From e39f4c7519d7fac26d542038601307bd241f080d Mon Sep 17 00:00:00 2001
From: Jeremi Joslin <jeremi@joslin.fr>
Date: Fri, 14 Aug 2026 06:35:52 +0700
Subject: [PATCH] fix(release): accept Syft root directory evidence

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
---
 release/scripts/check-advisory-baselines.py   | 10 ++++--
 .../scripts/test_check_advisory_baselines.py  | 36 +++++++++++++++++++
 2 files changed, 43 insertions(+), 3 deletions(-)

diff --git a/release/scripts/check-advisory-baselines.py b/release/scripts/check-advisory-baselines.py
index 1c9e9fc6b..1351b8003 100755
--- a/release/scripts/check-advisory-baselines.py
+++ b/release/scripts/check-advisory-baselines.py
@@ -478,13 +478,16 @@ def syft_artifacts(report: Any) -> dict[str, dict[str, Any]]:
     return indexed
 
 
-def validate_image_path(value: Any, field: str) -> str:
+def validate_image_path(value: Any, field: str, *, allow_root: bool = False) -> str:
     if (
         not isinstance(value, str)
         or not value.startswith("/")
-        or value == "/"
+        or (value == "/" and not allow_root)
         or "\x00" in value
-        or any(part in {"", ".", ".."} for part in value.split("/")[1:])
+        or (
+            value != "/"
+            and any(part in {"", ".", ".."} for part in value.split("/")[1:])
+        )
     ):
         fail(f"{field} must be a normalized absolute image path")
     return value
@@ -501,6 +504,7 @@ def syft_files(report: Any) -> tuple[frozenset[str], tuple[tuple[str, str], ...]
         path = validate_image_path(
             location.get("path") if isinstance(location, dict) else None,
             "syft file location path",
+            allow_root=True,
         )
         if path in paths:
             fail(f"syft report contains duplicate file path: {path}")
diff --git a/release/scripts/test_check_advisory_baselines.py b/release/scripts/test_check_advisory_baselines.py
index 896566534..e782db8d7 100644
--- a/release/scripts/test_check_advisory_baselines.py
+++ b/release/scripts/test_check_advisory_baselines.py
@@ -300,6 +300,42 @@ def finding(self, **kwargs):
         grype, syft = self.reports(**kwargs)
         return self.module.normalize_grype(grype, self.SUBJECT, syft).findings[0]
 
+    def test_syft_root_directory_is_valid_file_evidence(self):
+        grype, syft = self.reports()
+        syft["files"].append(
+            {
+                "id": "file-root",
+                "location": {"path": "/", "layerID": self.BASE_LAYER_1},
+                "metadata": {"type": "Directory"},
+            }
+        )
+
+        normalized = self.module.normalize_grype(grype, self.SUBJECT, syft)
+
+        self.assertIn("/", normalized.findings[0].syft_file_paths)
+
+    def test_reviewed_assertion_path_cannot_target_root(self):
+        with self.assertRaises(SystemExit):
+            self.module.validate_image_path("/", "reviewed assertion path")
+
+    def test_syft_file_paths_reject_unsafe_or_unnormalized_values(self):
+        for path in (
+            "app/service",
+            "/app//service",
+            "/app/service/",
+            "/app/./service",
+            "/app/../service",
+            "/app/\x00service",
+        ):
+            with self.subTest(path=repr(path)):
+                with self.assertRaises(SystemExit):
+                    self.module.syft_files({"files": [{"location": {"path": path}}]})
+
+    def test_syft_file_paths_reject_duplicates_including_root(self):
+        root_entry = {"location": {"path": "/"}}
+        with self.assertRaises(SystemExit):
+            self.module.syft_files({"files": [root_entry, copy.deepcopy(root_entry)]})
+
     def with_digest(self, definition):
         definition["definition_digest"] = self.module.definition_digest(definition)
         return definition