aquasecurity / chain-bench

An open-source tool for auditing your software supply chain stack for security compliance based on a new CIS Software Supply Chain benchmark.
Apache License 2.0
715 stars 62 forks source link

Non-conventional JSON format #43

Closed rgreinho closed 2 years ago

rgreinho commented 2 years ago

Description

When saving the results as JSON, the keys are formatted in a non-conventional nor consistent manner. This makes deserializing the file with other tools unnecessary complicated.

What did you expect to happen?

I expected all the keys to use a conventional encoding, like lowercase or camelCase.

For instance, looking at the JSON API recommendations (https://jsonapi.org/recommendations/), they recommend the keys to use camelCase (which seems to be the most commonly accepted one):

Member names SHOULD be camel-cased (i.e., wordWordWord)

Looking at several libraries, the more common encodings are:

What happened instead?

Instead the id key is UPPERCASE, and the other ones are Capitalized.

[
  {
    "ID": "1.1.3",
    "Name": "Ensure any change to code receives approval of two strongly authenticated users",
    "Descrition": "Ensure that every code change is reviewed and approved by two authorized contributors who are strongly authenticated.",
    "Remediation": "An organization can protect specific code branches — for example, the \"main\" branch which often is the version deployed to production — by setting protection rules. These rules secure your code repository from unwanted or unauthorized changes. You may set requirements for any code change to that branch, and thus specify a minimum number of reviewers required to approve a change.",
    "Result": "Failed",
    "Reason": "",
    "Url": "https://avd.aquasec.com/compliance/softwaresupplychain/cis-1.0/cis-1.0-sourcecode/1.1"
  }
]

Additional info

Tools like gomodifytags can simplify the process of mass editing the struct tags.

naortalmor1 commented 2 years ago

On it 😄