sbom-present.yaml

# Copyright 2024-2026 The Chainloop Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: chainloop.dev/v1
kind: Policy
metadata:
  name: sbom-present
  description: Checks a SBOM is present in the attestation materials
  annotations:
    category: sbom
spec:
  policies:
    - kind: ATTESTATION
      embedded: |
        package main

        # Verifies there is a SBOM material, even if not enforced by contract

        import rego.v1

        ################################
        # Common section do NOT change #
        ################################

        result := {
        	"skipped": skipped,
        	"violations": violations,
        	"skip_reason": skip_reason,
        }

        default skip_reason := ""

        skip_reason := m if {
        	not valid_input
        	m := "the file content is not recognized"
        }

        default skipped := true

        skipped := false if valid_input

        ########################################
        # EO Common section, custom code below #
        ########################################

        # TODO: update to validate if the file is expected, i.e checking the tool that generates it
        valid_input := true

        violations contains msg if {
        	not has_sbom
        	msg := "missing SBOM material"
        }

        # Collect all material types
        kinds contains kind if {
        	some material in input.predicate.materials
        	kind := material.annotations["chainloop.material.type"]
        }

        has_sbom if {
        	values := ["SBOM_SPDX_JSON", "SBOM_CYCLONEDX_JSON"]
        	some kind in kinds
        	kind in values
        }