Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Affirm that correct event is fired for invalid SBOM #363

Closed
jcrossley3 opened this issue Aug 8, 2023 · 2 comments · Fixed by #389
Closed

Affirm that correct event is fired for invalid SBOM #363

jcrossley3 opened this issue Aug 8, 2023 · 2 comments · Fixed by #389

Comments

@jcrossley3
Copy link
Contributor

Related to #7

This is a tricky one, because we don't validate the content of the SBOM on the upload. To mitigate the risk of a DoS attack, we avoid loading the entire SBOM into memory -- we stream chunks directly to S3, and the indexer serially loads (and validates, eventually) them once notified that all the chunks have been streamed successfully.

I guess we have to decide if this test is worth the additional code complexity to "peek" at the payload to see if it's small enough to validate. Any thoughts @lulf?

Originally posted by @jcrossley3 in #356 (comment)
@jcrossley3 jcrossley3 mentioned this issue Aug 8, 2023
Closed
@lulf
Copy link
Contributor

lulf commented Aug 9, 2023

I think avoiding loading the SBOM into memory is important, though maybe less so assuming we trust any authenticated user. Perhaps an option would be to rely on the indexer posting 'failed to parse' events, which it currently does, to the sbom-failed topic?

The test could then consume from that topic to verify that the invalid document gets the correct treatment.

jcrossley3 added a commit to jcrossley3/trustification that referenced this issue Aug 11, 2023
@jcrossley3
fix: affirm indexer parse error emits a failed event
59cb9fb 
Fixes trustification#363

Signed-off-by: Jim Crossley <[email protected]>
jcrossley3 added a commit to jcrossley3/trustification that referenced this issue Aug 11, 2023
@jcrossley3
fix: affirm indexer parse error emits a failed event
8a4f5db 
Fixes trustification#363

Signed-off-by: Jim Crossley <[email protected]>
jcrossley3 added a commit to jcrossley3/trustification that referenced this issue Aug 12, 2023
@jcrossley3
feat: factor event waiting logic into a more useful helper fn
e7d4b54 
Un-ignores the remaining tests relating to trustification#363

The additional tests triggered some "too many open files" errors (due
to a low-ish default ulimit of 1024) that can be mitigated by limiting
the number of test threads.

Signed-off-by: Jim Crossley <[email protected]>
jcrossley3 added a commit to jcrossley3/trustification that referenced this issue Aug 14, 2023
@jcrossley3
fix: affirm indexer parse error emits a failed event
ec8dede 
Fixes trustification#363

Signed-off-by: Jim Crossley <[email protected]>
jcrossley3 added a commit to jcrossley3/trustification that referenced this issue Aug 14, 2023
@jcrossley3
feat: factor event waiting logic into a more useful helper fn
583b0eb 
Un-ignores the remaining tests relating to trustification#363

The additional tests triggered some "too many open files" errors (due
to a low-ish default ulimit of 1024) that can be mitigated by limiting
the number of test threads.

Signed-off-by: Jim Crossley <[email protected]>
@jcrossley3 jcrossley3 mentioned this issue Aug 14, 2023
Merged
jcrossley3 added a commit to jcrossley3/trustification that referenced this issue Aug 14, 2023
@jcrossley3
fix: affirm indexer parse error emits a failed event
300bd79 
Fixes trustification#363

Signed-off-by: Jim Crossley <[email protected]>
jcrossley3 added a commit to jcrossley3/trustification that referenced this issue Aug 14, 2023
@jcrossley3
feat: factor event waiting logic into a more useful helper fn
2555062 
Un-ignores the remaining tests relating to trustification#363

The additional tests triggered some "too many open files" errors (due
to a low-ish default ulimit of 1024) that can be mitigated by limiting
the number of test threads.

Signed-off-by: Jim Crossley <[email protected]>
jcrossley3 added a commit to jcrossley3/trustification that referenced this issue Aug 15, 2023
@jcrossley3
fix: affirm indexer parse error emits a failed event
fd49934 
Fixes trustification#363

Signed-off-by: Jim Crossley <[email protected]>
jcrossley3 added a commit to jcrossley3/trustification that referenced this issue Aug 15, 2023
@jcrossley3
feat: factor event waiting logic into a more useful helper fn
9c3d20e 
Un-ignores the remaining tests relating to trustification#363

The additional tests triggered some "too many open files" errors (due
to a low-ish default ulimit of 1024) that can be mitigated by limiting
the number of test threads.

Signed-off-by: Jim Crossley <[email protected]>
jcrossley3 added a commit that referenced this issue Aug 15, 2023
@jcrossley3
fix: affirm indexer parse error emits a failed event
adc7bfa 
Fixes #363

Signed-off-by: Jim Crossley <[email protected]>
jcrossley3 added a commit that referenced this issue Aug 15, 2023
@jcrossley3
feat: factor event waiting logic into a more useful helper fn
d9ea1d9 
Un-ignores the remaining tests relating to #363

The additional tests triggered some "too many open files" errors (due
to a low-ish default ulimit of 1024) that can be mitigated by limiting
the number of test threads.

Signed-off-by: Jim Crossley <[email protected]>
@ikanias
Copy link
Collaborator

ikanias commented Aug 17, 2023

Relevant JIRA ticket: https://issues.redhat.com/browse/TC-385

This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
Supply-Chain Trust Manager
Archived in project
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Enable integs to assert certain events occur jcrossley3/trustification
3 participants
@jcrossley3 @lulf @ikanias