Closed jan-cerny closed 7 years ago
This definitely needs a comment. Looking at the line and not being familiar with the short ID feature there is no way you can figure out what it is doing...
Doesn't this break the rest of the API? Like creating and defining tasks and all that? Short profile ID won't work when generating HTML guides.
I am leaning NACK on this.
This is in "oscapd-evalaute", not in "oscapd-cli".
This condition checks if the ID provided by user is a suffix of some profile ID in SSG for the target platform. I depends on underlying tool eg. oscap or oscap-ssh if it can process the short ID.
The case that I solve by this patch is: I have oscap
that supports shortened IDs installed, so I want to use shortened IDs in oscapd-evaluate scan
as well, but I can't, because oscapd-evaluate scan
parses SSG datastream, it can't find that exact ID there, so it terminates.
@mpreisler Could you explain connection of this with creating and defining tasks, please? Do we need a more complex solution for some reason?
IMO if we add some paradigm to one part of the API we should add it everywhere. Profile ID meaning different things in different parts of the API leads to confusion. Furthermore, both oscapd-cli and oscapd-evaluate use EvaluationSpec, so I don't see why this should be limited to oscapd-evaluate.
@mpreisler OK, that sounds reasonable. So I think I will rework the fix so that it completes the shortened ID to the full ID by longest suffix match, preferably before EvaluationSpec is created. That way the shortened ID won't be stored in EvaluationSpec, so it won't introduce any paradigm in any API.
I have reworked it so that it doesn't work with short profile IDs in the API, it completes them instead.
This doesn't solve much and goes contrary to what I said. As a user I expect to be able to use short IDs in all parts of openscap daemon or nowhere.
On Jul 13, 2017 05:47, "Jan Černý" notifications@github.com wrote:
I have reworked it so that it doesn't work with short profile IDs in the API, it completes them instead.
— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/OpenSCAP/openscap-daemon/pull/107#issuecomment-315029438, or mute the thread https://github.com/notifications/unsubscribe-auth/AAt-ARgHa_fsx_o1xKjSEmRU6P6sFXcEks5sNeexgaJpZM4OMLwX .
@mpreisler Then, please could you explain how do you imagine short IDs in oscapd-evaluate
? I don't understand at all what do you want.
I still think it would be beneficial to support short IDs in oscapd-evaluate
, because that will enable short IDs in atomic scan
, which will improve user experience of atomic scan
, because users will not have to remember and type looong IDs.
If it isn't possible to enable short IDs in oscapd-evaluate
, please feel free to close this pull request.
@mpreisler Any idea?
@mpreisler Any idea?
As I said, if it were me I would do this in a way that adds short profile IDs to both oscapd-evaluate (all subcommands) and oscapd-cli (all subcommands). Perhaps others can chime in.
We discussed this yesterday. I will look into this problem again. I will try to find a solution that works across whole Deamon in all use-cases. It could be done in EvalauationSpec, maybe as a new method of EvaluationSpec.
I looked into this again today. I think that EvaulationSpec doesn't care if the ID is short or long. Only subcommand in oscapd-cli that I found that takes the profile ID is "task-create -i", which is interactive, so user just presses a number, and doesn't type the ID by hand. In oscapd-evaluate, the only subcommand is "oscapd-evaluate scan", which was solved in this PR. I think we I just need the code to evaluation_spec module.
I have created a method in EvaluationSpec and moved the code there.
I have renamed the method to "select_profile_by_suffix" and changed "profile" variable to "profile_suffix".
I have improved this patch . The method select_profile_by_suffix
throws an exception. This exception is caught in oscapd-evaluate
where an error message is produced.
@openscap-ci test this please
I have done requested changes.
LGTM. I think @mpreisler would like to review before merging.
@yuumasato thank you
I trust you @yuumasato ! :D
Recently we implemented short profile IDs in OpenSCAP. However oscapd-evaluate checks if the given profile ID is present in SCAP Security Guide Datastream. We need to apply suffix matching on the list of SSG profiles. Otherwise we will get an error that the profile was not found.