Drop trusty REST client for SDK

This commit modifies the trusty evaluator to use the API client from stacklok/trusty-sdk-go isntead of the in tree pacakge which is now removed. Signed-off-by: Adolfo García Veytia (Puerco) <[email protected]>
mindersec · Jun 5, 2024 · 1f75b7e · 1f75b7e
1 parent e9e43e9
commit 1f75b7e
Show file tree

Hide file tree

Showing 6 changed files with 97 additions and 251 deletions.
diff --git a/internal/engine/eval/trusty/actions.go b/internal/engine/eval/trusty/actions.go
@@ -28,6 +28,7 @@ import (
 
 	"github.com/google/go-github/v61/github"
 	"github.com/rs/zerolog"
+	trustytypes "github.com/stacklok/trusty-sdk-go/pkg/types"
 
 	"github.com/stacklok/minder/internal/constants"
 	"github.com/stacklok/minder/internal/engine/eval/pr_actions"
@@ -201,7 +202,7 @@ type dependencyAlternatives struct {
 	BlockPR bool
 
 	// trustyReply is the complete response from trusty for this package
-	trustyReply *Reply
+	trustyReply *trustytypes.Reply
 }
 
 // summaryPrHandler is a prStatusHandler that adds a summary text to the PR as a comment.
@@ -345,7 +346,7 @@ func (sph *summaryPrHandler) generateSummary() (string, error) {
 }
 
 // buildProvenanceStruct builds the provenance data structure for the PR template
-func buildProvenanceStruct(r *Reply) *templateProvenance {
+func buildProvenanceStruct(r *trustytypes.Reply) *templateProvenance {
 	if r == nil || r.Provenance == nil {
 		return nil
 	}

diff --git a/internal/engine/eval/trusty/actions_test.go b/internal/engine/eval/trusty/actions_test.go
@@ -18,6 +18,7 @@ package trusty
 import (
 	"testing"
 
+	trustytypes "github.com/stacklok/trusty-sdk-go/pkg/types"
 	"github.com/stretchr/testify/require"
 
 	v1 "github.com/stacklok/minder/pkg/api/protobuf/go/minder/v1"
@@ -36,23 +37,23 @@ func TestBuildProvenanceStruct(t *testing.T) {
 	t.Parallel()
 	for _, tc := range []struct {
 		name     string
-		sut      *Reply
+		sut      *trustytypes.Reply
 		mustNil  bool
 		expected *templateProvenance
 	}{
 		{
 			name: "full-response",
-			sut: &Reply{
-				Provenance: &Provenance{
+			sut: &trustytypes.Reply{
+				Provenance: &trustytypes.Provenance{
 					Score: 8.0,
-					Description: ProvenanceDescription{
-						Historical: HistoricalProvenance{
+					Description: trustytypes.ProvenanceDescription{
+						Historical: trustytypes.HistoricalProvenance{
 							Tags:     10,
 							Common:   8,
 							Overlap:  80,
 							Versions: 10,
 						},
-						Sigstore: SigstoreProvenance{
+						Sigstore: trustytypes.SigstoreProvenance{
 							Issuer:           "CN=sigstore-intermediate,O=sigstore.dev",
 							Workflow:         ".github/workflows/build_and_deploy.yml",
 							SourceRepository: "https://github.com/vercel/next.js",
@@ -78,11 +79,11 @@ func TestBuildProvenanceStruct(t *testing.T) {
 		},
 		{
 			name: "only-historical",
-			sut: &Reply{
-				Provenance: &Provenance{
+			sut: &trustytypes.Reply{
+				Provenance: &trustytypes.Provenance{
 					Score: 8.0,
-					Description: ProvenanceDescription{
-						Historical: HistoricalProvenance{
+					Description: trustytypes.ProvenanceDescription{
+						Historical: trustytypes.HistoricalProvenance{
 							Tags:     10,
 							Common:   8,
 							Overlap:  80,
@@ -102,11 +103,11 @@ func TestBuildProvenanceStruct(t *testing.T) {
 		},
 		{
 			name: "only-sigstore",
-			sut: &Reply{
-				Provenance: &Provenance{
+			sut: &trustytypes.Reply{
+				Provenance: &trustytypes.Provenance{
 					Score: 8.0,
-					Description: ProvenanceDescription{
-						Sigstore: SigstoreProvenance{
+					Description: trustytypes.ProvenanceDescription{
+						Sigstore: trustytypes.SigstoreProvenance{
 							Issuer:           "CN=sigstore-intermediate,O=sigstore.dev",
 							Workflow:         ".github/workflows/build_and_deploy.yml",
 							SourceRepository: "https://github.com/vercel/next.js",
@@ -132,7 +133,7 @@ func TestBuildProvenanceStruct(t *testing.T) {
 		},
 		{
 			name:    "no-provenance",
-			sut:     &Reply{},
+			sut:     &trustytypes.Reply{},
 			mustNil: true,
 		},
 	} {

diff --git a/internal/engine/eval/trusty/trusty.go b/internal/engine/eval/trusty/trusty.go
@@ -22,6 +22,8 @@ import (
 	"strings"
 
 	"github.com/rs/zerolog"
+	trusty "github.com/stacklok/trusty-sdk-go/pkg/client"
+	trustytypes "github.com/stacklok/trusty-sdk-go/pkg/types"
 
 	evalerrors "github.com/stacklok/minder/internal/engine/errors"
 	"github.com/stacklok/minder/internal/engine/eval/pr_actions"
@@ -41,7 +43,7 @@ const (
 type Evaluator struct {
 	cli      provifv1.GitHub
 	endpoint string
-	client   *trustyClient
+	client   *trusty.Trusty
 }
 
 // NewTrustyEvaluator creates a new trusty evaluator
@@ -55,21 +57,21 @@ func NewTrustyEvaluator(ctx context.Context, ghcli provifv1.GitHub) (*Evaluator,
 
 	// If the environment variable is not set, use the default endpoint
 	if trustyEndpoint == "" {
-		trustyEndpoint = trustyEndpointURL
+		trustyEndpoint = trusty.DefaultOptions.BaseURL
 		zerolog.Ctx(ctx).Info().Str("trusty-endpoint", trustyEndpoint).Msg("using default trusty endpoint")
 	} else {
 		zerolog.Ctx(ctx).Info().Str("trusty-endpoint", trustyEndpoint).Msg("using trusty endpoint from environment")
 	}
 
-	piCli := newPiClient(trustyEndpoint)
-	if piCli == nil {
-		return nil, fmt.Errorf("failed to create pi client")
-	}
+	trustyClient := trusty.NewWithOptions(trusty.Options{
+		HttpClient: trusty.DefaultOptions.HttpClient,
+		BaseURL:    trustyEndpoint,
+	})
 
 	return &Evaluator{
 		cli:      ghcli,
 		endpoint: trustyEndpoint,
-		client:   piCli,
+		client:   trustyClient,
 	}, nil
 }
 
@@ -221,9 +223,15 @@ func buildEvalResult(prSummary *summaryPrHandler) error {
 	return nil
 }
 
-func getDependencyScore(ctx context.Context, trusty *trustyClient, dep *pb.PrDependencies_ContextualDependency) (*Reply, error) {
+func getDependencyScore(
+	ctx context.Context, trustyClient *trusty.Trusty, dep *pb.PrDependencies_ContextualDependency,
+) (*trustytypes.Reply, error) {
 	// Call the Trusty API
-	resp, err := trusty.SendRecvRequest(ctx, dep.Dep)
+	resp, err := trustyClient.Report(ctx, &trustytypes.Dependency{
+		Name:      dep.Dep.Name,
+		Version:   dep.Dep.Version,
+		Ecosystem: trustytypes.Ecosystem(dep.Dep.Ecosystem),
+	})
 	if err != nil {
 		return nil, fmt.Errorf("failed to send request: %w", err)
 	}
@@ -233,7 +241,7 @@ func getDependencyScore(ctx context.Context, trusty *trustyClient, dep *pb.PrDep
 // classifyDependency checks the dependencies from the PR for maliciousness or
 // low scores and adds them to the summary if needed
 func classifyDependency(
-	_ context.Context, logger *zerolog.Logger, resp *Reply, ruleConfig *config,
+	_ context.Context, logger *zerolog.Logger, resp *trustytypes.Reply, ruleConfig *config,
 	prSummary *summaryPrHandler, dep *pb.PrDependencies_ContextualDependency,
 ) {
 	// Check all the policy violations
@@ -319,10 +327,10 @@ func classifyDependency(
 
 // readPackageDescription reads the description from the package summary and
 // normlizes the required values when missing from a partial Trusty response
-func readPackageDescription(resp *Reply) map[string]any {
+func readPackageDescription(resp *trustytypes.Reply) map[string]any {
 	descr := map[string]any{}
 	if resp == nil {
-		resp = &Reply{}
+		resp = &trustytypes.Reply{}
 	}
 	if resp.Summary.Description != nil {
 		descr = resp.Summary.Description

diff --git a/internal/engine/eval/trusty/trusty_rest_handler.go b/internal/engine/eval/trusty/trusty_rest_handler.go