🌱 [W.I.P] feat(listing): add ignorelist for scanning #1408
Conversation
Fixes ossf#1406 Signed-off-by: Furkan <[email protected]> Co-authored-by: Batuhan <[email protected]>
|
This is currently WIP. Passing the We add a new And we are not passing @laurentsimon Can you please enlighten us on this? |
|
The current idea we have is to build the "ignore list" as a policy applied on the canonical scorecard results. By canonical, I mean scorecard results without filtering. Consumers of the canonical results can then decide to apply a policy of their choice, e.g., "I don't care about results referencing path /some/path for check CheckName". The policy file may be different for every consumer, and we aim to provide a policy language to express more complex policies, e.g. using https://cuelang.org/ or https://www.openpolicyagent.org/docs/latest/policy-language/ or anything users may want. If we were to provide a directory list that changes scorecard's behavior at the time it gathers information (this PR), it becomes harder to tell what the ground truth is. Also, it's not expressive enough for other use cases users may want. So we envisage a world where:
In order to build expressive policies, we aim to add some features in scorecard to output the results in a more structure format. We're tracking it in #1245. The first step is to split the checks into 2 parts:
Let me know if you have questions. |
|
Stale pull request message |
|
A bit confused and lost @laurentsimon on this PR. Thanks for your thoughts. How should we proceed here? 🙏 |
|
We're going to address the |
The Maven 'Standard Directory Layout' [0] is fairly widely used, not only in Maven but also in adjacent ecosystems like Gradle and clojure. Longer-term this would become part of the default policy, see discussion at ossf#1408 (comment) etc. [0]: https://maven.apache.org/guides/introduction/introduction-to-the-standard-directory-layout.html
The Maven 'Standard Directory Layout' [0] is fairly widely used, not only in Maven but also in adjacent ecosystems like Gradle and clojure. Longer-term this would become part of the default policy, see discussion at ossf#1408 (comment) etc. [0]: https://maven.apache.org/guides/introduction/introduction-to-the-standard-directory-layout.html
The Maven 'Standard Directory Layout' [0] is fairly widely used, not only in Maven but also in adjacent ecosystems like Gradle and clojure. Longer-term this would become part of the default policy, see discussion at ossf#1408 (comment) etc. [0]: https://maven.apache.org/guides/introduction/introduction-to-the-standard-directory-layout.html
The Maven 'Standard Directory Layout' [0] is fairly widely used, not only in Maven but also in adjacent ecosystems like Gradle and clojure. Longer-term this would become part of the default policy, see discussion at ossf#1408 (comment) etc. [0]: https://maven.apache.org/guides/introduction/introduction-to-the-standard-directory-layout.html Signed-off-by: Arnout Engelen <[email protected]>
The Maven 'Standard Directory Layout' [0] is fairly widely used, not only in Maven but also in adjacent ecosystems like Gradle and clojure. Longer-term this would become part of the default policy, see discussion at ossf#1408 (comment) etc. [0]: https://maven.apache.org/guides/introduction/introduction-to-the-standard-directory-layout.html Signed-off-by: Arnout Engelen <[email protected]>
The Maven 'Standard Directory Layout' [0] is fairly widely used, not only in Maven but also in adjacent ecosystems like Gradle and clojure. Longer-term this would become part of the default policy, see discussion at ossf#1408 (comment) etc. [0]: https://maven.apache.org/guides/introduction/introduction-to-the-standard-directory-layout.html Signed-off-by: Arnout Engelen <[email protected]>
The Maven 'Standard Directory Layout' [0] is fairly widely used, not only in Maven but also in adjacent ecosystems like Gradle and clojure. Longer-term this would become part of the default policy, see discussion at ossf#1408 (comment) etc. [0]: https://maven.apache.org/guides/introduction/introduction-to-the-standard-directory-layout.html Signed-off-by: Arnout Engelen <[email protected]>
The Maven 'Standard Directory Layout' [0] is fairly widely used, not only in Maven but also in adjacent ecosystems like Gradle and clojure. Longer-term this would become part of the default policy, see discussion at #1408 (comment) etc. [0]: https://maven.apache.org/guides/introduction/introduction-to-the-standard-directory-layout.html Signed-off-by: Arnout Engelen <[email protected]>
The Maven 'Standard Directory Layout' [0] is fairly widely used, not only in Maven but also in adjacent ecosystems like Gradle and clojure. Longer-term this would become part of the default policy, see discussion at ossf#1408 (comment) etc. [0]: https://maven.apache.org/guides/introduction/introduction-to-the-standard-directory-layout.html Signed-off-by: Arnout Engelen <[email protected]> Signed-off-by: Shofiya2003 <[email protected]>
The Maven 'Standard Directory Layout' [0] is fairly widely used, not only in Maven but also in adjacent ecosystems like Gradle and clojure. Longer-term this would become part of the default policy, see discussion at ossf#1408 (comment) etc. [0]: https://maven.apache.org/guides/introduction/introduction-to-the-standard-directory-layout.html Signed-off-by: Arnout Engelen <[email protected]> Signed-off-by: Shofiya2003 <[email protected]>
Signed-off-by: Furkan [email protected] @Dentrax
Co-authored-by: Batuhan [email protected] @developer-guy
Fixes #1406
See #1406 and anchore/syft#593
We have the ability to pass ignorelist.
No