search

mitre / hipcheck

Automatically assess and score software repositories for supply chain risk.
https://mitre.github.io/hipcheck/
Apache License 2.0
68 stars 3 forks source link

Create a json schema in the SDK for Target #444

Open j-lanson opened 2 hours ago

j-lanson commented 2 hours ago

RFD4 says that the top-level analysis plugins that are used in a policy file will each receive the execution's instance of a resolved Target to the query endpoint they declare (often the default/unnamed endpoint). But so far we don't actually have/use the schemas to declare the type of Target once JSON-ified. Having this available in the SDK would help top-level analysis plugin authors know what type of data to expect.

alilleybrinker commented 1 hour ago

Fair point. The simplest / quickest option would be to make the relevant types Serialize and just serialize them. Alternatively, since I know there's the RFD open to refactor the targeting setup, we might try to make the JSON data match the planned new format post-RFD-refactor.

j-lanson commented 1 hour ago

Yeah it is a little weird with the timing. I'll leave it to you to decide whether 1) its more important that customers have the ability to play with writing an analysis plugin using the SDK as soon as we publish 3.7.0, with the assumption they will have to change their code once the Target struct changes or 2) or we should wait to offer a Target schema until the Target struct is stabilized after RFD5 is accepted / implemented (which could be a month away)

alilleybrinker commented 1 hour ago

Let's go with option 1. We do need to ship the target as part of the default query request made for top-level plugins, and it was an oversight to omit. I expect we'll have other needs to modify the plugin system based on experience with it, so I don't feel too bad about needing to potentially change the target representation for that query in a future version.