✨ Binary artifact exception for gradle-wrapper.jar when using validation action #2039

ethanent · 2022-07-12T00:50:51Z

What kind of change does this PR introduce?

Feature

PR title follows the guidelines defined in our pull request documentation

What is the current behavior?

Scorecard considers gradle-wrapper.jar files to be harmful binary artifacts even when they are verified by the gradle/wrapper-validation-action action.

What is the new behavior (if this is a feature change)?**

gradle-wrapper.jar files will no longer be flagged by the binary artifacts check iff all conditions are met:

There is a workflow using the gradle/wrapper-validation-action action in a step in a job
That workflow passed for the latest commit on default branch
Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

Fixes #1815

Special notes for your reviewer

Does this PR introduce a user-facing change?

For user-facing changes, please add a concise, human-readable release note to
the release-note

(In particular, describe what changes users might need to make in their
application as a result of this pull request.)

gradle-wrapper.jar files are no longer flagged by the Binary Artifacts check if the Gradle Wrapper Validation Action is enabled as part of a passing workflow.

… files

codecov · 2022-07-12T01:45:22Z

Codecov Report

Merging #2039 (6c92a63) into main (f1b182a) will increase coverage by 0.23%.
The diff coverage is 60.41%.

@@            Coverage Diff             @@
##             main    #2039      +/-   ##
==========================================
+ Coverage   42.17%   42.40%   +0.23%     
==========================================
  Files          89       89              
  Lines        7336     7430      +94     
==========================================
+ Hits         3094     3151      +57     
- Misses       4008     4033      +25     
- Partials      234      246      +12

github-actions · 2022-07-12T01:58:51Z

Integration tests success for
[db5744a]
(https://github.com/ossf/scorecard/actions/runs/2653573292)

github-actions · 2022-07-12T03:35:00Z

Integration tests success for
[afa21c4]
(https://github.com/ossf/scorecard/actions/runs/2653875365)

loosebazooka

nice work, people have been asking for this.

Is there a way to tell users that we found a gradle wrapper but no validation action in the issue presented to the user? Or point to a remediation faq?

checks/raw/binary_artifact.go

checks/raw/binary_artifact_test.go

checks/raw/binary_artifact.go

laurentsimon

Thanks for the PR. As @loosebazooka said, there is demand for this!

checks/raw/binary_artifact.go

github-actions · 2022-07-13T03:10:30Z

Integration tests success for
[54a33fd]
(https://github.com/ossf/scorecard/actions/runs/2660638220)

github-actions · 2022-07-13T10:45:39Z

Integration tests success for
[541126f]
(https://github.com/ossf/scorecard/actions/runs/2662747602)

checks/raw/binary_artifact.go

laurentsimon

Thanks, LGTM!

checks/raw/binary_artifact.go

github-actions · 2022-07-16T03:41:10Z

Integration tests success for
[d96378f]
(https://github.com/ossf/scorecard/actions/runs/2680476048)

github-actions · 2022-07-18T18:39:10Z

Integration tests success for
[6c92a63]
(https://github.com/ossf/scorecard/actions/runs/2692612305)

…ion action (ossf#2039) * implement binary artifacts exception for validated gradle-wrapper.jar files * add tests for binary artifact gradle wrapper verification exception * fix issues for linter * expect added jar in TestBinaryArtifacts Jar file test * improve readability of raw/binary_artifact * Binary-Artifact request types no longer includes FileBased * add version requirement capability to gradle action check * Refactor exception from checks/raw to checks/evaluation * remove unnecessary len(files) * flatten application of exception by moving to another function * revert refactor to checks/evaluation * flatten removal of validated wrappers * create fileExists function Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

Remove sigstore-java from exempt list, fixed with ossf/scorecard#2039

Remove sigstore-java from exempt list, fixed with ossf/scorecard#2039 Signed-off-by: Appu Goundan <appu@google.com>

Enable Binary artifacts check for local repositories that was disabled in the PR ossf#2039 and revert the change done for empty repository handling in the PR ossf#2207

Enable Binary artifacts check for local repositories that was disabled in the PR ossf#2039 and revert the change done for empty repository handling in the PR ossf#2207 Co-authored-by: Abhisek Sanyal <abhisek@veedna.com>

New functionality added as part of the PR ossf#2039 is not supported for local repositories. When this code path is hit, it will check if it is an unsupported error and not fail the Binary Artifacts check. Fallback to existing behavior for any other type of errors

New functionality added as part of the PR ossf#2039 is not supported for local repositories. When this code path is hit, it will check if it is an unsupported error and not fail the Binary Artifacts check. Fallback to existing behavior for any other type of errors Co-authored-by: Abhisek Sanyal <abhisek@veedna.com>

Enable Binary artifacts check for local repositories that was disabled in the PR ossf#2039 and revert the change done for empty repository handling in the PR ossf#2207 Co-authored-by: Abhisek Sanyal <abhisek@veedna.com>

New functionality added as part of the PR ossf#2039 is not supported for local repositories. When this code path is hit, it will check if it is an unsupported error and not fail the Binary Artifacts check. Fallback to existing behavior for any other type of errors Co-authored-by: Abhisek Sanyal <abhisek@veedna.com>

Enable Binary artifacts check for local repositories that was disabled in the PR ossf#2039 and revert the change done for empty repository handling in the PR ossf#2207

New functionality added as part of the PR ossf#2039 is not supported for local repositories. When this code path is hit, it will check if it is an unsupported error and not fail the Binary Artifacts check. Fallback to existing behavior for any other type of errors

Enable Binary artifacts check for local repositories that was disabled in the PR ossf#2039 and revert the change done for empty repository handling in the PR ossf#2207

New functionality added as part of the PR ossf#2039 is not supported for local repositories. When this code path is hit, it will check if it is an unsupported error and not fail the Binary Artifacts check. Fallback to existing behavior for any other type of errors

Enable Binary artifacts check for local repositories that was disabled in the PR ossf#2039 and revert the change done for empty repository handling in the PR ossf#2207

ethanent added 2 commits July 11, 2022 17:03

implement binary artifacts exception for validated gradle-wrapper.jar…

926afa9

… files

add tests for binary artifact gradle wrapper verification exception

ed2fb65

ethanent requested review from azeemshaikh38, justaugustus, laurentsimon and naveensrinivasan as code owners July 12, 2022 00:50

ethanent had a problem deploying to integration-test July 12, 2022 00:51 Failure

fix issues for linter

f62f2b8

ethanent had a problem deploying to integration-test July 12, 2022 01:32 Failure

expect added jar in TestBinaryArtifacts Jar file test

db5744a

ethanent temporarily deployed to integration-test July 12, 2022 01:41 Inactive

Merge branch 'ossf:main' into binary-artifact-gradle-exception

afa21c4

ethanent temporarily deployed to integration-test July 12, 2022 03:20 Inactive

loosebazooka reviewed Jul 12, 2022

View reviewed changes

checks/raw/binary_artifact.go Outdated Show resolved Hide resolved

checks/raw/binary_artifact.go Outdated Show resolved Hide resolved

checks/raw/binary_artifact_test.go Show resolved Hide resolved

checks/raw/binary_artifact.go Outdated Show resolved Hide resolved

laurentsimon reviewed Jul 12, 2022

View reviewed changes

ethanent mentioned this pull request Jul 13, 2022

Move application of Binary Artifacts Gradle Wrapper Action exception into checks/evaluation/ #2048

Closed

ethanent added 2 commits July 12, 2022 19:37

improve readability of raw/binary_artifact

a6bb2d5

Binary-Artifact request types no longer includes FileBased

54a33fd

ethanent temporarily deployed to integration-test July 13, 2022 02:39 Inactive

add version requirement capability to gradle action check

541126f

ethanent temporarily deployed to integration-test July 13, 2022 10:27 Inactive

laurentsimon reviewed Jul 13, 2022

View reviewed changes

checks/raw/binary_artifact.go Outdated Show resolved Hide resolved

checks/raw/binary_artifact.go Outdated Show resolved Hide resolved

checks/raw/binary_artifact.go Outdated Show resolved Hide resolved

Refactor exception from checks/raw to checks/evaluation

1f2187d

ethanent temporarily deployed to integration-test July 13, 2022 22:41 Inactive

remove unnecessary len(files)

62d487a

ethanent requested a review from laurentsimon July 15, 2022 21:06

laurentsimon approved these changes Jul 15, 2022

View reviewed changes

checks/raw/binary_artifact.go Outdated Show resolved Hide resolved

create fileExists function

d96378f

ethanent temporarily deployed to integration-test July 16, 2022 03:25 Inactive

Merge branch 'main' into binary-artifact-gradle-exception

6c92a63

laurentsimon enabled auto-merge (squash) July 18, 2022 18:21

laurentsimon temporarily deployed to integration-test July 18, 2022 18:21 Inactive

laurentsimon merged commit dd8fbc0 into ossf:main Jul 18, 2022

loosebazooka added a commit to loosebazooka/.allstar that referenced this pull request Jul 28, 2022

Update binary_artifacts.yaml

df4acef

Remove sigstore-java from exempt list, fixed with ossf/scorecard#2039

loosebazooka mentioned this pull request Jul 28, 2022

Update binary_artifacts.yaml sigstore/.allstar#6

Merged

loosebazooka added a commit to loosebazooka/.allstar that referenced this pull request Jul 28, 2022

Update binary_artifacts.yaml

e7d939f

Remove sigstore-java from exempt list, fixed with ossf/scorecard#2039 Signed-off-by: Appu Goundan <appu@google.com>

vlsi mentioned this pull request Aug 10, 2022

Bootstrap Gradle build using cmd-line scripts only gradle/gradle#11816

Open

abhiseksanyal mentioned this pull request Oct 11, 2022

Enable Binary artifacts check for local repos lineaje-labs/scorecard#2

Merged

2 tasks

abhiseksanyal mentioned this pull request Oct 14, 2022

Handle Unsupported Binary Artifacts check lineaje-labs/scorecard#4

Merged

2 tasks

spencerschrock mentioned this pull request Aug 22, 2023

✨ Support Binary-Artifacts check again for local repos #3415

Merged

2 tasks

jobarr-amzn mentioned this pull request Sep 19, 2023

Add gradle wrapper validation amazon-ion/ion-java#577

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

✨ Binary artifact exception for gradle-wrapper.jar when using validation action #2039

✨ Binary artifact exception for gradle-wrapper.jar when using validation action #2039

ethanent commented Jul 12, 2022 •

edited

codecov bot commented Jul 12, 2022 •

edited

github-actions bot commented Jul 12, 2022

github-actions bot commented Jul 12, 2022

loosebazooka left a comment

laurentsimon left a comment

github-actions bot commented Jul 13, 2022

github-actions bot commented Jul 13, 2022

laurentsimon left a comment

github-actions bot commented Jul 16, 2022

github-actions bot commented Jul 18, 2022

✨ Binary artifact exception for gradle-wrapper.jar when using validation action #2039

✨ Binary artifact exception for gradle-wrapper.jar when using validation action #2039

Conversation

ethanent commented Jul 12, 2022 • edited

What kind of change does this PR introduce?

What is the current behavior?

What is the new behavior (if this is a feature change)?**

Which issue(s) this PR fixes

Special notes for your reviewer

Does this PR introduce a user-facing change?

codecov bot commented Jul 12, 2022 • edited

Codecov Report

github-actions bot commented Jul 12, 2022

github-actions bot commented Jul 12, 2022

loosebazooka left a comment

Choose a reason for hiding this comment

laurentsimon left a comment

Choose a reason for hiding this comment

github-actions bot commented Jul 13, 2022

github-actions bot commented Jul 13, 2022

laurentsimon left a comment

Choose a reason for hiding this comment

github-actions bot commented Jul 16, 2022

github-actions bot commented Jul 18, 2022

ethanent commented Jul 12, 2022 •

edited

codecov bot commented Jul 12, 2022 •

edited