Repository navigation
Validate Yocto documents before upload and fix the purls we inject - #436
aurangzaib048 wants to merge 4 commits into
Conversation
inject_yocto_purls_spdx3 wrote the bare packageUrl, which the SPDX 3.0 JSON-LD context and schema name software_packageUrl, so a Yocto image the schema accepted was refused once a purl had been added to it. It also read only the bare packageVersion and packageUrl, so it dropped the version from the purl of a conformant document and could add a second purl beside an existing software_packageUrl. It now reads either spelling and writes software_packageUrl.
The Yocto pipeline uploaded every document unvalidated. It now checks the document it is about to upload. SPDX 3 must pass its schema, and one that fails is not uploaded and is counted as an error. An SPDX 2 document that fails is uploaded with a warning naming the package, the path and the reason. Yocto writes relationship types SPDX added in 2.3, such as AMENDS, into documents that declare SPDX-2.2, which the 2.2 schema refuses. Nobody running the build can fix that, and refusing it would drop the package from the release.
inject_yocto_purls_spdx22 tagged each purl it added with referenceCategory PACKAGE-MANAGER, the spelling SPDX 2.3 introduced. The 2.2 schema accepts only PACKAGE_MANAGER, so every Yocto package document it touched failed 2.2 validation on account of the purl this tool added. PACKAGE_MANAGER is valid in both 2.2 and 2.3.
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Copilot review overview
Review effort: Lite
Findings: 1
Open (2)
What changed in this PR
Adds schema validation gating to the Yocto upload pipeline and fixes SPDX 2.2 / SPDX 3 PURL property spellings so injected PURLs remain schema-conformant.
Changes:
- Validate SBOMs right before upload, warning+uploading invalid SPDX 2.x but rejecting invalid SPDX 3.
- Fix SPDX 2.2 externalRef category spelling (
PACKAGE_MANAGER) and update tests accordingly. - Fix SPDX 3 injector/tests to write
software_packageUrland read both prefixed/unprefixed spellings.
| File | Description |
|---|---|
| tests/test_yocto_purl.py | Updates expectations for corrected SPDX 2.2/3 spellings and adds validation regression coverage. |
| tests/test_yocto_pipeline.py | Adds pipeline-level tests for “warn+upload SPDX 2.2” vs “reject SPDX 3” validation behavior and updates SPDX 3 fixture. |
| sbomify_action/_yocto/purl.py | Corrects injected SPDX 2.2 referenceCategory and SPDX 3 property names; reads both old/new spellings. |
| sbomify_action/_yocto/pipeline.py | Adds pre-upload validation that warns for SPDX 2.x failures but errors out for SPDX 3 failures. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
I merged master into this branch in 87aeef7. Master had moved 8 commits since the last CI run: the uv group bump, the Dockerfile uv pin, the Linux-only runtime guard and the runtime id fix. None of them touched the files this PR changes, so the merge had no conflicts. ruff, the format check and mypy pass. The full suite passes apart from 26 tests in test_runtimes.py, test_ecosystem_routing.py and test_php_composer.py, which fail the same way on master when run on macOS, because the new guard refuses Linux tool runtimes there. CI runs on Linux. |
There was a problem hiding this comment.
🟡 Changes recommended
The new _check_before_upload() treats “validation skipped” (valid=None) as success, which can allow uploads without any validation or warning when schemas are unavailable.
1 open finding
2 resolved since last review
🧠 Review effort: Lite
| result = validate_sbom_file_auto(sbom_file) | ||
| if result.valid is not False: | ||
| return | ||
| where = f" at {result.error_path}" if result.error_path else "" | ||
| reason = f"SPDX {result.spec_version} document failed validation{where}: {result.error_message}" | ||
| if result.spec_version.startswith("3"): | ||
| raise SBOMValidationError(f"{pkg_name}: {reason}") | ||
| logger.warning(f"{pkg_name}: {reason}. Uploading it anyway.") |
What was wrong
The Yocto pipeline uploaded every document without validating it. Turning validation on as #326 asks turned up three problems:
AMENDS, into documents that declare SPDX-2.2. The 2.2 schema refuses them, and nobody running the build can fix that.PACKAGE-MANAGER, the 2.3 spelling. The 2.2 schema refuses it, so every document we touched failed 2.2 validation because of our own edit.packageUrl. The 3.0 schema refuses it; the property issoftware_packageUrl. It also missedsoftware_packageVersion, so conformant documents got purls with no version.The fix
PACKAGE_MANAGER, which both 2.2 and 2.3 accept.software_packageUrl.Verified
A 2.2 document using AMENDS uploads with a warning that names AMENDS. An invalid SPDX 3 document is not uploaded. A valid Yocto 2.2 package document stays valid after purl injection. Each of these tests fails without its fix. A run against a stub API shows the warning, then one SBOM uploaded and no errors.
Refs #326