fix(provenance): verify every matched SPDX, not just the first (#11)

verify() checked only sorted(glob)[0], so when the SPDX glob matched
several documents a broken or tampered SPDX that sorted later passed
CI unexamined -- a silent pass, the worst failure mode for a provenance
verifier. Loop over all matched documents, accumulating problems so one
run reports every broken file; object-store integrity still runs once.

Adds regression tests: a later dangling SPDX now fails the run, and two
valid documents both verify.

Author: MarkAtwood

provenance/bomsh_verify.py

@@ -167,26 +167,45 @@ def verify(spdx_glob, omnibor_dir):
     spdx_paths = sorted(_glob.glob(spdx_glob))
     if not spdx_paths:
         return False, [f'no SPDX matched {spdx_glob!r}']
-    spdx_path = spdx_paths[0]
-    try:
-        spdx_gitoids = load_spdx_gitoids(spdx_path)
-    except (json.JSONDecodeError, ValueError) as e:
-        return False, [f'could not load SPDX gitoids: {e}']
-    if not spdx_gitoids:
-        return False, [f'no gitoid externalRefs in {spdx_path}']
 
     objects_dir = os.path.join(omnibor_dir, 'objects')
-
-    missing = check_resolvability(spdx_gitoids, objects_dir)
-    if missing:
-        for pkg_name, gid, obj in missing:
+    ok = True
+    total_gitoids = 0
+
+    # (A) EVERY matched SPDX must load and have all its gitoids resolve --
+    # not just spdx_paths[0].  When the glob matches several documents (e.g.
+    # one per product/version), verifying only the first lets a broken or
+    # tampered SPDX that sorts later pass unexamined; for a provenance
+    # verifier a silent pass is the failure to avoid.  Problems are
+    # accumulated (rather than returned on the first) so one run reports every
+    # broken document.
+    for spdx_path in spdx_paths:
+        try:
+            spdx_gitoids = load_spdx_gitoids(spdx_path)
+        except (json.JSONDecodeError, ValueError) as e:
+            messages.append(
+                f'could not load SPDX gitoids from {spdx_path}: {e}')
+            ok = False
+            continue
+        if not spdx_gitoids:
+            messages.append(f'no gitoid externalRefs in {spdx_path}')
+            ok = False
+            continue
+        missing = check_resolvability(spdx_gitoids, objects_dir)
+        if missing:
+            for pkg_name, gid, obj in missing:
+                messages.append(
+                    f'DANGLING: {spdx_path}: {pkg_name} gitoid {gid} -> {obj}')
             messages.append(
-                f'DANGLING: {pkg_name} gitoid {gid} -> {obj}')
+                f'{len(missing)} SPDX gitoid(s) from {spdx_path} not present '
+                f'in {objects_dir}/ (provenance bundle is broken)')
+            ok = False
+            continue
+        total_gitoids += len(spdx_gitoids)
         messages.append(
-            f'{len(missing)} SPDX gitoid(s) not present in '
-            f'{objects_dir}/ (provenance bundle is broken)')
-        return False, messages
+            f'OK: {spdx_path}: {len(spdx_gitoids)} gitoid(s) verified')
 
+    # (B) Object-store integrity, once for the whole store.
     obj_count, bad = check_object_store_integrity(objects_dir)
     if bad:
         for obj, expected, actual in bad[:5]:
@@ -195,11 +214,14 @@ def verify(spdx_glob, omnibor_dir):
         messages.append(
             f'{len(bad)} object(s) in {objects_dir}/ failed gitoid '
             f'round-trip (object store is corrupt)')
-        return False, messages
+        ok = False
 
-    messages.append(f'OK: {len(spdx_gitoids)} gitoid(s) verified')
-    messages.append(f'    objects round-trip: {obj_count} blobs')
-    return True, messages
+    if ok:
+        messages.append(
+            f'OK: {len(spdx_paths)} SPDX file(s), {total_gitoids} '
+            f'gitoid(s) verified')
+        messages.append(f'    objects round-trip: {obj_count} blobs')
+    return ok, messages
 
 
 def main():

tests/test_gen_sbom.py

@@ -2824,6 +2824,50 @@ def test_no_gitoid_externalrefs_fails(self):
                 any('no gitoid externalRefs' in m for m in messages),
                 messages)
 
+    def test_all_matched_spdx_are_verified_not_just_first(self):
+        # Regression: when the glob matches several SPDX documents, the
+        # verifier must check every one.  A second document that sorts *after*
+        # the good one and carries a dangling gitoid must fail the run --
+        # verifying only spdx_paths[0] would let it pass silently.
+        with tempfile.TemporaryDirectory() as tmpdir:
+            fx = _BomshFixture(tmpdir)          # omnibor.wolfssl-5.9.1 (valid)
+            bogus_gid = 'a' * 40                # well-formed hex, never staged
+            second = fx.tmpdir / 'omnibor.wolfssl-5.9.2.spdx.json'
+            second.write_text(json.dumps({'packages': [{
+                'name': 'wolfssl-later',
+                'externalRefs': [{
+                    'referenceCategory': 'PERSISTENT-ID',
+                    'referenceType': 'gitoid',
+                    'referenceLocator': f'gitoid:blob:sha1:{bogus_gid}',
+                }],
+            }]}))
+            ok, messages = fx.verify()
+            self.assertFalse(ok, f'later dangling SPDX not caught: {messages}')
+            joined = '\n'.join(messages)
+            self.assertIn('DANGLING', joined)
+            self.assertIn(bogus_gid, joined)
+            self.assertIn(str(second), joined)  # names the offending document
+
+    def test_multiple_valid_spdx_all_pass(self):
+        # Positive companion: two valid SPDX documents both verify, and the
+        # summary counts gitoids from both (not just the first).
+        with tempfile.TemporaryDirectory() as tmpdir:
+            fx = _BomshFixture(tmpdir)          # 3 gitoids
+            second = fx.tmpdir / 'omnibor.wolfssl-5.9.2.spdx.json'
+            second.write_text(json.dumps({'packages': [{
+                'name': 'wolfssl',
+                'externalRefs': [{
+                    'referenceCategory': 'PERSISTENT-ID',
+                    'referenceType': 'gitoid',
+                    'referenceLocator':
+                        f'gitoid:blob:sha1:{fx.gitoids["wolfssl"]}',
+                }],
+            }]}))
+            ok, messages = fx.verify()
+            self.assertTrue(ok, messages)
+            self.assertIn('2 SPDX file(s), 4 gitoid(s) verified',
+                          '\n'.join(messages))
+
     def test_object_store_integrity_skips_non_blob_files(self):
         # OmniBOR objects/ may contain housekeeping files at the root
         # (info/, pack/, etc.) that are NOT blobs and must not be