Skip to content

Commit 7b2df11

Browse files
puercopuerco
authored
Policy struct protobuf definitions (#235)
* Add buf config files Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@carabiner.dev> * Add policy protobuf definitions Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@carabiner.dev> * Add buf config Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev> * buf generate Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev> * Use policy generated from proto Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev> * Add proto machinery and CI test Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev> --------- Signed-off-by: Adolfo Garcia Veytia (puerco) <puerco@carabiner.dev> Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>
1 parent 1f8654f commit 7b2df11

12 files changed

Lines changed: 761 additions & 227 deletions

File tree

‎.github/workflows/go-test.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,21 @@ jobs:
2020
go-version: "1.24"
2121
check-latest: true
2222

23+
- name: Setup Buf
24+
uses: bufbuild/buf-setup-action@a47c93e0b1648d5651a065437926377d060baa99 # v1.50.0
25+
26+
- name: Setup protoc
27+
uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # @v3.0.0
28+
2329
- name: Run Go tests
2430
run: |
2531
go test ./sourcetool/...
2632
2733
- name: Check generated fakes
2834
run: |
2935
hack/verify-fakes.sh
36+
37+
- name: Check protobuf generated codew
38+
run: |
39+
go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
40+
hack/verify-protos.sh

‎Makefile‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,18 @@
1+
BOLD := \033[1m
2+
CYAN := \033[36m
3+
GREEN := \033[32m
4+
WHITE := \033[37m
5+
RESET := \033[0m
6+
7+
.PHONY: help
8+
help:
9+
@printf "${BOLD}${WHITE}SLSA Source Tooling Makefile Help\n=================================${RESET}\n"
10+
@grep -Eh '^[a-zA-Z_-]+:.*?## .*$$' ${MAKEFILE_LIST} | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "${BOLD}${CYAN}%-25s${RESET}%s\n", $$1, $$2}'
11+
112
.PHONY: fakes
213
fakes: ## Rebuild the implementation fakes
314
go generate ./sourcetool/...
415

16+
.PHONY: proto
17+
proto: ## Rebuild the policies and provenance predicate from protocol buffer definitions
18+
buf generate

‎buf.gen.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
2+
# SPDX-License-Identifier: Apache-2.0
3+
---
4+
version: v2
5+
6+
managed:
7+
enabled: true
8+
plugins:
9+
- protoc_builtin: go
10+
out: ./sourcetool/pkg
11+
opt:
12+
- paths=import
13+
- module=github.com/slsa-framework/slsa-source-poc/sourcetool/pkg

‎buf.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
2+
# SPDX-License-Identifier: Apache-2.0
3+
---
4+
version: v2
5+
6+
modules:
7+
- path: proto/v1
8+
lint:
9+
except:
10+
- ENUM_VALUE_PREFIX
11+
- ENUM_ZERO_VALUE_SUFFIX
12+
- PACKAGE_DIRECTORY_MATCH
13+
- PACKAGE_VERSION_SUFFIX
14+
breaking:
15+
except:
16+
- FILE_SAME_GO_PACKAGE
17+
lint:
18+
use:
19+
- STANDARD
20+
- COMMENTS
21+
22+
breaking:
23+
use:
24+
- FILE
25+
- WIRE_JSON

‎hack/verify-protos.sh‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/usr/bin/env bash
2+
3+
set -o errexit
4+
set -o nounset
5+
set -o pipefail
6+
7+
set -o xtrace
8+
9+
source hack/common.sh
10+
11+
make proto
12+
git diff --exit-code || exit_with_msg "Code from protocol definitions is not up to date. Please run 'make proto' and commit the result"

‎proto/v1/policy.proto‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
// SPDX-FileCopyrightText: Copyright 2025 The SLSA Authors
2+
// SPDX-License-Identifier: Apache-2.0
3+
4+
syntax = "proto3";
5+
package ampel.v1;
6+
7+
import "google/protobuf/timestamp.proto";
8+
9+
option go_package = "github.com/slsa-framework/slsa-source-poc/sourcetool/pkg/policy";
10+
11+
// The repository policy definition
12+
message RepoPolicy {
13+
string canonical_repo = 1 [json_name="canonical_repo"];
14+
repeated ProtectedBranch protected_branches = 2 [json_name="protected_branches"];
15+
optional ProtectedTag protected_tag = 3;
16+
}
17+
18+
// When a branch requires multiple controls, they must all be enabled
19+
// at or before 'since'.
20+
message ProtectedBranch {
21+
string name = 1;
22+
google.protobuf.Timestamp since = 2;
23+
// We override this string with slsa.SlsaSourceLevel
24+
string target_slsa_source_level = 3;
25+
bool require_review = 4;
26+
repeated OrgStatusCheckControl org_status_check_controls = 5 [json_name="org_status_check_controls"];
27+
}
28+
29+
// The controls required for protected tags.
30+
message ProtectedTag {
31+
google.protobuf.Timestamp since = 1;
32+
bool tag_hygiene = 2;
33+
}
34+
35+
// Used by orgs to require that specific 'checks' are run on protected
36+
// branches and to associate those checks with a control name to include
37+
// in provenance and VSAs.
38+
// https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets#require-status-checks-to-pass-before-merging
39+
message OrgStatusCheckControl {
40+
// The property to record in the VSA if the conditions are met.
41+
// MUST start with `ORG_SOURCE_`.
42+
// We'll overide this with slsa.ControlName
43+
string property_name = 1;
44+
45+
// These controls have their own start time to enable orgs to enable
46+
// new ones without violating continuity on other controls.
47+
google.protobuf.Timestamp since = 2;
48+
49+
// The name of the 'Status Check' as reported in the GitHub UI & API.
50+
string check_name = 3;
51+
}

‎sourcetool/pkg/policy/marshalers.go‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
package policy
2+
3+
import "encoding/json"
4+
5+
func (branch *ProtectedBranch) MarshalJSON() ([]byte, error) {
6+
type Alias ProtectedBranch
7+
var since string
8+
if branch.GetSince() != nil {
9+
since = branch.GetSince().AsTime().Format("2006-01-02T15:04:05.000Z")
10+
}
11+
12+
return json.Marshal(
13+
&struct {
14+
Since string `json:"since"`
15+
*Alias
16+
}{
17+
Since: since,
18+
Alias: (*Alias)(branch),
19+
},
20+
)
21+
}
22+
23+
func (ctl *OrgStatusCheckControl) MarshalJSON() ([]byte, error) {
24+
type Alias OrgStatusCheckControl
25+
var since string
26+
if ctl.GetSince() != nil {
27+
since = ctl.GetSince().AsTime().Format("2006-01-02T15:04:05.000Z")
28+
}
29+
30+
return json.Marshal(
31+
&struct {
32+
Since string `json:"since"`
33+
*Alias
34+
}{
35+
Since: since,
36+
Alias: (*Alias)(ctl),
37+
},
38+
)
39+
}
40+
41+
func (tag *ProtectedTag) MarshalJSON() ([]byte, error) {
42+
type Alias ProtectedTag
43+
var since string
44+
if tag.GetSince() != nil {
45+
since = tag.GetSince().AsTime().Format("2006-01-02T15:04:05.000Z")
46+
}
47+
48+
return json.Marshal(
49+
&struct {
50+
Since string `json:"since"`
51+
*Alias
52+
}{
53+
Since: since,
54+
Alias: (*Alias)(tag),
55+
},
56+
)
57+
}

0 commit comments

Comments
 (0)