[ENT-12099] Initial implementation of an experimental feature of policy set analysis #218
Conversation
Signed-off-by: jakub-nt <[email protected]>
Signed-off-by: jakub-nt <[email protected]>
|
Thanks for submitting a PR! Maybe @craigcomstock can review this? |
| fetch_archive(RI_ARCHIVE_URL, RI_SHA1_CHECKSUM, with_index=False) | ||
| # TODO the release information checksum needs to be updated on each new release | ||
| # currently, if the checksum is not manually updated, the old, already downloaded files will continue to be used | ||
| # and if the old files have not already been downloaded, the download from GitHub will fail |
There was a problem hiding this comment.
Right. So when we release we need to update this.
We need to add instructions to this template ticket for releases: https://northerntech.atlassian.net/browse/ENT-12575
There was a problem hiding this comment.
I added a note already referring to line 83 above but we should update it after merging this PR to the "real" location/URL. Maybe it would be better to externalize this checksum in a single file for easier maintenance so folks could just "edit file" in github and make a PR without having to search through analyze.py?
There was a problem hiding this comment.
@craigcomstock @jakub-nt no, we should not do it like this. As it's implemented here, cfbs analyze essentially stops working in all versions of cfbs when we release something new in release-information, and we have to release a new version of cfbs to fix it.
Keep in mind that HTTPS already has signatures and thus integrity checking, and so should be protected against corrupt downloads / MITM attacks. So what we are doing here is an additional check, to protect against for example a compromised user having access to edit the data in GitHub.
The correct way to do this is via some form of "releases". Either GH releases, with a download zip and a checksums.txt - assuming that they are a bit better protected, i.e. fewer people have access to edit releases. Or to avoid the single point of failure in GitHub, we could put the checksums.txt in another place, like our cfengine.com website, via the releases.json.
…nalyze` Signed-off-by: jakub-nt <[email protected]>
Signed-off-by: jakub-nt <[email protected]>
No description provided.