Add an SSG module for interacting with SSG#12
Add an SSG module for interacting with SSG#12dLobatog merged 1 commit intoOpenSCAP:masterfrom akofink:add-ssg
Conversation
| require 'ssg/downloader' | ||
| require 'ssg/unarchiver' | ||
|
|
||
| module Ssg |
There was a problem hiding this comment.
In general, I've tried to design these two classes so that the methods are short and well-named so it's easy to understand what is happening without a bunch of comments.
|
|
||
| def download_urls | ||
| get_json(LATEST_RELEASE_URI).dig('assets').map do |asset| | ||
| asset.dig('browser_download_url') |
There was a problem hiding this comment.
This method is coupled to GitHub's releases api, unfortunately. If they change the structure of the response, we'll have to update this method. It's essentially:
http https://api.github.com/repos/ComplianceAsCode/content/releases/latest | jq '.assets[] | .browser_download_url'
| # Downloads SCAP datastreams from the SCAP Security Guide | ||
| # https://github.com/ComplianceAsCode/content | ||
| class Downloader | ||
| RELEASES_API = 'https://api.github.com/repos'\ |
There was a problem hiding this comment.
How official source is this?
There was a problem hiding this comment.
It doesn't look good :( (from #openscap on irc.devel.rh):
13:00 akofink ╡ o/ Hi - how reliably do the releases at https://github.com/ComplianceAsCode/content/releases match what is packaged and shipped as RPMs to RHEL?
13:01 ⤷ ╡ like, RHEL7 has scap-security-guide-0.1.43-13.el7.noarch - are the datastreams provided guaranteed to match tag v0.1.43 on github?
13:11 ascheel ╡ akofink: (I don't work on this team any more, and everyone who still does is UTC+2) -- I think dist-git is your friend here.
13:13 ascheel ╡ akofink: `rhpkg clone scap-security-guide` -- 7.7 has what you see there, 7.8 has a rebase to v0.1.46. There's a number of patches (~28) which have been picked on top of 0.1.43 tarball.
13:14 akofink ╡ hrmm, okay :/ it seems more complicated than I expected
13:14 ascheel ╡ akofink: What are you looking for in particular while I have it up?
13:15 akofink ╡ I'm writing a thing to download and extract certain datastreams of specific versions of the SSG, and we'd like to sync the SSG provided to RHEL6, 7, and 8. It seems like the only way to really do that is to look at the RHEL package repos
13:16 ⤷ ╡ https://github.com/dLobatog/openscap_parser/pull/12 if you're interested
13:16 ⤷ ╡ (the openscap ffi gem has memory leaks last we checked)
13:17 ascheel ╡ Yeah, sorry. The RHEL packaging process kinda hinders SSG here.
13:17 akofink ╡ thanks for the pointers though :)
13:18 ascheel ╡ akofink: Yeah looks like they've picked ~66 commits on top of that tag.
13:18 akofink ╡ geez
There was a problem hiding this comment.
I've also sent an email to scap-internal-list with the subject "Hosted SSG - A Use Case for cloud.redhat.com" if you're interested in following the discussion there.
dLobatog
left a comment
dLobatog
left a comment
There was a problem hiding this comment.
@akofink Thanks! It looks good to me, I was able to download and test it successfully.
I would not really do any testing since you're just calling libraries to download/unarchive. I wonder as you said though, if this is part of openscap_parser or should it rather be a openscap_ssg_downloader - I don't mind keeping it here as it's definitely handy and would help all users of openscap_parser, but IMO this should be another library. Your call.
|
Added a Readme. @dLobatog no tests, really? |
Policies and Rules come from the SCAP Security Guide, generated from https://github.com/ComplianceAsCode/content. This adds rake tasks to download and unarchive released versions of SSG for a given application, and a shortcut rake task for all the RHEL SSG content. Signed-off-by: Andrew Kofink <akofink@redhat.com>
|
Added a couple simple tests. This should be ready for final review |
3 participants
Policies and Rules come from the SCAP Security Guide, generated from
https://github.com/ComplianceAsCode/content. This adds rake tasks to
download and unarchive released versions of SSG for a given application,
and a shortcut rake task for all the RHEL SSG content.
Todo:
It seems weird to namespace parts of this under
OpenscapParser, such as theDownloaderandUnarchiver, since they do no parsing of SCAP content.@dLobatog I'd like a sanity check here before I go further with tests and docs. I plan on submitting another PR for any additional parsing code we need.
Signed-off-by: Andrew Kofink akofink@redhat.com