fix: accept from-provenance repos as scm authentic#1131
Merged
Conversation
behnazh-w
reviewed
Jul 22, 2025
behnazh-w
left a comment
Member
There was a problem hiding this comment.
Can you please pick an integration test that generates a provenance and make sure the scm authenticity passes?
Also, the description of the check on the index.rst needs to be adjusted.
Signed-off-by: Ben Selwyn-Smith <benselwynsmith@googlemail.com>
…nce available integration test Signed-off-by: Ben Selwyn-Smith <benselwynsmith@googlemail.com>
Signed-off-by: Ben Selwyn-Smith <benselwynsmith@googlemail.com>
Signed-off-by: Ben Selwyn-Smith <benselwynsmith@googlemail.com>
b36d0b3 to
b144f9c
Compare
behnazh-w
previously approved these changes
Jul 23, 2025
behnazh-w
reviewed
Jul 23, 2025
…rifier hierarchy Signed-off-by: Ben Selwyn-Smith <benselwynsmith@googlemail.com>
behnazh-w
previously approved these changes
Jul 28, 2025
Signed-off-by: Ben Selwyn-Smith <benselwynsmith@googlemail.com>
behnazh-w
approved these changes
Jul 29, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR updates the SCM Authenticity check to allow acceptance of repository URLs found from provenance as being authentic.
Description of changes
The check is changed to rely entirely on the repo verification results produced during analysis. Previously the check would reject any non-Maven PURLs.
The final confidence value for
PASSEDresults is now reported asHIGHif the reason isfrom_provenance.The class hierarchy of the repo verifiers has been extended to support repository verification from provenance. The new hierarchy is as follows:
RepoVerifierBase, the abstract base class exists to provide theverify_repofunction stub.RepoVerifierFromProvenanceis an implementation ofRepoVerifierBasethat provides the from-repo functionality in itsverify_repofunctionRepoVerifierToolSpecificis an abstract class that inherits the functionality ofRepoVerifierFromProvenancewhile providing an abstract property for subclass defined build tools (specific_tool), an abstract functionverify_by_toolfor tool specific functionality, and a pre-definedverify_repofunction that makes use of theRepoVerifierFromProvenancefunctionality before calling theverify_by_toolfunction.RepoVerifierMaven,RepoVerifierGradle, and future classes inherit fromRepoVerifierToolSpecificand must provide their own specific functionality in theverify_by_toolfunction, and their build tool in thespecific_toolproperty.The integration test
provenance_availableis renamed topypi_toga_provenance_authenticand re-used for this fix to demonstrate that a PyPI package can pass the SCM authenticity check.Related issues
Closes #1128