feat(cli): limit archive explode to an SBOM/SARIF allowlist

Address review feedback: explode only kinds with a meaningful bundle
form (SBOM_CYCLONEDX_JSON, SBOM_SPDX_JSON, SARIF) instead of exploding
any archive that is not archive-native. Every other kind (ARTIFACT,
EVIDENCE, ZAP_DAST_ZIP, …) records the archive whole, so a regular zip
provided as a single material is never expanded. Replaces the
archive-native denylist with an explodable-kind allowlist.

Also consolidate name sanitization: SanitizeMaterialName now returns the
bare sanitized component (empty when nothing remains) and callers supply
their fallback, so the action layer's sanitizeMaterialNamePart reuses it
instead of duplicating the logic.

Assisted-by: Claude Code
Signed-off-by: Javier Rodriguez <javier@chainloop.dev>

Chainloop-Trace-Sessions: da72e107-14e9-4da1-add0-28004f542628, ef6d3cdb-5a23-445c-b39a-510b659023e4

Author: javirln

app/cli/pkg/action/attestation_add.go

@@ -225,10 +225,14 @@ func (action *AttestationAdd) Run(ctx context.Context, attestationID, materialNa
 }
 
 // shouldExplode decides whether an att-add should explode the value into many
-// materials: only when --kind is set, the value is a supported archive, and the
-// kind is not archive-native (e.g. ZAP_DAST_ZIP, which is recorded whole).
+// materials: only when the kind is explodable (SBOM/SARIF) and the value is a
+// supported archive. It returns ArchiveNone for every other kind so a regular
+// zip provided as e.g. ARTIFACT or EVIDENCE is recorded whole.
 func shouldExplode(materialType, value string) (materials.ArchiveFormat, error) {
-	if materialType == "" || materials.IsArchiveNativeKind(materialType) {
+	// Only explode kinds that have a meaningful "bundle of the same kind"
+	// archive form (SBOM, SARIF). Any other kind — including ARTIFACT and
+	// EVIDENCE — records the archive whole even when the value is a zip/tar.
+	if !materials.IsExplodableKind(materialType) {
 		return materials.ArchiveNone, nil
 	}
 	return materials.DetectArchive(value)
@@ -370,29 +374,14 @@ func policyInputEvidenceNames(materialName string, policyInputFiles []*PolicyInp
 	return names
 }
 
-// sanitizeMaterialNamePart lower-cases s and collapses every run of characters
-// outside [a-z0-9] into a single "-", trimming leading/trailing "-", so the
-// result is a valid material-name component. Falls back to "input" if nothing
-// usable remains.
+// sanitizeMaterialNamePart sanitizes s into a valid material-name component via
+// materials.SanitizeMaterialName, falling back to "input" if nothing usable
+// remains.
 func sanitizeMaterialNamePart(s string) string {
-	var b strings.Builder
-	pendingHyphen := false
-	for _, r := range strings.ToLower(s) {
-		if (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9') {
-			if pendingHyphen && b.Len() > 0 {
-				b.WriteByte('-')
-			}
-			b.WriteRune(r)
-			pendingHyphen = false
-		} else {
-			pendingHyphen = true
-		}
-	}
-
-	if b.Len() == 0 {
-		return "input"
+	if name := materials.SanitizeMaterialName(s); name != "" {
+		return name
 	}
-	return b.String()
+	return "input"
 }
 
 // GetPolicyEvaluations is a Wrapper around the getPolicyEvaluations

app/cli/pkg/action/attestation_add_routing_test.go

@@ -58,15 +58,19 @@ func TestShouldExplode(t *testing.T) {
 		value      string
 		wantFormat materials.ArchiveFormat
 	}{
-		// A non-ArchiveNone format means the value will be exploded.
-		{"kind + archive", "SBOM_CYCLONEDX_JSON", zipPath, materials.ArchiveZip},
-		{"archive-native kind", "ZAP_DAST_ZIP", zipPath, materials.ArchiveNone},
+		// A non-ArchiveNone format means the value will be exploded. Only
+		// explodable kinds (SBOM, SARIF) explode; everything else is recorded
+		// whole even when the value is an archive.
+		{"explodable SBOM + archive", "SBOM_CYCLONEDX_JSON", zipPath, materials.ArchiveZip},
+		{"explodable SARIF + archive", "SARIF", zipPath, materials.ArchiveZip},
+		{"non-explodable ARTIFACT + archive", "ARTIFACT", zipPath, materials.ArchiveNone},
+		{"non-explodable EVIDENCE + archive", "EVIDENCE", zipPath, materials.ArchiveNone},
+		{"archive-native ZAP + archive", "ZAP_DAST_ZIP", zipPath, materials.ArchiveNone},
 		{"no kind", "", zipPath, materials.ArchiveNone},
-		{"kind + non-archive", "ARTIFACT", plainPath, materials.ArchiveNone},
-		// Non-file values must never return an error — STRING and CONTAINER_IMAGE
-		// carry values that are not file paths at all.
-		{"kind STRING non-file value", "STRING", "hello world", materials.ArchiveNone},
-		{"kind CONTAINER_IMAGE non-file value", "CONTAINER_IMAGE", "registry.example.com/app:v1", materials.ArchiveNone},
+		{"explodable kind + non-archive", "SBOM_CYCLONEDX_JSON", plainPath, materials.ArchiveNone},
+		// Non-file values must never return an error — even for an explodable kind
+		// the value here is not a file path at all.
+		{"explodable kind STRING-like non-file value", "SARIF", "hello world", materials.ArchiveNone},
 	}
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {

pkg/attestation/crafter/materials/archive.go

@@ -267,18 +267,21 @@ func walkTar(p string, gzipped bool, visit func(name string, r io.Reader) error)
 	}
 }
 
-// archiveNativeKinds lists material kinds whose value is the archive itself.
-// For these, --kind short-circuits the explode path and the archive is
-// recorded whole. Extend this set as new "the archive is the material" kinds
-// are added.
-var archiveNativeKinds = map[string]struct{}{
-	schemaapi.CraftingSchema_Material_ZAP_DAST_ZIP.String(): {},
+// explodableKinds is the allowlist of material kinds whose archive value is
+// expanded into one material per entry. Every other kind (ARTIFACT, EVIDENCE,
+// ZAP_DAST_ZIP, …) records the archive whole, so a customer can still provide a
+// regular zip as a single material. Extend this set as more kinds gain a
+// meaningful "bundle of the same kind" archive form.
+var explodableKinds = map[string]struct{}{
+	schemaapi.CraftingSchema_Material_SBOM_CYCLONEDX_JSON.String(): {},
+	schemaapi.CraftingSchema_Material_SBOM_SPDX_JSON.String():      {},
+	schemaapi.CraftingSchema_Material_SARIF.String():               {},
 }
 
-// IsArchiveNativeKind reports whether kind treats the archive as a single
-// material (recorded whole) rather than something to explode.
-func IsArchiveNativeKind(kind string) bool {
-	_, ok := archiveNativeKinds[kind]
+// IsExplodableKind reports whether an archive provided for kind should be
+// expanded into one material per entry (true) or recorded whole (false).
+func IsExplodableKind(kind string) bool {
+	_, ok := explodableKinds[kind]
 	return ok
 }
 
@@ -295,9 +298,10 @@ func ArchiveEntryBaseName(name string) string {
 // (empty/symbol-only input or prefix).
 const defaultMaterialName = "material"
 
-// SanitizeMaterialName converts s into a valid DNS-1123 material name:
-// lowercase, with every run of characters outside [a-z0-9] collapsed to a
-// single "-" and leading/trailing "-" trimmed. Falls back to "material".
+// SanitizeMaterialName converts s into a valid DNS-1123 material-name component:
+// lowercase, with every run of characters outside [a-z0-9] collapsed to a single
+// "-" and leading/trailing "-" trimmed. It returns "" when nothing usable
+// remains; callers supply their own fallback.
 func SanitizeMaterialName(s string) string {
 	var b strings.Builder
 	pendingHyphen := false
@@ -312,9 +316,6 @@ func SanitizeMaterialName(s string) string {
 			pendingHyphen = true
 		}
 	}
-	if b.Len() == 0 {
-		return defaultMaterialName
-	}
 	return b.String()
 }
 
@@ -341,8 +342,8 @@ func NewNameAllocator(existing []string) *NameAllocator {
 // the base "material" (so entries are named material-0, material-1, …).
 func (a *NameAllocator) AllocateSequential(prefix string) string {
 	base := defaultMaterialName
-	if prefix != "" {
-		base = SanitizeMaterialName(prefix)
+	if s := SanitizeMaterialName(prefix); s != "" {
+		base = s
 	}
 
 	for {

pkg/attestation/crafter/materials/archive_test.go

@@ -239,7 +239,8 @@ func TestSanitizeMaterialName(t *testing.T) {
 		{"scan.json", "scan-json"},
 		{"results.XML", "results-xml"},
 		{"weird__name!!", "weird-name"},
-		{"___", "material"},
+		{"___", ""}, // nothing usable -> empty; callers supply their own fallback
+		{"", ""},
 	}
 	for _, tc := range tests {
 		assert.Equal(t, tc.want, SanitizeMaterialName(tc.in))
@@ -272,8 +273,14 @@ func TestNameAllocatorSequential(t *testing.T) {
 	})
 }
 
-func TestIsArchiveNativeKind(t *testing.T) {
-	assert.True(t, IsArchiveNativeKind("ZAP_DAST_ZIP"))
-	assert.False(t, IsArchiveNativeKind("SBOM_CYCLONEDX_JSON"))
-	assert.False(t, IsArchiveNativeKind("ARTIFACT"))
+func TestIsExplodableKind(t *testing.T) {
+	// Explodable: SBOM and SARIF bundles.
+	assert.True(t, IsExplodableKind("SBOM_CYCLONEDX_JSON"))
+	assert.True(t, IsExplodableKind("SBOM_SPDX_JSON"))
+	assert.True(t, IsExplodableKind("SARIF"))
+	// Not explodable: recorded whole even when a zip/tar is provided.
+	assert.False(t, IsExplodableKind("ARTIFACT"))
+	assert.False(t, IsExplodableKind("EVIDENCE"))
+	assert.False(t, IsExplodableKind("ZAP_DAST_ZIP"))
+	assert.False(t, IsExplodableKind(""))
 }