Skip to content

fix(release): accept current Grype database schema #533

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jeremi merged 1 commit into from
Jul 28, 2026
Merged

fix(release): accept current Grype database schema #533

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 34 additions & 6 deletions .github/workflows/release-candidate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -734,8 +734,18 @@ jobs:
if ! jq -e '
type == "object" and
(.matches | type == "array") and
(.descriptor.db.built | type == "string") and
(.descriptor.db.checksum | type == "string")
(
(.descriptor.db.built // .descriptor.db.status.built)

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Add the required DCO sign-off

Commit 1090e1c71174fe40bdf6ba250572a08d610b31fe has no Signed-off-by: trailer, so it does not satisfy the repository's mandatory DCO policy and cannot be accepted as submitted; recreate the commit with a matching sign-off before merging.

AGENTS.md reference: AGENTS.md:L68-L70

Useful? React with 👍 / 👎.

| type == "string"
) and
(
(.descriptor.db.checksum | type == "string") or
(
.descriptor.db.status.from
| type == "string" and
test("checksum=sha256%3A[0-9a-fA-F]{64}")
)
)
' "${report}" >/dev/null; then
echo "Grype did not emit a complete scan report (exit ${status})" >&2
exit 1
Expand All @@ -744,6 +754,22 @@ jobs:
echo "::warning::Grype exited ${status}; enforcing its complete report through the reviewed advisory policy"
fi
}
read_db_metadata() {
local report="$1"
jq -er '
[
(.descriptor.db.built // .descriptor.db.status.built),
(
.descriptor.db.checksum //
(
.descriptor.db.status.from
| capture("checksum=sha256%3A(?<digest>[0-9a-fA-F]{64})").digest
| ascii_downcase
)
)
] | @tsv
' "${report}"
}
for name in registry-notary registry-relay; do
digest_ref="$(cat "inputs/build-a/dist/images/${name}.digest")"
expected_label_args=()
Expand Down Expand Up @@ -779,8 +805,9 @@ jobs:
echo "Exported rootfs ${name} contains a forbidden special file" >&2
exit 1
fi
db_built="$(jq -er '.descriptor.db.built' "dist/candidate/dist/grype/${name}.grype.json")"
db_checksum="$(jq -er '.descriptor.db.checksum' "dist/candidate/dist/grype/${name}.grype.json")"
IFS=$'\t' read -r db_built db_checksum < <(
read_db_metadata "dist/candidate/dist/grype/${name}.grype.json"
)
db_built_epoch="$(date -u -d "${db_built}" +%s)"
now_epoch="$(date -u +%s)"
if (( db_built_epoch > now_epoch || now_epoch - db_built_epoch > 259200 )); then
Expand Down Expand Up @@ -810,8 +837,9 @@ jobs:
echo "Exported rootfs postgresql contains a forbidden special file" >&2
exit 1
fi
db_built="$(jq -er '.descriptor.db.built' dist/candidate/dist/grype/postgresql.grype.json)"
db_checksum="$(jq -er '.descriptor.db.checksum' dist/candidate/dist/grype/postgresql.grype.json)"
IFS=$'\t' read -r db_built db_checksum < <(
read_db_metadata dist/candidate/dist/grype/postgresql.grype.json
)
db_built_epoch="$(date -u -d "${db_built}" +%s)"
now_epoch="$(date -u +%s)"
if (( db_built_epoch > now_epoch || now_epoch - db_built_epoch > 259200 )); then
Expand Down
4 changes: 3 additions & 1 deletion release/OPERATIONS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,9 @@ the separate repeatability workflow, not a second build in the blocking
candidate path.
Grype process status is not itself the advisory decision. The candidate first
requires a complete scan report, then the reviewed advisory policy decides
whether that report is acceptable.
whether that report is acceptable. Database identity accepts both the legacy
flat Grype descriptor and the nested descriptor emitted by the pinned Grype
release.

The selector writes `registry-stack.release-proof-selection.v1` JSON into the
candidate evidence.
Expand Down
3 changes: 3 additions & 0 deletions release/scripts/check-gates-inventory.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -649,6 +649,9 @@
'digest_ref="$(cat "inputs/build-a/dist/images/${name}.digest")"',
"scan_sbom() {",
'(.matches | type == "array")',
".descriptor.db.built // .descriptor.db.status.built",
'test("checksum=sha256%3A[0-9a-fA-F]{64}")',
"read_db_metadata() {",
"Grype did not emit a complete scan report",
"enforcing its complete report through the reviewed advisory policy",
"name: Enforce advisory policy",
Expand Down
9 changes: 9 additions & 0 deletions release/scripts/test_registry_release.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -701,6 +701,15 @@ def test_release_image_scans_are_policy_enforced_and_preserved(self) -> None:
self.assertIn("set +e", scan_body)
self.assertIn('status=$?', scan_body)
self.assertIn('(.matches | type == "array")', scan_body)
self.assertIn(
".descriptor.db.built // .descriptor.db.status.built",
scan_body,
)
self.assertIn(
'test("checksum=sha256%3A[0-9a-fA-F]{64}")',
scan_body,
)
self.assertIn("read_db_metadata() {", scan_body)
self.assertIn(
"Grype did not emit a complete scan report",
scan_body,
Expand Down
Loading