opensource-observer / oso

Measuring the impact of open source software
https://opensource.observer
Apache License 2.0
73 stars 16 forks source link

Missing required properties in SBOMs #2460

Closed Jabolol closed 1 week ago

Jabolol commented 1 week ago

What is it?

Apparently, some SBOMs are missing some properties required by githubkit, and it fails the internal pydantic schema validation. We'll have to skip these until a fix is deployed upstream on githubkit.

Check the failed run here

pydantic_core._pydantic_core.ValidationError: 1 validation error for DependencyGraphSpdxSbom
sbom.documentDescribes
  Field required [type=missing, input_value={'spdxVersion': 'SPDX-2.3...hipType': 'DESCRIBES'}]}, input_type=dict]
    For further information visit https://errors.pydantic.dev/2.9/v/missing
  File "/usr/local/lib/python3.12/dist-packages/dlt/extract/pipe_iterator.py", line 274, in _get_source_item
    pipe_item = next(gen)
                ^^^^^^^^^
  File "/usr/src/app/warehouse/oso_dagster/dlt_sources/github_repos/__init__.py", line 414, in oss_directory_github_sbom_resource
    yield from resolver.get_sbom_for_repo(
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/src/app/warehouse/oso_dagster/dlt_sources/github_repos/__init__.py", line 296, in get_sbom_for_repo
    graph = sbom.parsed_data.sbom
            ^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/dist-packages/githubkit/response.py", line 63, in parsed_data
    return type_validate_json(self._data_model, self.content)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/dist-packages/githubkit/compat.py", line 51, in type_validate_json
    return TypeAdapter(type_).validate_json(data)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/dist-packages/pydantic/type_adapter.py", line 135, in wrapped
    return func(self, *args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.12/dist-packages/pydantic/type_adapter.py", line 384, in validate_json
    return self.validator.validate_json(data, strict=strict, context=context)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^