Skip to content

Conversation

@brokensound77
Copy link
Contributor

Issues

related to #2251

Summary

Build-time fields create changes to rule hashes without being accounted for explicitly within the version lock (essentially creating a "soft" lock). This is problematic because it creates a buggy situation where non-latest rules version bump every time due to the delta hash resulting from the differences from the build time fields. To address this, build time field introduction requires that all fields.

This adds a test to enforce that on any defined build time rule

@botelastic botelastic bot added the python Internal python for the repository label Aug 24, 2022
@Mikaayenson Mikaayenson linked an issue Aug 24, 2022 that may be closed by this pull request
5 tasks
Copy link
Contributor

@Mikaayenson Mikaayenson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Small suggestion

  • Account for new rules that don't add min_stack_version in toml

invalids = []

for rule in self.production_rules:
min_stack = rule.contents.metadata.min_stack_version
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will we never use soft-forking then, only hard-forking from the metadata field??

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

based on our last discussions, I don't think it is supportable (or advisable)

@brokensound77
Copy link
Contributor Author

I realized this would fail when backported to <8.3 branches and in general for branches <= build enforcement, so I added a constraint to check the current version for each build field in b2bec63

@brokensound77 brokensound77 merged commit d37eac8 into elastic:main Aug 26, 2022
protectionsmachine pushed a commit that referenced this pull request Aug 26, 2022
#2262)

* add test that newly introduced build-time fields for a min_stack for applicable rules.

* account for rules without min_stack_version

* limit test to >= stack ver

(cherry picked from commit d37eac8)
protectionsmachine pushed a commit that referenced this pull request Aug 26, 2022
#2262)

* add test that newly introduced build-time fields for a min_stack for applicable rules.

* account for rules without min_stack_version

* limit test to >= stack ver

(cherry picked from commit d37eac8)
protectionsmachine pushed a commit that referenced this pull request Aug 26, 2022
#2262)

* add test that newly introduced build-time fields for a min_stack for applicable rules.

* account for rules without min_stack_version

* limit test to >= stack ver

(cherry picked from commit d37eac8)
protectionsmachine pushed a commit that referenced this pull request Aug 26, 2022
#2262)

* add test that newly introduced build-time fields for a min_stack for applicable rules.

* account for rules without min_stack_version

* limit test to >= stack ver

(cherry picked from commit d37eac8)
protectionsmachine pushed a commit that referenced this pull request Aug 26, 2022
#2262)

* add test that newly introduced build-time fields for a min_stack for applicable rules.

* account for rules without min_stack_version

* limit test to >= stack ver

(cherry picked from commit d37eac8)
protectionsmachine pushed a commit that referenced this pull request Aug 26, 2022
#2262)

* add test that newly introduced build-time fields for a min_stack for applicable rules.

* account for rules without min_stack_version

* limit test to >= stack ver

(cherry picked from commit d37eac8)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport: auto python Internal python for the repository

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] Pre-Built Detection Rules Package Versioning

3 participants