rabbitmq / credentials-obfuscation

Tiny library/OTP app for credential obfuscation
Other
14 stars 8 forks source link

Add schema file #29

Closed SimonUnge closed 1 year ago

SimonUnge commented 1 year ago

Proposed Changes

Add schema-files that uses supported_ciphers|hashes as validation.

Types of Changes

What types of changes does your code introduce to this project? Put an x in the boxes that apply

Checklist

Put an x in the boxes that apply. You can also fill these out after creating the PR. If you're unsure about any of them, don't hesitate to ask on the mailing list. We're here to help! This is simply a reminder of what we are going to look for before merging your code.

Further Comments

If this is a relatively large or complex change, kick off the discussion by explaining why you chose the solution you did and what alternatives you considered, etc.

SimonUnge commented 1 year ago

I am happy to add tests too, if required.

michaelklishin commented 1 year ago

@SimonUnge I think this is so straighforward that we can do without schema generation tests. One thing I am worried about if these defaults may show up in the generated config files in RabbitMQ's own suites. If so we will have to use cuttlefish:unset/0 like so

{mapping, "connection_max", "rabbit.connection_max",
  [{datatype, [{atom, infinity}, integer]}]}.

{translation, "rabbit.connection_max",
 fun(Conf) ->
  case cuttlefish:conf_get("connection_max", Conf, undefined) of
      undefined -> cuttlefish:unset();
      infinity  -> infinity;
      Val when is_integer(Val) -> Val;
      _         -> cuttlefish:invalid("should be a non-negative integer")
  end
 end
}.
SimonUnge commented 1 year ago

@michaelklishin I'll give it a try in rabbitmq, if I can figure out bazel enough to use the main branch!

michaelklishin commented 1 year ago

@SimonUnge here is one example where we use a dependency from a git repo.

michaelklishin commented 1 year ago

@SimonUnge and here is where we define the Cuttlefish dependency (currently consumed from hex.pm).

SimonUnge commented 1 year ago

Thank you!

SimonUnge commented 1 year ago

Building now. But, we could ofc just use 'unset()' as the code itself has the defaults

michaelklishin commented 1 year ago

Let's use cuttlefish:unset/0 then, it's a standard thing to do in the RabbitMQ codebase.

SimonUnge commented 1 year ago

OK, I'll create a new PR.

SimonUnge commented 1 year ago

@michaelklishin Something like this seems to be required in rabbitmq bazel setup to fetch the file:

diff --git a/bazel/BUILD.credentials_obfuscation b/bazel/BUILD.credentials_obfuscation
index e3381d99bd..746a28147e 100644
--- a/bazel/BUILD.credentials_obfuscation
+++ b/bazel/BUILD.credentials_obfuscation
@@ -57,7 +57,11 @@ filegroup(
     ],
 )

-filegroup(name = "priv")
+filegroup(
+    name = "priv",
+    srcs = ["priv/schema/credentials_obfuscation.schema"],
+)
+

Should I create a PR for that in the main repo? will also look into if make needs something special. Or the packaging target for the delivery?

michaelklishin commented 1 year ago

@SimonUnge possibly. This is not a plugin, just a dependency, so various code path rules for it can be different (e.g. the priv directory will not be automatically included)>

SimonUnge commented 1 year ago

Not sure how it works for hex packages to be honest. The above bazel fix worked to get it included when bazel fetch the code from git... I'll do some digging, and maybe ask Rin!