From 0a852de6c46d26c5bb429aa204f40c473d7a53b6 Mon Sep 17 00:00:00 2001 From: Javier Rodriguez Date: Tue, 13 Oct 2026 19:12:13 +0200 Subject: [PATCH] fix(materials): accept GitLab security reports with any observability event The GitLab security report library v5 rejects every scan.observability event except the SAST metrics event. Reports from the GitLab secrets analyzer failed with "unknown event type: collect_secrets_analyzer_scan_metrics_from_pipeline". Move to report v7, which keeps observability events as opaque data. Assisted-by: Claude Code Signed-off-by: Javier Rodriguez Chainloop-Trace-Sessions: 4b67ada5-fe50-4e11-93d0-2ac98a9f7e02 --- go.mod | 2 +- go.sum | 4 +- pkg/attestation/crafter/materials/gitlab.go | 2 +- .../crafter/materials/gitlab_test.go | 8 +++ ...secret-detection-report-observability.json | 71 +++++++++++++++++++ 5 files changed, 83 insertions(+), 4 deletions(-) create mode 100644 pkg/attestation/crafter/materials/testdata/gl-secret-detection-report-observability.json diff --git a/go.mod b/go.mod index 07bc8bf2c..450d833d6 100644 --- a/go.mod +++ b/go.mod @@ -102,7 +102,7 @@ require ( github.com/testcontainers/testcontainers-go v0.44.0 github.com/vektah/gqlparser/v2 v2.5.60 github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 - gitlab.com/gitlab-org/security-products/analyzers/report/v5 v5.13.1 + gitlab.com/gitlab-org/security-products/analyzers/report/v7 v7.3.0 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.72.0 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.72.0 go.opentelemetry.io/otel v1.47.0 diff --git a/go.sum b/go.sum index 5a8662185..c9d6b13e5 100644 --- a/go.sum +++ b/go.sum @@ -1342,8 +1342,8 @@ gitlab.com/gitlab-org/api/client-go v1.46.0 h1:YxBWFZIFYKcGESCb9fpkwzouo+apyB9pr gitlab.com/gitlab-org/api/client-go v1.46.0/go.mod h1:FtgyU6g2HS5+fMhw6nLK96GBEEBx5MzntOiJWfIaiN8= gitlab.com/gitlab-org/security-products/analyzers/common/v3 v3.4.0 h1:+1k1NQiBSVeLDePX82ec3nHdrOsDvhMmA09LL25omTk= gitlab.com/gitlab-org/security-products/analyzers/common/v3 v3.4.0/go.mod h1:VEhMaykRqWmiLS7uWGKAVfsFmAqeHp1q1K1s24d37Ig= -gitlab.com/gitlab-org/security-products/analyzers/report/v5 v5.13.1 h1:936hBRBYfrLjQp5LGrSsP6vet2EawSI1zyUppoHOj/I= -gitlab.com/gitlab-org/security-products/analyzers/report/v5 v5.13.1/go.mod h1:89AMh07hABjE8V9JFl6UYmjXYaBrsAlQCR7FGWD/aIQ= +gitlab.com/gitlab-org/security-products/analyzers/report/v7 v7.3.0 h1:jAbRipqripmOdrN3oea0LGkUA48DdzXARNrf3YE7ZrI= +gitlab.com/gitlab-org/security-products/analyzers/report/v7 v7.3.0/go.mod h1:sSgZy0JXQUfMPPUIdxN7KNNjM6uboLeTnpQAfkDLllU= gitlab.com/gitlab-org/security-products/analyzers/ruleset/v3 v3.3.2 h1:dvJgv4yfy+B2DcPtc9cE23sHdm8bcETeprTcD0pHfJA= gitlab.com/gitlab-org/security-products/analyzers/ruleset/v3 v3.3.2/go.mod h1:hHFwTR6EqMt2J0b5U18oMxU/yG0h/j7vVboqIszwCrA= go.etcd.io/bbolt v1.3.3/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU= diff --git a/pkg/attestation/crafter/materials/gitlab.go b/pkg/attestation/crafter/materials/gitlab.go index 9f51e619d..1349c4dfc 100644 --- a/pkg/attestation/crafter/materials/gitlab.go +++ b/pkg/attestation/crafter/materials/gitlab.go @@ -26,7 +26,7 @@ import ( api "github.com/chainloop-dev/chainloop/pkg/attestation/crafter/api/attestation/v1" "github.com/chainloop-dev/chainloop/pkg/casclient" "github.com/rs/zerolog" - "gitlab.com/gitlab-org/security-products/analyzers/report/v5" + "gitlab.com/gitlab-org/security-products/analyzers/report/v7" ) var supportedTypes = []string{"sast", "dast", "api_fuzzing", "coverage_fuzzing", "secret_detection", "dependency_scanning", "container_scanning", "container_scanning_for_registry", "cluster_image_scanning"} diff --git a/pkg/attestation/crafter/materials/gitlab_test.go b/pkg/attestation/crafter/materials/gitlab_test.go index 673d20a1a..2cf357db1 100644 --- a/pkg/attestation/crafter/materials/gitlab_test.go +++ b/pkg/attestation/crafter/materials/gitlab_test.go @@ -109,6 +109,14 @@ func TestGitlabCrafter_Craft(t *testing.T) { "chainloop.material.tool.version": ":SKIP:", }, }, + { + name: "secret detection report with observability events", + filePath: "./testdata/gl-secret-detection-report-observability.json", + annotations: map[string]string{ + "chainloop.material.tool.name": "Gitleaks", + "chainloop.material.tool.version": "8.29.1", + }, + }, { name: "sonarqube report", filePath: "./testdata/gl-sonarqube-report.json", diff --git a/pkg/attestation/crafter/materials/testdata/gl-secret-detection-report-observability.json b/pkg/attestation/crafter/materials/testdata/gl-secret-detection-report-observability.json new file mode 100644 index 000000000..0e6ae5ef8 --- /dev/null +++ b/pkg/attestation/crafter/materials/testdata/gl-secret-detection-report-observability.json @@ -0,0 +1,71 @@ +{ + "version": "15.2.4", + "vulnerabilities": [ + { + "id": "cc927200-b884-4fb7-8fcc-df8b667404c9", + "category": "secret_detection", + "name": "Generic API Key", + "description": "Generic API Key", + "cve": "app/config.yaml:3a3436765885cdf2edc179512c22dd4c4259410f0d18f391cbc8d83a837c678e:generic-api-key", + "severity": "Critical", + "confidence": "Unknown", + "raw_source_code_extract": "example-not-a-real-secret", + "scanner": { + "id": "gitleaks", + "name": "Gitleaks" + }, + "location": { + "file": "app/config.yaml", + "commit": { + "sha": "0000000" + }, + "start_line": 3 + }, + "identifiers": [ + { + "type": "gitleaks_rule_id", + "name": "Gitleaks rule ID generic-api-key", + "value": "generic-api-key" + } + ] + } + ], + "scan": { + "analyzer": { + "id": "secrets", + "name": "secrets", + "url": "https://gitlab.com/gitlab-org/security-products/analyzers/secrets", + "vendor": { + "name": "GitLab" + }, + "version": "7.24.1" + }, + "scanner": { + "id": "gitleaks", + "name": "Gitleaks", + "url": "https://github.com/gitleaks/gitleaks", + "vendor": { + "name": "GitLab" + }, + "version": "8.29.1" + }, + "type": "secret_detection", + "start_time": "2025-01-01T00:00:00", + "end_time": "2025-01-01T00:00:02", + "status": "success", + "observability": { + "events": [ + { + "event": "collect_secrets_analyzer_scan_metrics_from_pipeline", + "time_s": 1.5, + "exit_code": 0, + "bytes_scanned": 2048 + }, + { + "event": "example_unregistered_event", + "value": 1 + } + ] + } + } +}