feat: add pypi attestation discovery#1067

Merged

benmss merged 15 commits into

mainfrom

947-discover-pypi-attestation

May 12, 2025

benmss commented Apr 24, 2025

Contributor

Summary

This PR adds discovery of PyPI attestation. URLs to these attestation files are sought via the deps.dev API.

Description of changes

DepsDevRepoFinder was updated to use the DepsDevService, ensuring consistent and easily configurable use of the API
Tests were added for DepsDevRepoFinder functions (they were not added previously), including for the functions that PyPI attestation discovery relies upon.
PyPI attestations do not have a predicate. The pypi-attestation is used to extract information from the attestation certificate. This information is coerced into a predicate for use elsewhere within Macaron.
Addition of an integration test case using the ultralytics Python library as its target.

Related issues

Closes #947

benmss self-assigned this

oracle-contributor-agreement Bot added the OCA Verified label

benmss force-pushed the 947-discover-pypi-attestation branch 2 times, most recently from 2df212b to 6d7cf95 Compare

April 24, 2025 06:31

benmss marked this pull request as ready for review

April 24, 2025 13:00

benmss requested review from behnazh-w and tromai as code owners

April 24, 2025 13:00

tromai reviewed

View reviewed changes

src/macaron/provenance/provenance_extractor.py

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/package_registry/deps_dev.py Outdated

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/provenance/loader.py

tromai reviewed

View reviewed changes

src/macaron/provenance/provenance_finder.py Outdated

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/package_registry/deps_dev.py Outdated

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/package_registry/deps_dev.py Outdated

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/package_registry/deps_dev.py Outdated

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/package_registry/deps_dev.py Outdated

tromai reviewed

View reviewed changes

src/macaron/repo_finder/repo_finder_deps_dev.py Outdated

tromai reviewed

View reviewed changes

src/macaron/repo_finder/repo_finder_deps_dev.py

tromai reviewed

View reviewed changes

src/macaron/repo_finder/repo_finder_deps_dev.py

tromai reviewed

View reviewed changes

src/macaron/repo_finder/repo_finder_deps_dev.py

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/provenance/loader.py Outdated

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/provenance/loader.py

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/provenance/loader.py Outdated

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/provenance/loader.py Outdated

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/provenance/loader.py Outdated

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/provenance/loader.py Outdated

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/provenance/loader.py Outdated

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/provenance/loader.py Outdated

tromai reviewed

View reviewed changes

tests/repo_finder/test_repo_finder_deps_dev.py

tromai reviewed

View reviewed changes

tests/repo_finder/test_repo_finder_deps_dev.py Outdated

tromai reviewed

View reviewed changes

tests/repo_finder/test_repo_finder_deps_dev.py Outdated

tromai suggested changes

View reviewed changes

tromai left a comment

Contributor

I have finished my round of review. Thank you.

tromai reviewed

View reviewed changes

src/macaron/slsa_analyzer/provenance/loader.py Outdated

tromai previously approved these changes

View reviewed changes

tromai left a comment

Contributor

LGTM. Thanks for addressing the feedbacks.

behnazh-w previously approved these changes

View reviewed changes

benmss force-pushed the 947-discover-pypi-attestation branch from aee8b44 to 2620a0a Compare

May 12, 2025 07:24

benmss added 15 commits

May 12, 2025 20:22


          feat: add pypi attestation discovery

8db88a2

Signed-off-by: Ben Selwyn-Smith <benselwynsmith@googlemail.com>


          chore: keep encoding of purls consistent

53d5807

Signed-off-by: Ben Selwyn-Smith <benselwynsmith@googlemail.com>


          chore: add config to repo finder tests

8797d7a

Signed-off-by: Ben Selwyn-Smith <benselwynsmith@googlemail.com>


          chore: use SplitResult type hint

b6b7fd3

Signed-off-by: Ben Selwyn-Smith <benselwynsmith@googlemail.com>


          chore: replace library used for x509 extraction

c670305

Signed-off-by: Ben Selwyn-Smith <benselwynsmith@googlemail.com>


          chore: update pyproject.toml

b2cfab1

Signed-off-by: Ben Selwyn-Smith <benselwynsmith@googlemail.com>


          chore: remove comment

Signed-off-by: Ben Selwyn-Smith <benselwynsmith@googlemail.com>


          chore: address PR feedback

198c853

Signed-off-by: Ben Selwyn-Smith <benselwynsmith@googlemail.com>


          chore: minor fix

446b1b4

Signed-off-by: Ben Selwyn-Smith <benselwynsmith@googlemail.com>


          chore: minor fix

b78a06d

Signed-off-by: Ben Selwyn-Smith <benselwynsmith@googlemail.com>


          chore: add custom predicate doc string

424a44c

Signed-off-by: Ben Selwyn-Smith <benselwynsmith@googlemail.com>


          chore: address PR feedback

0d7280a

Signed-off-by: Ben Selwyn-Smith <benselwynsmith@googlemail.com>


          chore: add example PURL endpoint

25d0efb

Signed-off-by: Ben Selwyn-Smith <benselwynsmith@googlemail.com>


          chore: fix predicate check

545a603

Signed-off-by: Ben Selwyn-Smith <benselwynsmith@googlemail.com>


          chore: remove github attestation related change

57f4346

Signed-off-by: Ben Selwyn-Smith <benselwynsmith@googlemail.com>

benmss dismissed stale reviews from behnazh-w and tromai via

57f4346

May 12, 2025 10:24

benmss force-pushed the 947-discover-pypi-attestation branch from 2620a0a to 57f4346 Compare

May 12, 2025 10:24

tromai approved these changes

View reviewed changes

behnazh-w approved these changes

View reviewed changes

benmss merged commit 4b20c18 into main

11 checks passed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels