Skip to content

Commit 6119157

Browse files
eramongodberamongodb
authored
Add release instructions for static analysis and 3rd party deps (CXX-3009, CXX-3023) (#1143)
* Add EVG task to check augmented SBOM for updates * Split Artifactory and Garasign credential files * CXX-3023 Add instructions to update and report Silk vulnerabilities * CXX-3009 Add instructions to update SSDLC Report sheet with Coverity issues * CXX-3023 Add etc/third_party_vulnerabilities.md * Restrict third party dependencies to bundled sources only * Properly distinguish between SBOM Lite and Augmented SBOM documents * Always print contents of Augmented SBOM in diff * Update Augmented SBOM and include instructions for manual download
1 parent fb2d4f7 commit 6119157

File tree

7 files changed

+341
-33
lines changed

7 files changed

+341
-33
lines changed

‎.evergreen/check-augmented-sbom.sh

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
#!/usr/bin/env bash
2+
3+
set -o errexit
4+
set -o pipefail
5+
6+
command -v podman >/dev/null || {
7+
echo "missing required program podman" 1>&2
8+
exit 1
9+
}
10+
11+
command -v jq >/dev/null || {
12+
echo "missing required program jq" 1>&2
13+
exit 1
14+
}
15+
16+
podman login --password-stdin --username "${ARTIFACTORY_USER:?}" artifactory.corp.mongodb.com <<<"${ARTIFACTORY_PASSWORD:?}"
17+
18+
silkbomb_download_flags=(
19+
# Avoid bumping version or timestamp in diff.
20+
--no-update-sbom-version
21+
--no-update-timestamp
22+
23+
--silk-asset-group mongo-cxx-driver
24+
-o /pwd/etc/augmented.sbom.json.new
25+
)
26+
27+
podman run \
28+
--env-file <(
29+
echo "SILK_CLIENT_ID=${SILK_CLIENT_ID:?}"
30+
echo "SILK_CLIENT_SECRET=${SILK_CLIENT_SECRET:?}"
31+
) \
32+
-it --rm -v "$(pwd):/pwd" \
33+
artifactory.corp.mongodb.com/release-tools-container-registry-public-local/silkbomb:1.0 \
34+
download "${silkbomb_download_flags[@]:?}"
35+
36+
[[ -f ./etc/augmented.sbom.json.new ]] || {
37+
echo "failed to download Augmented SBOM from Silk" 1>&2
38+
exit 1
39+
}
40+
41+
echo "Comparing Augmented SBOM..."
42+
43+
# Allow task to upload the augmented SBOM despite failed diff.
44+
if ! diff -sty --left-column -W 200 \
45+
<(jq ./etc/augmented.sbom.json) \
46+
<(jq ./etc/augmented.sbom.json.new) >|diff.txt; then
47+
declare status
48+
status='{"status":"failed", "type":"test", "should_continue":true, "desc":"detected significant changes in Augmented SBOM"}'
49+
curl -sS -d "${status:?}" -H "Content-Type: application/json" -X POST localhost:2285/task_status || true
50+
fi
51+
52+
cat diff.txt
53+
54+
echo "Comparing Augmented SBOM... done."

‎.mci.yml

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -700,6 +700,43 @@ functions:
700700
content_type: text/html
701701
display_name: Scan Build Report
702702

703+
"check augmented sbom":
704+
- command: subprocess.exec
705+
type: test
706+
params:
707+
working_dir: "mongo-cxx-driver"
708+
binary: bash
709+
include_expansions_in_env:
710+
- ARTIFACTORY_USER
711+
- ARTIFACTORY_PASSWORD
712+
- SILK_CLIENT_ID
713+
- SILK_CLIENT_SECRET
714+
args:
715+
- -c
716+
- .evergreen/check-augmented-sbom.sh
717+
718+
"upload augmented sbom":
719+
- command: s3.put
720+
params:
721+
aws_key: ${aws_key}
722+
aws_secret: ${aws_secret}
723+
remote_file: ${project}/${build_variant}/${revision}/${version_id}/${build_id}/silk/augmented.sbom.json
724+
bucket: mciuploads
725+
permissions: public-read
726+
local_file: mongo-cxx-driver/etc/augmented.sbom.json.new
727+
content_type: application/json
728+
display_name: Augmented SBOM
729+
- command: s3.put
730+
params:
731+
aws_key: ${aws_key}
732+
aws_secret: ${aws_secret}
733+
remote_file: ${project}/${build_variant}/${revision}/${version_id}/${build_id}/silk/augmented.sbom.json.diff
734+
bucket: mciuploads
735+
permissions: public-read
736+
local_file: mongo-cxx-driver/diff.txt
737+
content_type: application/json
738+
display_name: Augmented SBOM (Diff)
739+
703740
#######################################
704741
# Post Task #
705742
#######################################
@@ -1230,6 +1267,14 @@ tasks:
12301267
BSONCXX_POLYFILL: std
12311268
- func: "upload scan artifacts"
12321269

1270+
- name: silk-check-augmented-sbom
1271+
run_on: rhel8-latest-small
1272+
tags: [silk]
1273+
commands:
1274+
- func: "setup"
1275+
- func: "check augmented sbom"
1276+
- func: "upload augmented sbom"
1277+
12331278
task_groups:
12341279
- name: tg-abi-stability
12351280
max_hosts: -1
@@ -2171,3 +2216,8 @@ buildvariants:
21712216
display_name: scan-build-matrix
21722217
tasks:
21732218
- name: .scan-build-matrix
2219+
2220+
- name: silk
2221+
display_name: silk
2222+
tasks:
2223+
- name: .silk

‎etc/augmented.sbom.json

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
{
2+
"components": [
3+
{
4+
"bom-ref": "pkg:github/mnmlstc/[email protected]",
5+
"copyright": "Copyright \u00a9 2013 - 2014 MNMLSTC",
6+
"externalReferences": [
7+
{
8+
"type": "distribution",
9+
"url": "https://github.com/mnmlstc/core/archive/refs/tags/v1.1.0.tar.gz"
10+
},
11+
{
12+
"type": "website",
13+
"url": "https://github.com/mnmlstc/core/tree/v1.1.0"
14+
}
15+
],
16+
"group": "mnmlstc",
17+
"licenses": [
18+
{
19+
"license": {
20+
"id": "Apache-2.0"
21+
}
22+
}
23+
],
24+
"name": "core",
25+
"purl": "pkg:github/mnmlstc/[email protected]",
26+
"type": "library",
27+
"version": "v1.1.0"
28+
},
29+
{
30+
"bom-ref": "pkg:github/mongodb/[email protected]",
31+
"copyright": "Copyright 2009-present MongoDB, Inc.",
32+
"externalReferences": [
33+
{
34+
"type": "distribution",
35+
"url": "https://github.com/mongodb/mongo-c-driver/archive/refs/tags/v1.25.0.tar.gz"
36+
},
37+
{
38+
"type": "website",
39+
"url": "https://github.com/mongodb/mongo-c-driver/tree/v1.25.0"
40+
}
41+
],
42+
"group": "mongodb",
43+
"licenses": [
44+
{
45+
"license": {
46+
"id": "Apache-2.0"
47+
}
48+
}
49+
],
50+
"name": "mongo-c-driver",
51+
"purl": "pkg:github/mongodb/[email protected]",
52+
"type": "library",
53+
"version": "v1.25.0"
54+
}
55+
],
56+
"dependencies": [
57+
{
58+
"ref": "pkg:github/mnmlstc/[email protected]"
59+
},
60+
{
61+
"ref": "pkg:github/mongodb/[email protected]"
62+
}
63+
],
64+
"metadata": {
65+
"timestamp": "2024-06-06T18:10:31.789025+00:00",
66+
"tools": [
67+
{
68+
"externalReferences": [
69+
{
70+
"type": "build-system",
71+
"url": "https://github.com/CycloneDX/cyclonedx-python-lib/actions"
72+
},
73+
{
74+
"type": "distribution",
75+
"url": "https://pypi.org/project/cyclonedx-python-lib/"
76+
},
77+
{
78+
"type": "documentation",
79+
"url": "https://cyclonedx-python-library.readthedocs.io/"
80+
},
81+
{
82+
"type": "issue-tracker",
83+
"url": "https://github.com/CycloneDX/cyclonedx-python-lib/issues"
84+
},
85+
{
86+
"type": "license",
87+
"url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/LICENSE"
88+
},
89+
{
90+
"type": "release-notes",
91+
"url": "https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md"
92+
},
93+
{
94+
"type": "vcs",
95+
"url": "https://github.com/CycloneDX/cyclonedx-python-lib"
96+
},
97+
{
98+
"type": "website",
99+
"url": "https://github.com/CycloneDX/cyclonedx-python-lib/#readme"
100+
}
101+
],
102+
"name": "cyclonedx-python-lib",
103+
"vendor": "CycloneDX",
104+
"version": "6.4.4"
105+
}
106+
]
107+
},
108+
"serialNumber": "urn:uuid:dd68fbb0-f77c-4bb9-90cd-606dd854f301",
109+
"version": 1,
110+
"$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
111+
"bomFormat": "CycloneDX",
112+
"specVersion": "1.5"
113+
}

‎etc/cyclonedx.sbom.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@
6262
}
6363
],
6464
"metadata": {
65-
"timestamp": "2024-05-09T15:50:40.695420+00:00",
65+
"timestamp": "2024-06-05T21:16:58.419485+00:00",
6666
"tools": [
6767
{
6868
"externalReferences": [

‎etc/garasign_dist_file.sh

Lines changed: 11 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -19,25 +19,18 @@ if ! command -v gpg >/dev/null; then
1919
echo "gpg is required to verify distribution tarball signature" 1>&2
2020
fi
2121

22-
creds=~/.secrets/garasign-creds.txt
22+
artifactory_creds=~/.secrets/artifactory-creds.txt
23+
garasign_creds=~/.secrets/garasign-creds.txt
2324

24-
if [[ ! -f "${creds:?}" ]]; then
25-
echo "missing file ${creds:?}" 1>&2
26-
exit 1
27-
fi
28-
29-
# Avoid conflict/use of creds defined in the environment.
30-
unset ARTIFACTORY_USER
31-
unset ARTIFACTORY_PASSWORD
32-
unset GRS_CONFIG_USER1_USERNAME
33-
unset GRS_CONFIG_USER1_PASSWORD
34-
35-
. "${creds:?}"
25+
unset ARTIFACTORY_USER ARTIFACTORY_PASSWORD
26+
. "${artifactory_creds:?}"
27+
: "${ARTIFACTORY_USER:?"missing ARTIFACTORY_USER in ${artifactory_creds:?}"}"
28+
: "${ARTIFACTORY_PASSWORD:?"missing ARTIFACTORY_PASSWORD in ${artifactory_creds:?}"}"
3629

37-
: "${ARTIFACTORY_USER:?"missing ARTIFACTORY_USER in ${creds:?}"}"
38-
: "${ARTIFACTORY_PASSWORD:?"missing ARTIFACTORY_PASSWORD in ${creds:?}"}"
39-
: "${GRS_CONFIG_USER1_USERNAME:?"missing GRS_CONFIG_USER1_USERNAME in ${creds:?}"}"
40-
: "${GRS_CONFIG_USER1_PASSWORD:?"missing GRS_CONFIG_USER1_PASSWORD in ${creds:?}"}"
30+
unset GRS_CONFIG_USER1_USERNAME GRS_CONFIG_USER1_PASSWORD
31+
. "${garasign_creds:?}"
32+
: "${GRS_CONFIG_USER1_USERNAME:?"missing GRS_CONFIG_USER1_USERNAME in ${garasign_creds:?}"}"
33+
: "${GRS_CONFIG_USER1_PASSWORD:?"missing GRS_CONFIG_USER1_PASSWORD in ${garasign_creds:?}"}"
4134

4235
dist_file="${1:?}"
4336
dist_file_signed="${dist_file:?}.asc"
@@ -48,7 +41,7 @@ plugin_commands=(
4841
gpg --yes -v --armor -o "${dist_file_signed:?}" --detach-sign "${dist_file:?}"
4942
)
5043
"${launcher:?}" run \
51-
--env-file="${creds:?}" \
44+
--env-file="${garasign_creds:?}" \
5245
-e "PLUGIN_COMMANDS=${plugin_commands[*]:?}" \
5346
--rm \
5447
-v "$(pwd):$(pwd)" \

0 commit comments

Comments
 (0)