fix(release): enforce complete Grype reports (#532)

Require complete Grype JSON and delegate the blocking decision to the reviewed advisory policy.

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Author: jeremi

.github/workflows/release-candidate.yml

@@ -723,6 +723,27 @@ jobs:
           fi
           printf '%s\n' "${postgresql_ref}" \
             > dist/candidate/dist/images/postgresql.digest
+          scan_sbom() {
+            local sbom="$1"
+            local report="$2"
+            local status
+            set +e
+            grype "sbom:${sbom}" -o json > "${report}"
+            status=$?
+            set -e
+            if ! jq -e '
+              type == "object" and
+              (.matches | type == "array") and
+              (.descriptor.db.built | type == "string") and
+              (.descriptor.db.checksum | type == "string")
+            ' "${report}" >/dev/null; then
+              echo "Grype did not emit a complete scan report (exit ${status})" >&2
+              exit 1
+            fi
+            if (( status != 0 )); then
+              echo "::warning::Grype exited ${status}; enforcing its complete report through the reviewed advisory policy"
+            fi
+          }
           for name in registry-notary registry-relay; do
             digest_ref="$(cat "inputs/build-a/dist/images/${name}.digest")"
             expected_label_args=()
@@ -745,8 +766,9 @@ jobs:
               "dist/candidate/dist/sbom/${name}.spdx.json" \
               --image-name "${name}" \
               --digest-ref "${digest_ref}"
-            grype "sbom:dist/candidate/dist/sbom/${name}.syft.json" -o json \
-              > "dist/candidate/dist/grype/${name}.grype.json"
+            scan_sbom \
+              "dist/candidate/dist/sbom/${name}.syft.json" \
+              "dist/candidate/dist/grype/${name}.grype.json"
             mkdir -p "dist/candidate/dist/rootfs/${name}"
             crane export "${digest_ref}" - \
               | tar --extract --file=- --directory="dist/candidate/dist/rootfs/${name}" \
@@ -775,8 +797,9 @@ jobs:
             dist/candidate/dist/sbom/postgresql.spdx.json \
             --image-name postgresql \
             --digest-ref "${postgresql_ref}"
-          grype "sbom:dist/candidate/dist/sbom/postgresql.syft.json" -o json \
-            > dist/candidate/dist/grype/postgresql.grype.json
+          scan_sbom \
+            dist/candidate/dist/sbom/postgresql.syft.json \
+            dist/candidate/dist/grype/postgresql.grype.json
           mkdir -p dist/candidate/dist/rootfs/postgresql
           crane export "${postgresql_ref}" - \
             | tar --extract --file=- --directory=dist/candidate/dist/rootfs/postgresql \

release/OPERATIONS.md

@@ -28,6 +28,9 @@ invalid immutable image topology, an unreviewed advisory, or any source and
 artifact binding mismatch. Extended proof is additional evidence produced by
 the separate repeatability workflow, not a second build in the blocking
 candidate path.
+Grype process status is not itself the advisory decision. The candidate first
+requires a complete scan report, then the reviewed advisory policy decides
+whether that report is acceptable.
 
 The selector writes `registry-stack.release-proof-selection.v1` JSON into the
 candidate evidence.

release/scripts/check-gates-inventory.py

@@ -559,7 +559,6 @@
             "build-a:\n    name: Build A cached canonical candidate",
             "name: Restore exact-key Cargo cache",
             "name: Validate canonical binary inventory",
-            'grype "sbom:dist/candidate/dist/sbom/${name}.syft.json"',
         ),
     ),
     (
@@ -648,6 +647,10 @@
         (
             "name: Scan immutable staging digests",
             'digest_ref="$(cat "inputs/build-a/dist/images/${name}.digest")"',
+            "scan_sbom() {",
+            '(.matches | type == "array")',
+            "Grype did not emit a complete scan report",
+            "enforcing its complete report through the reviewed advisory policy",
             "name: Enforce advisory policy",
             "--syft-report dist/candidate/dist/sbom/registry-notary.syft.json",
             "--rootfs dist/candidate/dist/rootfs/registry-notary",

release/scripts/test_registry_release.py

@@ -696,6 +696,19 @@ def test_release_image_scans_are_policy_enforced_and_preserved(self) -> None:
         upload_step = images_job.index("Upload exact candidate payload")
         self.assertLess(scan_step, enforcement_step)
         self.assertLess(enforcement_step, upload_step)
+        scan_body = images_job[scan_step:enforcement_step]
+        self.assertIn("scan_sbom() {", scan_body)
+        self.assertIn("set +e", scan_body)
+        self.assertIn('status=$?', scan_body)
+        self.assertIn('(.matches | type == "array")', scan_body)
+        self.assertIn(
+            "Grype did not emit a complete scan report",
+            scan_body,
+        )
+        self.assertIn(
+            "enforcing its complete report through the reviewed advisory policy",
+            scan_body,
+        )
         self.assertIn(
             "grype dist/candidate/dist/grype/registry-notary.grype.json",
             images_job,