fix(materials): guard legacy tool annotations against empty values#2881
Open
jiparis wants to merge 2 commits intochainloop-dev:mainfrom
Open
fix(materials): guard legacy tool annotations against empty values#2881jiparis wants to merge 2 commits intochainloop-dev:mainfrom
jiparis wants to merge 2 commits intochainloop-dev:mainfrom
Conversation
SBOM uploads fail when a tool entry has an empty version string because the legacy annotation is set to "" and then rejected by the crafter validation. Guard all legacy annotation assignments with non-empty checks across all material crafters. Fixes chainloop-dev#2880 Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
There was a problem hiding this comment.
2 issues found across 9 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="pkg/attestation/crafter/materials/csaf.go">
<violation number="1" location="pkg/attestation/crafter/materials/csaf.go:152">
P2: Add a CSAF test for empty `generator.engine.name` / `version` values; the new guard changes annotation behavior but is not covered.
(Based on your team's feedback about adding or updating tests for new paths.) [FEEDBACK_USED]</violation>
</file>
<file name="pkg/attestation/crafter/materials/spdxjson.go">
<violation number="1" location="pkg/attestation/crafter/materials/spdxjson.go:94">
P3: Add a SPDX JSON craft test case where the first tool has an empty name to exercise the new guard and assert the legacy name annotation is omitted.
(Based on your team's feedback about adding/updating tests for new paths.) [FEEDBACK_USED]</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
| m.Annotations[AnnotationToolNameKey] = name | ||
| } | ||
| if version, ok := engine["version"].(string); ok { | ||
| if version, ok := engine["version"].(string); ok && version != "" { |
There was a problem hiding this comment.
P2: Add a CSAF test for empty generator.engine.name / version values; the new guard changes annotation behavior but is not covered.
(Based on your team's feedback about adding or updating tests for new paths.)
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At pkg/attestation/crafter/materials/csaf.go, line 152:
<comment>Add a CSAF test for empty `generator.engine.name` / `version` values; the new guard changes annotation behavior but is not covered.
(Based on your team's feedback about adding or updating tests for new paths.) </comment>
<file context>
@@ -146,10 +146,10 @@ func (i *CSAFCrafter) injectAnnotations(m *api.Attestation_Material, documentMap
m.Annotations[AnnotationToolNameKey] = name
}
- if version, ok := engine["version"].(string); ok {
+ if version, ok := engine["version"].(string); ok && version != "" {
m.Annotations[AnnotationToolVersionKey] = version
}
</file context>
| if len(tools) > 0 { | ||
| m.Annotations[AnnotationToolNameKey] = tools[0].Name | ||
| m.Annotations[AnnotationToolVersionKey] = tools[0].Version | ||
| if tools[0].Name != "" { |
There was a problem hiding this comment.
P3: Add a SPDX JSON craft test case where the first tool has an empty name to exercise the new guard and assert the legacy name annotation is omitted.
(Based on your team's feedback about adding/updating tests for new paths.)
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At pkg/attestation/crafter/materials/spdxjson.go, line 94:
<comment>Add a SPDX JSON craft test case where the first tool has an empty name to exercise the new guard and assert the legacy name annotation is omitted.
(Based on your team's feedback about adding/updating tests for new paths.) </comment>
<file context>
@@ -91,7 +91,11 @@ func (i *SPDXJSONCrafter) injectAnnotations(m *api.Attestation_Material, doc *sp
if len(tools) > 0 {
- m.Annotations[AnnotationToolNameKey] = tools[0].Name
- m.Annotations[AnnotationToolVersionKey] = tools[0].Version
+ if tools[0].Name != "" {
+ m.Annotations[AnnotationToolNameKey] = tools[0].Name
+ }
</file context>
Add test for CSAF tool annotation assertions and SPDX empty tool name case to cover the new guards added in the previous commit. Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
migmartri
approved these changes
Mar 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
chainloop.material.tool.name,chainloop.material.tool.version) with non-empty checks across all material crafters (CycloneDX, SPDX, SARIF, CSAF)Fixes #2880