Skip to content

SQL-2805: add ssdlc utils to shared test infra #20

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

SQL-2805: add ssdlc utils to shared test infra #20

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
08d5272
additional updates for odbc driver
jchemburkar Sep 11, 2025
9f1b63b
update comments
jchemburkar Sep 11, 2025
e75f031
add publishing tasks
jchemburkar Sep 18, 2025
3d144d4
add template for compliance report
jchemburkar Sep 18, 2025
5d8baa1
update template
jchemburkar Sep 19, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
56 changes: 51 additions & 5 deletions evergreen/configs/ssdlc_util.yml
View file
Open in desktop
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's add publishing tasks for the compliance report and SBOM too, similar to what is done for the static analysis report, especially since the report is expecting the sbom and sarif to be in specific location.

Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@
# - SBOM_DIR - the directory to output sbom files to
# - SBOM_LICENSES - the name of the intermediate license file to scan
# - STATIC_CODE_ANALYSIS_NAME - the name of the file to output semgrep static analysis
# - SBOM_FILENAME - the name of the sbom file to add to the compliance report
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's go a step further and use the same pattern for all of our projects, instead of relying on the project to pass you the full value, just build the variable name off the release_version and product_name.
This way we have standardized names and the caller also has less to configure.

COMPLIANCE_REPORT_NAME => "${product_name}-${release_version}-compliance-report.md"
SBOM_LICENSES => "${product_name}.licenses.cdx.json"
STATIC_CODE_ANALYSIS_NAME => "${product_name}-${release_version}.sast.sarif"
SBOM_FILENAME => "${product_name}-${release_version}.sbom.json"

AUGMENTED_SBOM_FILENAME is missing from this list I think and would be "${product_name}-${release_version}.augmented.sbom.json".


variables:
- &rust_subprocess_default_params
Expand All @@ -26,9 +27,13 @@ functions:
- author
- author_email
- release_version
- template_filepath
- repo_name
- repo_title
- signing_title
Comment on lines +31 to +32
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nit]

Suggested change
- repo_title
- signing_title
- product_name
- signing_section_bookmark

- working_dir
- COMPLIANCE_REPORT_NAME
- STATIC_CODE_ANALYSIS_NAME
- SBOM_FILENAME
args:
- ${script_dir}/generate_compliance_report.sh
- command: s3.put
Expand All @@ -37,11 +42,31 @@ functions:
aws_key: ${aws_key}
aws_secret: ${aws_secret}
local_file: ${working_dir}/${COMPLIANCE_REPORT_NAME}
remote_file: ${working_dir}/artifacts/${version_id}/ssdlc/${COMPLIANCE_REPORT_NAME}
remote_file: ${working_dir}/artifacts/${working_dir}_${version_id}/ssdlc/${COMPLIANCE_REPORT_NAME}
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why did you have to change the path to use ${working_dir}_${version_id}?
Is it because of projects like the schema manager where there are multiple products in the same repo?

content_type: text/markdown
bucket: mciuploads
permissions: public-read


"publish compliance report":
- command: s3.get
params:
aws_key: ${aws_key}
aws_secret: ${aws_secret}
local_file: ${working_dir}/${COMPLIANCE_REPORT_NAME}
remote_file: ${working_dir}/artifacts/${working_dir}_${version_id}/ssdlc/${COMPLIANCE_REPORT_NAME}
content_type: text/markdown
bucket: mciuploads
- command: s3.put
params:
aws_key: ${release_aws_key}
aws_secret: ${release_aws_secret}
local_file: ${working_dir}/${COMPLIANCE_REPORT_NAME}
remote_file: ${working_dir}/${COMPLIANCE_REPORT_NAME}
content_type: text/markdown
bucket: translators-connectors-releases
permissions: public-read
display_name: ${COMPLIANCE_REPORT_NAME}

"scan SBOM":
- command: subprocess.exec
type: test
Expand All @@ -55,6 +80,27 @@ functions:
args:
- ${script_dir}/scan_sbom.sh

"publish augmented SBOM":
- command: s3.get
params:
aws_key: ${aws_key}
aws_secret: ${aws_secret}
local_file: ${working_dir}/${AUGMENTED_SBOM_FILENAME}
remote_file: ${working_dir}/artifacts/${version_id}/ssdlc/${AUGMENTED_SBOM_FILENAME}
content_type: application/json
bucket: mciuploads
permissions: public-read
- command: s3.put
params:
aws_key: ${release_aws_key}
aws_secret: ${release_aws_secret}
local_file: ${working_dir}/${AUGMENTED_SBOM_FILENAME}
remote_file: ${working_dir}/${SBOM_FILENAME}
bucket: translators-connectors-releases
content_type: application/json
permissions: public-read
display_name: ${SBOM_FILENAME}

"generate static code analysis":
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In generate_static_code_analysis.sh, can you add this logic to have a date in the report:

          # This adds a timestamp to the SAST file (i.e., this adds `"executionDateTime": <timestamp>` to `runs.invocations`). 
          jq --arg ts "$(date -u +'%Y-%m-%dT%H:%M:%SZ')" '(.runs[] | select(has("invocations"))).invocations[0].executionDateTime = $ts' xxxx.sast.sarif > temp.sarif && mv temp.sarif xxx.sast.sarif

This is implemented in mongosql and would be beneficial for all our projects.

- command: subprocess.exec
type: test
Expand Down Expand Up @@ -92,8 +138,8 @@ functions:
aws_key: ${release_aws_key}
aws_secret: ${release_aws_secret}
local_file: ${working_dir}/papertrail/${STATIC_CODE_ANALYSIS_NAME}
remote_file: ${working_dir}/artifacts/${version_id}/ssdlc/${STATIC_CODE_ANALYSIS_NAME}
remote_file: ${working_dir}/${STATIC_CODE_ANALYSIS_NAME}
content_type: application/json
bucket: translators-connectors-releases
permissions: public-read
display_name: ${working_dir}-${release_version}.sast.sarif
display_name: ${STATIC_CODE_ANALYSIS_NAME}
25 changes: 25 additions & 0 deletions evergreen/resources/compliance_report_template.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
# %REPO_TITLE% SSDLC Compliance Report - %VERSION%

**Release Creator**
%AUTHOR% - %AUTHOR_EMAIL%

**Compliance Report Created Date**
%CREATED_DATE%

**Process Document**
https://www.mongodb.com/resources/products/capabilities/supply-chain-security-in-mongodb-s-software-development-lifecycle

**Tool used to track third party vulnerabilities**
Silk Security
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is now "Kondukto".
I don't know if we really need to have this here anymore. This was a requirement the first time around for SSDLC, but I don't think the template is as tight now.
Just remove this section.


**Third-Party Dependency Information**
See SBOM at URL: %SBOM_URL%

**Static Analysis Findings**
See report at URL: %SARIF_URL%

**Signature Information**
Product is signed with signatures available which can be verified by following the instructions from our [README](https://github.com/mongodb/%REPO_NAME%/blob/main/README.md#%SIGNING_TITLE%).

**Known Vulnerabilities**
Any vulnerabilities that may be shown in the links referenced above have been reviewed and accepted by the appropriate reviewers.
32 changes: 28 additions & 4 deletions evergreen/scripts/generate_compliance_report.sh
View file
Open in desktop
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could we have a generic compliance report template to use for every project?
You can parametrize it fully I think by adding a variable for Project name in the signature validation steps

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The templates are slightly different -- do you want us to put the odbc signature information for ODBC into the README? that would then make it hte same as the JDBC one

https://github.com/mongodb/mongo-odbc-driver/blob/main/resources/ssdlc/mongo-odbc-driver_compliance_report_template.md
https://github.com/mongodb/mongo-jdbc-driver/blob/master/resources/release/mongo_jdbc_compliance_report_template.md

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It looks like both our README have the a section for signature validation, so that might be a good idea. You could then templatize it with just the README link. I would use the link to the bookmark section though, not sure why our JDBC link just point to the README.
Another way would be to have a file path, which would contain the steps, for each driver and then we would templatize the path to this file, copy the content in the report ( I think it is better to copy the content because if the key change for example, the steps will still be correct for outdated releases).
This would make things easier to keep up-to-date, but require a bit more work on the share test infra and drivers. But I think we have the time for that right now, so I would go with that. I also mean that if things change, we can point the docs team directly to the file with the steps as well.

Original file line number Diff line number Diff line change
Expand Up @@ -6,17 +6,17 @@ echo "Author = ${author}"
echo "Author email = ${author_email}"
echo "Version = ${release_version}"

SBOM_URL="https://translators-connectors-releases.s3.amazonaws.com/eap/${working_dir}/${working_dir}-${release_version}.sbom.json"
SARIF_URL="https://translators-connectors-releases.s3.amazonaws.com/eap/${working_dir}/${working_dir}-${release_version}.sast.sarif"
SBOM_URL="https://translators-connectors-releases.s3.amazonaws.com/${working_dir}/${SBOM_FILENAME}"
SARIF_URL="https://translators-connectors-releases.s3.amazonaws.com/${working_dir}/${STATIC_CODE_ANALYSIS_NAME}"

echo "Sbom url = $SBOM_URL"
echo "Sarif Url = $SARIF_URL"

echo "----- Generating ${COMPLIANCE_REPORT_NAME} -----"

# Copy template
echo "Copying template file from ${template_filepath} to ${COMPLIANCE_REPORT_NAME}"
cp ${template_filepath} ${COMPLIANCE_REPORT_NAME}
echo "Copying template file from sql-engines-common-test-infra/evergreen/resources/compliance_report_template.md to ${COMPLIANCE_REPORT_NAME}"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you create a variable resources_dir: ./evergreen/resources in create-expansions.sh and use it here instead of the hard-coded paths?
I think it should work and it could be useful if we add more resources later on.

cp sql-engines-common-test-infra/evergreen/resources/compliance_report_template.md ${COMPLIANCE_REPORT_NAME}

# Update the version
echo "Update the version"
Expand All @@ -42,3 +42,27 @@ echo "update the author email"
echo "sed -i.bu "s,%AUTHOR_EMAIL%,${author_email},g" ${COMPLIANCE_REPORT_NAME}"
sed -i.bu "s,%AUTHOR_EMAIL%,${author_email},g" ${COMPLIANCE_REPORT_NAME}
echo "---------------------------"

# Update the created date
CREATED_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
echo "Created date = $CREATED_DATE"
echo "update the created date"
echo "sed -i.bu "s,%CREATED_DATE%,${CREATED_DATE},g" ${COMPLIANCE_REPORT_NAME}"
sed -i.bu "s,%CREATED_DATE%,${CREATED_DATE},g" ${COMPLIANCE_REPORT_NAME}
echo "---------------------------"

# update repository specific metadata
echo "update the repo title"
echo "sed -i.bu "s,%REPO_TITLE%,${repo_title},g" ${COMPLIANCE_REPORT_NAME}"
sed -i.bu "s,%REPO_TITLE%,${repo_title},g" ${COMPLIANCE_REPORT_NAME}
echo "---------------------------"

echo "update the repo name"
echo "sed -i.bu "s,%REPO_NAME%,${repo_name},g" ${COMPLIANCE_REPORT_NAME}"
sed -i.bu "s,%REPO_NAME%,${repo_name},g" ${COMPLIANCE_REPORT_NAME}
echo "---------------------------"

echo "update the link to signing verification instructions"
echo "sed -i.bu "s,%SIGNING_TITLE%,${signing_title},g" ${COMPLIANCE_REPORT_NAME}"
sed -i.bu "s,%SIGNING_TITLE%,${signing_title},g" ${COMPLIANCE_REPORT_NAME}
echo "---------------------------"