feat(materials): add MSBUILD_LOG material type for compiler build logs

app/cli/documentation/cli-reference.md

@@ -264,7 +264,7 @@ Options
 --append                               reserved for a future release: will control whether --policy-input and --policy-input-from-file append to (rather than replace) the contract-declared value; has no effect yet
 --attestation-id string                Unique identifier of the in-progress attestation
 -h, --help                                 help for add
---kind string                          kind of the material to be recorded: ["ARTIFACT" "ASYNCAPI_SPEC" "ATTESTATION" "BLACKDUCK_SCA_JSON" "CERTCC_DRANZER" "CHAINLOOP_AI_AGENT_CONFIG" "CHAINLOOP_AI_CODING_SESSION" "CHAINLOOP_AI_SECURITY_CONTEXT" "CHAINLOOP_PR_INFO" "CHAINLOOP_RUNNER_CONTEXT" "CHECKMARX_JSON" "COBERTURA_XML" "CONTAINER_IMAGE" "CSAF_INFORMATIONAL_ADVISORY" "CSAF_SECURITY_ADVISORY" "CSAF_SECURITY_INCIDENT_RESPONSE" "CSAF_VEX" "EVIDENCE" "GHAS_CODE_SCAN" "GHAS_DEPENDENCY_SCAN" "GHAS_SECRET_SCAN" "GITLAB_SECURITY_REPORT" "GITLEAKS_JSON" "GRAPHQL_SPEC" "HELM_CHART" "JACOCO_XML" "JUNIT_XML" "OPENAPI_SPEC" "OPENVEX" "OSSF_SCORECARD_JSON" "OVERSECURED_JSON" "PITEST_XML" "RADAMSA_CRASHES" "RADAMSA_REPORT" "SARIF" "SBOM_CYCLONEDX_JSON" "SBOM_SPDX_JSON" "SLSA_PROVENANCE" "STRING" "SYSINTERNALS_ACCESSCHK" "SYSINTERNALS_SIGCHECK" "TRUFFLEHOG_JSON" "TWISTCLI_SCAN_JSON" "YELP_DETECT_SECRETS_BASELINE" "ZAP_DAST_ZIP"]
+--kind string                          kind of the material to be recorded: ["ARTIFACT" "ASYNCAPI_SPEC" "ATTESTATION" "BLACKDUCK_SCA_JSON" "CERTCC_DRANZER" "CHAINLOOP_AI_AGENT_CONFIG" "CHAINLOOP_AI_CODING_SESSION" "CHAINLOOP_AI_SECURITY_CONTEXT" "CHAINLOOP_PR_INFO" "CHAINLOOP_RUNNER_CONTEXT" "CHECKMARX_JSON" "COBERTURA_XML" "CONTAINER_IMAGE" "CSAF_INFORMATIONAL_ADVISORY" "CSAF_SECURITY_ADVISORY" "CSAF_SECURITY_INCIDENT_RESPONSE" "CSAF_VEX" "EVIDENCE" "GHAS_CODE_SCAN" "GHAS_DEPENDENCY_SCAN" "GHAS_SECRET_SCAN" "GITLAB_SECURITY_REPORT" "GITLEAKS_JSON" "GRAPHQL_SPEC" "HELM_CHART" "JACOCO_XML" "JUNIT_XML" "MSBUILD_LOG" "OPENAPI_SPEC" "OPENVEX" "OSSF_SCORECARD_JSON" "OVERSECURED_JSON" "PITEST_XML" "RADAMSA_CRASHES" "RADAMSA_REPORT" "SARIF" "SBOM_CYCLONEDX_JSON" "SBOM_SPDX_JSON" "SLSA_PROVENANCE" "STRING" "SYSINTERNALS_ACCESSCHK" "SYSINTERNALS_SIGCHECK" "TRUFFLEHOG_JSON" "TWISTCLI_SCAN_JSON" "YELP_DETECT_SECRETS_BASELINE" "ZAP_DAST_ZIP"]
 --max-extract-entries int              max number of files to extract when --value is an archive (default 10000)
 --max-extract-size string              max total uncompressed size to extract when --value is an archive (default "1GiB")
 --name string                          name of the material as shown in the contract
@@ -2876,7 +2876,7 @@ Options
 --annotation strings          Key-value pairs of material annotations (key=value)
 -h, --help                        help for eval
 --input stringArray           Key-value pairs of policy inputs (key=value)
---kind string                 Kind of the material: ["ARTIFACT" "ASYNCAPI_SPEC" "ATTESTATION" "BLACKDUCK_SCA_JSON" "CERTCC_DRANZER" "CHAINLOOP_AI_AGENT_CONFIG" "CHAINLOOP_AI_CODING_SESSION" "CHAINLOOP_AI_SECURITY_CONTEXT" "CHAINLOOP_PR_INFO" "CHAINLOOP_RUNNER_CONTEXT" "CHECKMARX_JSON" "COBERTURA_XML" "CONTAINER_IMAGE" "CSAF_INFORMATIONAL_ADVISORY" "CSAF_SECURITY_ADVISORY" "CSAF_SECURITY_INCIDENT_RESPONSE" "CSAF_VEX" "EVIDENCE" "GHAS_CODE_SCAN" "GHAS_DEPENDENCY_SCAN" "GHAS_SECRET_SCAN" "GITLAB_SECURITY_REPORT" "GITLEAKS_JSON" "GRAPHQL_SPEC" "HELM_CHART" "JACOCO_XML" "JUNIT_XML" "OPENAPI_SPEC" "OPENVEX" "OSSF_SCORECARD_JSON" "OVERSECURED_JSON" "PITEST_XML" "RADAMSA_CRASHES" "RADAMSA_REPORT" "SARIF" "SBOM_CYCLONEDX_JSON" "SBOM_SPDX_JSON" "SLSA_PROVENANCE" "STRING" "SYSINTERNALS_ACCESSCHK" "SYSINTERNALS_SIGCHECK" "TRUFFLEHOG_JSON" "TWISTCLI_SCAN_JSON" "YELP_DETECT_SECRETS_BASELINE" "ZAP_DAST_ZIP"]
+--kind string                 Kind of the material: ["ARTIFACT" "ASYNCAPI_SPEC" "ATTESTATION" "BLACKDUCK_SCA_JSON" "CERTCC_DRANZER" "CHAINLOOP_AI_AGENT_CONFIG" "CHAINLOOP_AI_CODING_SESSION" "CHAINLOOP_AI_SECURITY_CONTEXT" "CHAINLOOP_PR_INFO" "CHAINLOOP_RUNNER_CONTEXT" "CHECKMARX_JSON" "COBERTURA_XML" "CONTAINER_IMAGE" "CSAF_INFORMATIONAL_ADVISORY" "CSAF_SECURITY_ADVISORY" "CSAF_SECURITY_INCIDENT_RESPONSE" "CSAF_VEX" "EVIDENCE" "GHAS_CODE_SCAN" "GHAS_DEPENDENCY_SCAN" "GHAS_SECRET_SCAN" "GITLAB_SECURITY_REPORT" "GITLEAKS_JSON" "GRAPHQL_SPEC" "HELM_CHART" "JACOCO_XML" "JUNIT_XML" "MSBUILD_LOG" "OPENAPI_SPEC" "OPENVEX" "OSSF_SCORECARD_JSON" "OVERSECURED_JSON" "PITEST_XML" "RADAMSA_CRASHES" "RADAMSA_REPORT" "SARIF" "SBOM_CYCLONEDX_JSON" "SBOM_SPDX_JSON" "SLSA_PROVENANCE" "STRING" "SYSINTERNALS_ACCESSCHK" "SYSINTERNALS_SIGCHECK" "TRUFFLEHOG_JSON" "TWISTCLI_SCAN_JSON" "YELP_DETECT_SECRETS_BASELINE" "ZAP_DAST_ZIP"]
 --material string             Path to material or attestation file
 -p, --policy string               Policy reference (./my-policy.yaml, https://my-domain.com/my-policy.yaml, chainloop://my-stored-policy) (default "policy.yaml")
 --project string              Project name to use as engine context for chainloop.* built-ins

app/controlplane/api/workflowcontract/v1/crafting_schema.proto

@@ -209,6 +209,11 @@ message CraftingSchema {
       // repository's fix history, the attack surfaces they share, ranked risks,
       // and byte-verifiable evidence anchors backing each claim
       CHAINLOOP_AI_SECURITY_CONTEXT = 45;
+      // Build log of Microsoft build tools: an MSBuild binary log (-bl), an
+      // MSBuild text log, a Visual C++ build log (BuildLog.htm, written by
+      // VCBuild), or an archive of them. Its compiler and build warnings and
+      // errors are evaluated.
+      MSBUILD_LOG = 46;
     }
   }
 }

app/controlplane/api/workflowcontract/v1/crafting_schema_test.go

@@ -359,6 +359,10 @@ func TestMaterialKindsExcludedFromAutoDetection(t *testing.T) {
 			name: "radamsa crashes accept almost any non-empty file",
 			kind: v1.CraftingSchema_Material_RADAMSA_CRASHES,
 		},
+		{
+			name: "build log probing parses whole logs of hundreds of megabytes",
+			kind: v1.CraftingSchema_Material_MSBUILD_LOG,
+		},
 	}
 
 	for _, tc := range testCases {

app/controlplane/api/workflowcontract/v1/crafting_schema_validations.go

@@ -42,6 +42,9 @@ import (
 //     an app platform), but the export envelope is not published by the vendor,
 //     so pinning it here would bet every other JSON kind on a shape inferred
 //     from a sample.
+//   - MSBUILD_LOG: recognizing a log means parsing it, and diagnostic-verbosity
+//     text logs reach hundreds of megabytes; probing every file for it would
+//     slow down every auto-detected material.
 //
 // TestMaterialKindsExcludedFromAutoDetection pins these exclusions.
 var CraftingMaterialInValidationOrder = []CraftingSchema_Material_MaterialType{

pkg/attestation/crafter/api/attestation/v1/crafting_state.go

@@ -27,6 +27,7 @@ import (
 	v1 "github.com/chainloop-dev/chainloop/app/controlplane/api/workflowcontract/v1"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/crafter/materials/accesschk"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/crafter/materials/attestation"
+	"github.com/chainloop-dev/chainloop/pkg/attestation/crafter/materials/buildlog"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/crafter/materials/cobertura"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/crafter/materials/dranzer"
 	"github.com/chainloop-dev/chainloop/pkg/attestation/crafter/materials/jacoco"
@@ -350,6 +351,16 @@ func (m *Attestation_Material) ingestMaterialToJSON(rawMaterial []byte, value st
 			return nil, fmt.Errorf("invalid dranzer material: %w", err)
 		}
 		return json.Marshal(bundle)
+	case v1.CraftingSchema_Material_MSBUILD_LOG:
+		// Build logs are binary (MSBuild -bl), plain text or HTML, possibly
+		// several in an archive. They project to the normalized diagnostics
+		// only, with no raw text: diagnostic-verbosity text logs reach hundreds
+		// of megabytes and the policy engine holds its whole input in memory.
+		report, err := buildlog.Parse(rawMaterial)
+		if err != nil {
+			return nil, fmt.Errorf("invalid build log material: %w", err)
+		}
+		return json.Marshal(report)
 	}
 
 	return rawMaterial, nil

pkg/attestation/crafter/api/attestation/v1/crafting_state_test.go

@@ -372,6 +372,35 @@ func TestDranzerBundleIsEvaluable(t *testing.T) {
 	assert.Len(t, decoded["reports"], 4)
 }
 
+// TestMSBuildLogIsEvaluable guards that an MSBUILD_LOG material, which is stored as
+// the raw (often gzip-compressed binary) log, projects to the normalized
+// diagnostics policies evaluate. Handing the engine the raw bytes would fail
+// to parse, or for a text log yield nothing to evaluate.
+func TestMSBuildLogIsEvaluable(t *testing.T) {
+	m := &Attestation_Material{
+		MaterialType: schemaapi.CraftingSchema_Material_MSBUILD_LOG,
+		M: &Attestation_Material_Artifact_{
+			Artifact: &Attestation_Material_Artifact{Name: "build-log", Digest: "sha256:deadbeef"},
+		},
+	}
+
+	for _, name := range []string{"sample.binlog", "msbuild.txt", "vcbuild.htm"} {
+		t.Run(name, func(t *testing.T) {
+			content, err := m.GetEvaluableContent("../../../materials/testdata/buildlog/"+name, nil)
+			require.NoError(t, err)
+
+			var decoded map[string]any
+			require.NoError(t, json.NewDecoder(bytes.NewReader(content)).Decode(&decoded))
+
+			assert.NotEmpty(t, decoded["tool"].(map[string]any)["name"])
+			assert.EqualValues(t, 4, decoded["summary"].(map[string]any)["warnings"])
+			assert.Len(t, decoded["diagnostics"], 4)
+			assert.Len(t, decoded["logs"], 1)
+			assert.Contains(t, decoded, "chainloop_metadata")
+		})
+	}
+}
+
 // TestRadamsaReportArchiveIsEvaluable guards that a RADAMSA_REPORT material whose
 // value is an archive of per-run -M logs projects to input.elements holding the
 // records merged across every entry. Recording the archive whole without merging