Repository navigation
fix(sbom): revert Hermeto attribution requirement - #1950
joejstuart wants to merge 2 commits into
Conversation
Remove the CycloneDX and SPDX attribution rules added in EC-2016 because inherited base-image dependencies can trigger false violations. Remove the unused rule data, validation, tests, and generated documentation while preserving other Hermeto policies. Ref: https://redhat.atlassian.net/browse/EC-2224 Assisted-by: Codex
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Remove vendored PURL-type configuration policy/lib/rule_data/rule_data.rego, policy/lib/sbom/sbom.rego, policy/release/sbom/sbom_test.rego |
The default vendored_purl_types value, its validation, and its validation test were removed. |
Remove SBOM rules and tests policy/release/sbom_cyclonedx/*, policy/release/sbom_spdx/* |
The CycloneDX and SPDX Hermeto-attribution rules and related tests and fixtures were removed. Test helpers no longer override vendored_purl_types. |
Remove policy documentation references antora/docs/modules/ROOT/pages/packages/release_sbom_*.adoc, antora/docs/modules/ROOT/pages/release_policy.adoc, antora/docs/modules/ROOT/partials/release_policy_nav.adoc |
Rule descriptions, policy collection entries, and navigation links for both checks were removed. The repository and ref entries in the security policy collection were reordered. |
Priority:
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Bug fix
Suggested reviewers: acepresso, bohdanmar
Merge Risk: 
597cf
-
No actionable regression is identified in the supplied change context. The change is mergeable after normal checks.
Pre-merge checks: 
-
Check name Status Explanation Title check The title "fix(sbom): revert Hermeto attribution requirement" matches the main change. The PR removes the Hermeto attribution rules for CycloneDX and SPDX, plus the vendored_purl_types default and val… Description check The description follows the template's intent. It states what changed and why (false violations for inherited base-image packages). It lists the changes, a validation section, and a Jira link. The tem… Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Title check
-
Explanation
The title "fix(sbom): revert Hermeto attribution requirement" matches the main change. The PR removes the Hermeto attribution rules for CycloneDX and SPDX, plus the vendored_purl_types default and validation. It uses a conventional commit prefix and is concise.
Full details: Description check
-
Explanation
The description follows the template's intent. It states what changed and why (false violations for inherited base-image packages). It lists the changes, a validation section, and a Jira link. The template's "What", "Why", and "Tickets" headings are not used verbatim, but the required information is present. The Tickets content is provided as a Jira link (EC-2224).
Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
-
Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
Comment @coderabbitai help to get the list of available commands.
|
<!-- fullsend:risk-assessment --> DetailsTier 1 signals unchanged from prior assessment (large blast radius, no protected paths, no CI/dependency changes, deletion-only); high author contention (8 distinct authors in 90d) and the PR being a revert elevate Tier 2 to ~3.1, but this is offset by low churn, clear Jira alignment, and rollback-safe pure-deletion scope; composite 0.50×2.1 + 0.30×3.1 + 0.20×2.3 ≈ 2.5 rounds to 2, consistent with prior score of 2. Previous run<!-- fullsend:risk-assessment --> DetailsPure-deletion revert of a recently added feature (Hermeto attribution) across 11 SBOM policy files with large blast radius and high author contention (7 authors in 90d), but no protected paths, no CI changes, no dependency updates, and a well-known non-bot author; composite 2.2 rounds to 2. |
|
Looks good to me <!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 --> Previous runLooks good to me Labels: PR fixes false-violation policy rules; risk assessment scores moderate <!-- fullsend:review-findings-v2:eyJ2ZXJzaW9uIjoyLCJmaW5kaW5ncyI6W119 --> |
fullsend-ai-review
Bot
added
requires-manual-review
Keep the index order produced by make generate-docs so the CI clean-tree check passes after the EC-2224 rollback. Ref: https://redhat.atlassian.net/browse/EC-2224 Assisted-by: Codex
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
fullsend-ai-review
Bot
added
ready-for-merge
|
/fs-fix rebase on top of main and resolve conflicts |
Summary
Remove the Hermeto attribution requirement added in EC-2016. SBOM packages inherited from a base image can lack Hermeto attribution even when the component itself has no dependencies in that ecosystem, so the CycloneDX and SPDX rules can produce false violations.
Changes
sbom_cyclonedx.hermeto_attribution_requiredandsbom_spdx.hermeto_attribution_required.vendored_purl_typesdefault and schema validation. An absent or invalid value no longer drives an attribution check; other rule data validation remains.Acceptance criteria and traceability
hermeto_attribution_requireddeny rules are removed frompolicy/release/sbom_cyclonedx/andpolicy/release/sbom_spdx/; the check emits nothing whethervendored_purl_typesis present, absent, or invalid.golang/cargodefault inpolicy/lib/rule_data/and its validation inpolicy/lib/sbom/.make cipasses.Validation
make ci— passed: 1,206 policy tests, 100% reported coverage, acceptance tests, lint, format, and docs checks.git diff --check— passed.Jira: https://redhat.atlassian.net/browse/EC-2224