mitre / hipcheck

Automatically assess and score software repositories for supply chain risk.
https://mitre.github.io/hipcheck/
Apache License 2.0
80 stars 6 forks source link

feat: improve experience when using local plugins #555

Closed patrickjcasey closed 3 weeks ago

patrickjcasey commented 3 weeks ago

This change set improves the ergonomics of run 'local' plugins. Rather than running them at the path reachable in a provided Policy file, hipcheck now copies the entrypoints and plugin manifest files to the same cache locations that downloaded plugins would use.

Here is what tree ~/Library/Caches/hipcheck/plugins looks like on macOS after running hipcheck:

image

I deleted everything in ~/Library/Caches/hipcheck/plugins before this run

I used the config on this branch in config/Hipcheck.kdl for testing this branch

This branch also added manifest paths to binary and churn to config/Hipcheck.kdl and updated the policy expression for review, in order to allow hipcheck to successfully complete its analysis with the config in the repo