✨ Add experimental check for published SBOM

checker/raw_result.go

@@ -37,6 +37,7 @@ type RawResults struct {
 	DependencyUpdateToolResults DependencyUpdateToolData
 	FuzzingResults              FuzzingData
 	LicenseResults              LicenseData
+	SBOMResults                 SBOMData
 	MaintainedResults           MaintainedData
 	Metadata                    MetadataData
 	PackagingResults            PackagingData
@@ -168,6 +169,21 @@ type LicenseData struct {
 	LicenseFiles []LicenseFile
 }
 
+// SBOM details.
+type SBOM struct {
+	Name          string // SBOM Filename
+	Schema        string // SBOM Schema
+	SchemaVersion string // SBOM Schema Version
+	URL           string // SBOM Asset URL
+	File          File   // SBOM File Object
+}
+
+// SBOMData contains the raw results for the SBOM check.
+// Some repos may have more than one SBOM.
+type SBOMData struct {
+	SBOMFiles []SBOM
+}
+
 // CodeReviewData contains the raw results
 // for the Code-Review check.
 type CodeReviewData struct {

checks/evaluation/sbom.go

@@ -0,0 +1,106 @@
+// Copyright 2024 OpenSSF Scorecard Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package evaluation
+
+import (
+	"fmt"
+
+	"github.com/ossf/scorecard/v5/checker"
+	sce "github.com/ossf/scorecard/v5/errors"
+	"github.com/ossf/scorecard/v5/finding"
+	"github.com/ossf/scorecard/v5/probes/hasReleaseSBOM"
+	"github.com/ossf/scorecard/v5/probes/hasSBOM"
+)
+
+// SBOM applies the score policy for the SBOM check.
+func SBOM(name string,
+	findings []finding.Finding,
+	dl checker.DetailLogger,
+) checker.CheckResult {
+	// We have 4 unique probes, each should have a finding.
+	expectedProbes := []string{
+		hasSBOM.Probe,
+		hasReleaseSBOM.Probe,
+	}
+
+	if !finding.UniqueProbesEqual(findings, expectedProbes) {
+		e := sce.WithMessage(sce.ErrScorecardInternal, "invalid probe results")
+		return checker.CreateRuntimeErrorResult(name, e)
+	}
+
+	// Compute the score.
+	existsMsg := "SBOM file found in project"
+	releaseMsg := "SBOM file found in release artifacts"
+	score := 0
+	m := make(map[string]bool)
+	for i := range findings {
+		f := &findings[i]
+		switch f.Outcome {
+		case finding.OutcomeNotApplicable:
+			dl.Info(&checker.LogMessage{
+				Type:   finding.FileTypeSource,
+				Offset: 1,
+				Text:   f.Message,
+			})
+		case finding.OutcomeTrue:
+			switch f.Probe {
+			case hasSBOM.Probe:
+				dl.Info(&checker.LogMessage{
+					Type: finding.FileTypeSource,
+					Path: f.Message,
+					Text: existsMsg,
+				})
+				score += scoreProbeOnce(f.Probe, m, 5)
+			case hasReleaseSBOM.Probe:
+				dl.Info(&checker.LogMessage{
+					Type: finding.FileTypeURL,
+					Path: f.Message,
+					Text: releaseMsg,
+				})
+				score += scoreProbeOnce(f.Probe, m, 5)
+			default:
+				e := sce.WithMessage(sce.ErrScorecardInternal, "unknown probe results")
+				return checker.CreateRuntimeErrorResult(name, e)
+			}
+		case finding.OutcomeFalse:
+			switch f.Probe {
+			case hasSBOM.Probe:
+				dl.Warn(&checker.LogMessage{
+					Type: finding.FileTypeSource,
+					Path: f.Message,
+					Text: "SBOM file not found in project",
+				})
+				existsMsg = f.Message
+			case hasReleaseSBOM.Probe:
+				dl.Warn(&checker.LogMessage{
+					Type: finding.FileTypeURL,
+					Path: f.Message,
+					Text: "SBOM file not found in release artifacts",
+				})
+				releaseMsg = f.Message
+			}
+		default:
+			continue // for linting
+		}
+	}
+
+	_, defined := m[hasSBOM.Probe]
+	if !defined {
+		return checker.CreateMinScoreResult(name, "SBOM file not detected")
+	}
+
+	message := fmt.Sprintf("%s. %s.", existsMsg, releaseMsg)
+	return checker.CreateResultWithScore(name, message, score)
+}

checks/evaluation/sbom_test.go

@@ -0,0 +1,95 @@
+// Copyright 2024 OpenSSF Scorecard Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//	http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+package evaluation
+
+import (
+	"testing"
+
+	"github.com/ossf/scorecard/v5/checker"
+	"github.com/ossf/scorecard/v5/finding"
+	scut "github.com/ossf/scorecard/v5/utests"
+)
+
+func TestSBOM(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name     string
+		findings []finding.Finding
+		result   scut.TestReturn
+	}{
+		{
+			name: "Negative outcome = Min Score",
+			findings: []finding.Finding{
+				{
+					Probe:   "hasSBOM",
+					Outcome: finding.OutcomeFalse,
+				},
+				{
+					Probe:   "hasReleaseSBOM",
+					Outcome: finding.OutcomeFalse,
+				},
+			},
+			result: scut.TestReturn{
+				Score:        checker.MinResultScore,
+				NumberOfInfo: 0,
+				NumberOfWarn: 2,
+			},
+		},
+		{
+			name: "Exists in Source: Positive outcome.",
+			findings: []finding.Finding{
+				{
+					Probe:   "hasSBOM",
+					Outcome: finding.OutcomeTrue,
+				},
+				{
+					Probe:   "hasReleaseSBOM",
+					Outcome: finding.OutcomeFalse,
+				},
+			},
+			result: scut.TestReturn{
+				Score:        5,
+				NumberOfInfo: 1,
+				NumberOfWarn: 1,
+			},
+		},
+		{
+			name: "Exists in Release Assets: Max outcome.",
+			findings: []finding.Finding{
+				{
+					Probe:   "hasSBOM",
+					Outcome: finding.OutcomeTrue,
+				},
+				{
+					Probe:   "hasReleaseSBOM",
+					Outcome: finding.OutcomeTrue,
+				},
+			},
+			result: scut.TestReturn{
+				Score:        checker.MaxResultScore,
+				NumberOfInfo: 2,
+				NumberOfWarn: 0,
+			},
+		},
+	}
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			dl := scut.TestDetailLogger{}
+			got := SBOM(tt.name, tt.findings, &dl)
+			scut.ValidateTestReturn(t, tt.name, &tt.result, &got, &dl)
+		})
+	}
+}

checks/raw/sbom.go

@@ -0,0 +1,121 @@
+// Copyright 2024 OpenSSF Scorecard Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package raw
+
+import (
+	"fmt"
+	"regexp"
+
+	"github.com/ossf/scorecard/v5/checker"
+	"github.com/ossf/scorecard/v5/clients"
+	"github.com/ossf/scorecard/v5/finding"
+)
+
+var reRootFile = regexp.MustCompile(`^[^.]([^//]*)$`)
+
+// SBOM retrieves the raw data for the SBOM check.
+func SBOM(c *checker.CheckRequest) (checker.SBOMData, error) {
+	var results checker.SBOMData
+
+	SBOMsFound, lerr := c.RepoClient.ListSBOMs()
+	if lerr != nil {
+		return results, fmt.Errorf("RepoClient.ListSBOMs: %w", lerr)
+	}
+
+	for i := range SBOMsFound {
+		v := SBOMsFound[i]
+
+		results.SBOMFiles = append(results.SBOMFiles,
+			checker.SBOM{
+				File: checker.File{
+					Path: v.Path,
+					Type: finding.FileTypeURL,
+				},
+				Name:          v.Name,
+				Schema:        v.Schema,
+				SchemaVersion: v.SchemaVersion,
+				URL:           v.URL,
+			})
+	}
+
+	releases, lerr := c.RepoClient.ListReleases()
+	if lerr != nil {
+		return results, fmt.Errorf("RepoClient.ListReleases: %w", lerr)
+	}
+
+	releaseSBOMs := checkSBOMReleases(releases)
+	if releaseSBOMs != nil {
+		results.SBOMFiles = append(results.SBOMFiles, releaseSBOMs...)
+	}
+
+	// no SBOMs found in release artifacts or pipelines, continue looking for files
+	repoFiles, err := c.RepoClient.ListFiles(func(string) (bool, error) { return true, nil })
+	if err != nil {
+		return results, fmt.Errorf("error during ListFiles: %w", err)
+	}
+
+	// TODO: Make these two happy path left
+	sourceSBOMs := checkSBOMSource(repoFiles)
+	if sourceSBOMs != nil {
+		results.SBOMFiles = append(results.SBOMFiles, sourceSBOMs...)
+	}
+
+	return results, nil
+}
+
+func checkSBOMReleases(releases []clients.Release) []checker.SBOM {
+	var foundSBOMs []checker.SBOM
+
+	for i := range releases {
+		v := releases[i]
+
+		for _, link := range v.Assets {
+			if !clients.ReSBOMFile.Match([]byte(link.Name)) {
+				continue
+			}
+
+			foundSBOMs = append(foundSBOMs,
+				checker.SBOM{
+					File: checker.File{
+						Path: link.URL,
+						Type: finding.FileTypeURL,
+					},
+					Name: link.Name,
+					URL:  link.URL,
+				})
+		}
+	}
+	return foundSBOMs
+}
+
+func checkSBOMSource(fileList []string) []checker.SBOM {
+	var foundSBOMs []checker.SBOM
+
+	for _, file := range fileList {
+		if clients.ReSBOMFile.MatchString(file) && reRootFile.MatchString(file) {
+			// TODO: parse matching file contents to determine schema & version
+			foundSBOMs = append(foundSBOMs,
+				checker.SBOM{
+					File: checker.File{
+						Path: file,
+						Type: finding.FileTypeSource,
+					},
+					Name: file,
+				})
+		}
+	}
+
+	return foundSBOMs
+}