Merge pull request #98 from moorereason/iss95

Show negative results in some check details
ossf · Dec 20, 2020 · 6b80b78 · 6b80b78
2 parents 1991617 + ac55575
commit 6b80b78
Show file tree

Hide file tree

Showing 3 changed files with 25 additions and 6 deletions.
diff --git a/checks/pull_requests.go b/checks/pull_requests.go
@@ -53,6 +53,7 @@ func PullRequests(c checker.Checker) checker.CheckResult {
 		commitMessage := commit.GetCommit().GetMessage()
 		if strings.Contains(commitMessage, "\nReviewed-on: ") {
 			totalWithPrs++
+			c.Logf("found gerrit reviewed commit: %s", commit.GetSHA())
 			continue
 		}
 
@@ -62,6 +63,9 @@ func PullRequests(c checker.Checker) checker.CheckResult {
 		}
 		if len(prs) > 0 {
 			totalWithPrs++
+			c.Logf("found commit with PR: %s", commit.GetSHA())
+		} else {
+			c.Logf("!! found commit without PR: %s, committer: %s", commit.GetSHA(), commit.GetCommitter().GetLogin())
 		}
 	}
 	c.Logf("found PRs for %d out of %d commits", totalWithPrs, total)

diff --git a/checks/signed_releases.go b/checks/signed_releases.go
@@ -33,6 +33,8 @@ func SignedReleases(c checker.Checker) checker.CheckResult {
 		return checker.RetryResult(err)
 	}
 
+	artifactExtensions := []string{".asc", ".minisig", ".sig"}
+
 	totalReleases := 0
 	totalSigned := 0
 	for _, r := range releases {
@@ -47,7 +49,7 @@ func SignedReleases(c checker.Checker) checker.CheckResult {
 		totalReleases++
 		signed := false
 		for _, asset := range assets {
-			for _, suffix := range []string{".asc", ".minisig", ".sig"} {
+			for _, suffix := range artifactExtensions {
 				if strings.HasSuffix(asset.GetName(), suffix) {
 					c.Logf("signed release artifact found: %s, url: %s", asset.GetName(), asset.GetURL())
 					signed = true
@@ -59,13 +61,19 @@ func SignedReleases(c checker.Checker) checker.CheckResult {
 				break
 			}
 		}
+		if !signed {
+			c.Logf("!! release %s has no signed artifacts", r.GetName())
+		}
 		if totalReleases > releaseLookBack {
 			break
 		}
 	}
 
 	if totalReleases == 0 {
+		c.Logf("no releases found")
 		return checker.InconclusiveResult
 	}
+
+	c.Logf("found signed artifacts for %d out of %d releases", totalSigned, totalReleases)
 	return checker.ProportionalResult(totalSigned, totalReleases, 0.8)
 }
diff --git a/checks/signed_tags.go b/checks/signed_tags.go
@@ -26,7 +26,6 @@ func init() {
 }
 
 func SignedTags(c checker.Checker) checker.CheckResult {
-
 	type ref struct {
 		Name   githubv4.String
 		Target struct {
@@ -51,20 +50,28 @@ func SignedTags(c checker.Checker) checker.CheckResult {
 		return checker.RetryResult(err)
 	}
 
-	totalReleases := 0
+	totalTags := 0
 	totalSigned := 0
 	for _, t := range query.Repository.Refs.Nodes {
 		sha := string(t.Target.Oid)
-		totalReleases++
+		totalTags++
 		gt, _, err := c.Client.Git.GetTag(c.Ctx, c.Owner, c.Repo, sha)
 		if err != nil {
 			return checker.RetryResult(err)
 		}
 		if gt.GetVerification().GetVerified() {
-			c.Logf("signed tag found: %s, commit: %s", t.Name, sha)
+			c.Logf("verified tag found: %s, commit: %s", t.Name, sha)
 			totalSigned++
+		} else {
+			c.Logf("!! unverified tag found: %s, commit: %s, reason: %s", t.Name, sha, gt.GetVerification().GetReason())
 		}
 	}
 
-	return checker.ProportionalResult(totalSigned, totalReleases, 0.8)
+	if totalTags == 0 {
+		c.Logf("no tags found")
+		return checker.InconclusiveResult
+	}
+
+	c.Logf("found %d out of %d verified tags", totalSigned, totalTags)
+	return checker.ProportionalResult(totalSigned, totalTags, 0.8)
 }