155 lines
6.4 KiB
Python
155 lines
6.4 KiB
Python
"""The generated SBOM: shape, completeness, and the properties it is relied on for.
|
|
|
|
The point of shipping an SBOM to an air-gapped site is answering "are we exposed
|
|
to this CVE, and where" without scanning the box. That only works if the document
|
|
actually lists everything that ships, at the right versions, with identifiers a
|
|
scanner recognises. These tests hold it to that.
|
|
"""
|
|
import json
|
|
import subprocess
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
REPO = Path(__file__).resolve().parents[1]
|
|
GENERATOR = REPO / 'scripts' / 'generate_sbom.py'
|
|
FIXED_TIMESTAMP = '2026-01-01T00:00:00Z'
|
|
|
|
|
|
def generate(tmp_path, name='sbom.cdx.json'):
|
|
out = tmp_path / name
|
|
result = subprocess.run(
|
|
[sys.executable, str(GENERATOR), str(REPO), '-o', str(out),
|
|
'--timestamp', FIXED_TIMESTAMP],
|
|
capture_output=True, text=True)
|
|
assert result.returncode == 0, result.stderr
|
|
return json.loads(out.read_text()), out
|
|
|
|
|
|
@pytest.fixture(scope='module')
|
|
def sbom(tmp_path_factory):
|
|
document, _ = generate(tmp_path_factory.mktemp('sbom'))
|
|
return document
|
|
|
|
|
|
def test_is_valid_cyclonedx(sbom):
|
|
assert sbom['bomFormat'] == 'CycloneDX'
|
|
assert sbom['specVersion'] == '1.6'
|
|
assert sbom['serialNumber'].startswith('urn:uuid:')
|
|
assert sbom['version'] == 1
|
|
|
|
|
|
def test_carries_the_ntia_minimum_elements(sbom):
|
|
"""Supplier, component name, version, unique identifier, dependency
|
|
relationship, author, timestamp."""
|
|
meta = sbom['metadata']
|
|
assert meta['supplier']['name']
|
|
assert meta['authors']
|
|
assert meta['timestamp'] == FIXED_TIMESTAMP
|
|
assert meta['component']['name'] and meta['component']['version']
|
|
assert sbom['dependencies']
|
|
for component in sbom['components']:
|
|
assert component['name']
|
|
assert component['version']
|
|
assert component['purl'], '%s has no unique identifier' % component['name']
|
|
|
|
|
|
def test_every_python_pin_is_present(sbom):
|
|
"""The SBOM must not be quietly narrower than what the installer installs."""
|
|
import re
|
|
pinned = set()
|
|
for line in (REPO / 'requirements.txt').read_text().splitlines():
|
|
match = re.match(r'^([A-Za-z0-9._-]+)==([^\s;\\]+)', line.strip())
|
|
if match:
|
|
pinned.add((match.group(1).lower().replace('_', '-'), match.group(2)))
|
|
listed = {(c['name'].lower().replace('_', '-'), c['version'])
|
|
for c in sbom['components'] if c['purl'].startswith('pkg:pypi/')}
|
|
assert pinned == listed
|
|
|
|
|
|
def test_marked_out_dependencies_are_still_listed(sbom):
|
|
"""colorama is win32-only. It installs on the target, so it must appear -
|
|
the same blind spot that left it out of the wheelhouse."""
|
|
names = {c['name'] for c in sbom['components'] if c['purl'].startswith('pkg:pypi/')}
|
|
assert 'colorama' in names
|
|
|
|
|
|
def test_frontend_packages_are_covered(sbom):
|
|
"""The npm tree is the reason this exists: nothing else records what version
|
|
of leaflet or dompurify ends up inside the compiled SPA."""
|
|
npm = {c['name']: c for c in sbom['components'] if c['purl'].startswith('pkg:npm/')}
|
|
assert len(npm) > 100
|
|
for shipped in ('leaflet', 'dompurify', 'vue'):
|
|
assert shipped in npm, '%s is missing from the SBOM' % shipped
|
|
assert npm[shipped]['scope'] == 'required'
|
|
|
|
|
|
def test_build_only_packages_are_marked_not_dropped(sbom):
|
|
"""Dev packages do not ship. Recorded as 'excluded' rather than omitted, so a
|
|
reader can tell 'not here' from 'not looked for'."""
|
|
npm = {c['name']: c for c in sbom['components'] if c['purl'].startswith('pkg:npm/')}
|
|
assert npm['vite']['scope'] == 'excluded'
|
|
assert any(c['scope'] == 'required' for c in npm.values())
|
|
|
|
|
|
def test_bom_refs_are_unique(sbom):
|
|
"""CycloneDX forbids duplicate bom-refs, and scanners reject a document that
|
|
has them. npm installs the same package at several depths - node_modules/vite
|
|
and node_modules/vitest/node_modules/vite - which emitted it twice."""
|
|
refs = [c['bom-ref'] for c in sbom['components']]
|
|
duplicates = {ref for ref in refs if refs.count(ref) > 1}
|
|
assert not duplicates, 'duplicate bom-refs: %s' % sorted(duplicates)[:5]
|
|
|
|
|
|
def test_a_package_present_outside_the_dev_tree_counts_as_shipped(tmp_path):
|
|
"""Merging duplicates must not mark a shipped package build-only, which would
|
|
hide it from a CVE search on the server."""
|
|
sys.path.insert(0, str(REPO / 'scripts'))
|
|
import generate_sbom
|
|
|
|
lock = tmp_path / 'package-lock.json'
|
|
lock.write_text(json.dumps({'lockfileVersion': 3, 'packages': {
|
|
'': {'name': 'x', 'version': '1.0.0', 'dependencies': {'shared': '^1'}},
|
|
'node_modules/shared': {'version': '1.0.0'},
|
|
'node_modules/builder': {'version': '2.0.0', 'dev': True},
|
|
'node_modules/builder/node_modules/shared': {'version': '1.0.0', 'dev': True},
|
|
}}))
|
|
packages, direct = generate_sbom.parse_package_lock(str(lock))
|
|
shared = [p for p in packages if p['name'] == 'shared']
|
|
assert len(shared) == 1, 'the two copies of shared were not merged'
|
|
assert shared[0]['dev'] is False
|
|
assert direct == ['shared']
|
|
|
|
|
|
def test_components_carry_integrity_hashes(sbom):
|
|
missing = [c['name'] for c in sbom['components'] if not c.get('hashes')]
|
|
assert not missing, 'components without a hash: %s' % missing[:5]
|
|
|
|
|
|
def test_dependency_graph_is_real_not_flat(sbom):
|
|
"""A flat 'root depends on everything' graph cannot answer what was chosen
|
|
versus what was dragged in."""
|
|
root = sbom['metadata']['component']['bom-ref']
|
|
edges = {entry['ref']: entry['dependsOn'] for entry in sbom['dependencies']}
|
|
assert root in edges
|
|
assert len(edges) > 1, 'no edges below the root'
|
|
assert len(edges[root]) < len(sbom['components']), 'root depends on everything'
|
|
|
|
refs = {c['bom-ref'] for c in sbom['components']}
|
|
for ref, children in edges.items():
|
|
if ref == root:
|
|
continue
|
|
assert ref in refs, 'edge from an unknown component: %s' % ref
|
|
for child in children:
|
|
assert child in refs, 'edge to an unknown component: %s' % child
|
|
|
|
|
|
def test_output_is_byte_identical_across_runs(tmp_path):
|
|
"""Regenerating must not churn. A document that differs every build gets
|
|
re-committed without being read."""
|
|
first, first_path = generate(tmp_path, 'a.json')
|
|
_, second_path = generate(tmp_path, 'b.json')
|
|
assert first_path.read_bytes() == second_path.read_bytes()
|
|
assert first['serialNumber'] == json.loads(second_path.read_text())['serialNumber']
|