fix: ignore linked automatic baselines

Author: bomly-guy

dev-docs/ARCHITECTURE.md

@@ -220,10 +220,12 @@ projects. Discovery happens during normal target preparation: scan and explain
 read the materialized project tree, including repositories cloned through
 `--url`, while Git diff independently reads the base and head trees. A detected
 baseline is logged with its path, entry count, selection mode, and target kind;
-automatic discovery rejects a symbolic-link `.bomly` directory or baseline
-file so repository content cannot redirect the read outside the materialized
-target. Explicit baseline paths remain trusted user-selected inputs and may
-refer outside the project or through a symbolic link. Each evaluation logs
+automatic discovery warns and behaves as though no baseline exists when path
+inspection finds a symbolic-link `.bomly` directory or baseline file. This
+rejects discovered links but cannot prevent another process from replacing a
+path between inspection and reading. Explicit baseline paths remain trusted
+user-selected inputs and may refer outside the project or through a symbolic
+link. Each evaluation logs
 findings evaluated and accepted. Output receives ordinary findings whose policy
 status may be `suppressed` through `Finding.PolicyStatus` / `policy_status`, and
 no baseline-specific output model or pipeline stage exists. Renaming the

docs/AUDITORS.md

@@ -163,9 +163,10 @@ A project may commit `.bomly/baseline.json` to suppress accepted package
 findings without removing them from reports. Policy-status resolution is part of
 auditing: auditors first emit ordinary findings, then the audit stage marks
 compatible entries `suppressed`. It never removes a finding or suppresses
-pipeline diagnostics. Automatic discovery rejects symbolic links at the
-conventional baseline path; an explicit `--baseline <path>` remains a
-trusted user-selected path. See [Finding Baselines](BASELINES.md).
+pipeline diagnostics. If automatic discovery finds a symbolic link at the
+conventional baseline path, Bomly warns and behaves as though no baseline
+exists. An explicit `--baseline <path>` remains a trusted user-selected
+path. See [Finding Baselines](BASELINES.md).
 
 ## See also
 

docs/BASELINES.md

@@ -49,11 +49,12 @@ with its path, entry count, selection mode, and target kind. Audit completion
 logs include the baseline path, entries, findings evaluated, and findings
 accepted, including when those counts are zero.
 
-For automatic discovery, `.bomly` and `baseline.json` must not be symbolic
-links. Bomly rejects links so repository content cannot redirect the automatic
-read outside the project. An explicit `--baseline <path>` is different: it is a
-trusted path selected by the user and may refer to a symbolic link or a file
-outside the project.
+If automatic discovery sees a symbolic-link `.bomly` directory or
+`baseline.json`, Bomly warns and behaves as though no project baseline exists.
+This rejects links discovered during path inspection; it does not protect
+against another process replacing a path between inspection and reading. An
+explicit `--baseline <path>` is different: it is a trusted path selected by the
+user and may refer to a symbolic link or a file outside the project.
 
 Container targets have no reliable project root, so they require an absolute
 baseline path. For a standalone SBOM file, automatic discovery starts beside

internal/baseline/baseline.go

@@ -24,6 +24,8 @@ const (
 	DefaultRelativePath = ".bomly/baseline.json"
 )
 
+var errAutomaticBaselineSymlink = errors.New("automatic baseline path uses a symbolic link")
+
 // Document is a portable collection of package-specific finding entries.
 type Document struct {
 	SchemaVersion string  `json:"schema_version"`
@@ -206,6 +208,13 @@ func ResolversForTarget(selection string, target sdk.ExecutionTarget, logger *za
 	}
 	if automatic {
 		if err := validateAutomaticPath(target, path); err != nil {
+			if errors.Is(err, errAutomaticBaselineSymlink) {
+				logger.Warn("baseline: ignored linked project policy",
+					zap.String("path", path),
+					zap.String("target_kind", string(target.Kind)),
+					zap.Error(err))
+				return LoadResult{}, nil
+			}
 			return LoadResult{}, err
 		}
 	}
@@ -248,6 +257,8 @@ func validateAutomaticPath(target sdk.ExecutionTarget, path string) error {
 	if err != nil {
 		return fmt.Errorf("check automatic baseline path %q: %w", path, err)
 	}
+	// ResolvePath currently builds this path from a constant relative name.
+	// Keep the escape check as defense in depth if path construction changes.
 	if relative == ".." || strings.HasPrefix(relative, ".."+string(os.PathSeparator)) || filepath.IsAbs(relative) {
 		return fmt.Errorf("automatic baseline path %q escapes the project root", path)
 	}
@@ -260,14 +271,17 @@ func validateAutomaticPath(target sdk.ExecutionTarget, path string) error {
 		current = filepath.Join(current, component)
 		info, err := os.Lstat(current)
 		if errors.Is(err, os.ErrNotExist) {
+			// A dangling link is returned by Lstat and handled below. ErrNotExist
+			// therefore means a normal path component is absent.
 			return nil
 		}
 		if err != nil {
 			return fmt.Errorf("inspect automatic baseline path %q: %w", current, err)
 		}
 		if info.Mode()&os.ModeSymlink != 0 {
 			return fmt.Errorf(
-				"automatic baseline path %q uses symbolic link %q; use --baseline none to disable it or --baseline <path> to select a trusted file",
+				"%w: %q resolves through %q",
+				errAutomaticBaselineSymlink,
 				path,
 				current,
 			)

internal/baseline/baseline_test.go

@@ -273,7 +273,7 @@ func TestResolversForTargetHandlesOptionalRequiredAndURLPolicies(t *testing.T) {
 	}
 }
 
-func TestResolversForTargetRejectsSymlinksOnlyForAutomaticSelection(t *testing.T) {
+func TestResolversForTargetIgnoresAutomaticSymlinksAndAllowsExplicitSelection(t *testing.T) {
 	if runtime.GOOS == "windows" {
 		t.Skip("symlink creation requires elevated privileges on Windows")
 	}
@@ -302,11 +302,21 @@ func TestResolversForTargetRejectsSymlinksOnlyForAutomaticSelection(t *testing.T
 			}
 			target := sdk.ExecutionTarget{Kind: targetKind, Location: root}
 
-			if _, err := ResolversForTarget("auto", target, nil); err == nil ||
-				!strings.Contains(err.Error(), "uses symbolic link") {
-				t.Fatalf("automatic symlink error = %v", err)
+			core, logs := observer.New(zap.WarnLevel)
+			result, err := ResolversForTarget("auto", target, zap.New(core))
+			if err != nil || len(result.Resolvers) != 0 || result.Path != "" {
+				t.Fatalf("automatic symlink result = %#v, %v", result, err)
 			}
-			result, err := ResolversForTarget(link, target, nil)
+			warnings := logs.FilterMessage("baseline: ignored linked project policy")
+			if warnings.Len() != 1 {
+				t.Fatalf("automatic symlink warnings = %#v", logs.All())
+			}
+			fields := warnings.All()[0].ContextMap()
+			if fields["path"] != link || fields["target_kind"] != string(targetKind) ||
+				!strings.Contains(fmt.Sprint(fields["error"]), "resolves through") {
+				t.Fatalf("automatic symlink warning fields = %#v", fields)
+			}
+			result, err = ResolversForTarget(link, target, nil)
 			if err != nil || len(result.Resolvers) != 1 || result.Automatic {
 				t.Fatalf("explicit trusted symlink = %#v, %v", result, err)
 			}
@@ -323,9 +333,13 @@ func TestResolversForTargetRejectsSymlinksOnlyForAutomaticSelection(t *testing.T
 			}
 			target := sdk.ExecutionTarget{Kind: targetKind, Location: root}
 
-			if _, err := ResolversForTarget("", target, nil); err == nil ||
-				!strings.Contains(err.Error(), "uses symbolic link") {
-				t.Fatalf("automatic directory symlink error = %v", err)
+			core, logs := observer.New(zap.WarnLevel)
+			result, err := ResolversForTarget("", target, zap.New(core))
+			if err != nil || len(result.Resolvers) != 0 || result.Path != "" {
+				t.Fatalf("automatic directory symlink result = %#v, %v", result, err)
+			}
+			if logs.FilterMessage("baseline: ignored linked project policy").Len() != 1 {
+				t.Fatalf("automatic directory symlink warnings = %#v", logs.All())
 			}
 		})
 	}

internal/support/component_docs.go

@@ -504,9 +504,10 @@ A project may commit `+"`.bomly/baseline.json`"+` to suppress accepted package
 findings without removing them from reports. Policy-status resolution is part of
 auditing: auditors first emit ordinary findings, then the audit stage marks
 compatible entries `+"`suppressed`"+`. It never removes a finding or suppresses
-pipeline diagnostics. Automatic discovery rejects symbolic links at the
-conventional baseline path; an explicit `+"`--baseline <path>`"+` remains a
-trusted user-selected path. See [Finding Baselines](BASELINES.md).
+pipeline diagnostics. If automatic discovery finds a symbolic link at the
+conventional baseline path, Bomly warns and behaves as though no baseline
+exists. An explicit `+"`--baseline <path>`"+` remains a trusted user-selected
+path. See [Finding Baselines](BASELINES.md).
 
 ## See also