM Workflows section

Breaking Changes: None - all changes maintain backward compatibility

Installation

Download the appropriate binary for your platform and verify the checksum:

Linux (AMD64):

curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.2/acc_0.2.2_linux_amd64.tar.gz"
curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.2/checksums.txt"
sha256sum -c checksums.txt --ignore-missing
tar -xzf acc_0.2.2_linux_amd64.tar.gz
sudo mv acc-linux-amd64 /usr/local/bin/acc
chmod +x /usr/local/bin/acc
acc version

macOS (Apple Silicon):

curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.2/acc_0.2.2_darwin_arm64.tar.gz"
curl -LO "https://github.com/cloudcwfranck/acc/releases/download/v0.2.2/checksums.txt"
shasum -a 256 -c checksums.txt --ignore-missing
tar -xzf acc_0.2.2_darwin_arm64.tar.gz
sudo mv acc-darwin-arm64 /usr/local/bin/acc
chmod +x /usr/local/bin/acc
acc version

See README.md for complete installation instructions.

Assets 8
Loading