Skip to content

Commit b352910

Browse files
committed
refactor: add --list-policies flag to check for available policies.
Signed-off-by: Demolus13 <[email protected]>
1 parent 78d80f9 commit b352910

File tree

6 files changed

+30
-14
lines changed

6 files changed

+30
-14
lines changed

docs/source/pages/tutorials/verify_with_existing_policy.rst

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,20 @@
1-
==============================================================
2-
Verify with an existing example policy using --existing-policy
3-
==============================================================
1+
===================================================================
2+
How to use the policy engine to verify with our predefined policies
3+
===================================================================
44

5-
This short tutorial shows how to use the ``--existing-policy`` flag with the ``verify-policy`` subcommand to run one of the example (predefined) policies that ship with Macaron.
5+
This tutorial shows how to use the ``--existing-policy`` flag with the ``verify-policy`` subcommand to run one of the predefined policies that ship with Macaron.
66

77
--------
88
Use case
99
--------
1010

11-
Use ``--existing-policy`` when you want to run one of the built-in example policies by name instead of providing a local policy file with ``--file``. Example policies are useful for quick checks or automated examples/tests.
11+
Use ``--existing-policy`` when you want to run one of the built-in policies by name instead of providing a local policy file with ``--file``. Pre-defined policies are useful for quick checks or automated examples/tests.
1212

1313
-------
1414
Example
1515
-------
1616

17-
Run the ``malware-detection`` example policy against a package URL:
17+
Run the ``malware-detection`` policy against a package URL:
1818

1919
.. code-block:: shell
2020

src/macaron/__main__.py

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -205,6 +205,18 @@ def verify_policy(verify_policy_args: argparse.Namespace) -> int:
205205
return os.EX_OK
206206

207207
policy_content = None
208+
if verify_policy_args.list_policies:
209+
policy_dir = os.path.join(macaron.MACARON_PATH, "resources", "policies", "datalog")
210+
policy_suffix = ".dl"
211+
template_suffix = f"{policy_suffix}.template"
212+
available_policies = [
213+
os.path.splitext(policy)[0].replace(policy_suffix, "")
214+
for policy in os.listdir(policy_dir)
215+
if policy.endswith(template_suffix)
216+
]
217+
logger.info("Available policies are:\n\t%s", "\n\t".join(available_policies))
218+
return os.EX_OK
219+
208220
if verify_policy_args.file:
209221
if not os.path.isfile(verify_policy_args.file):
210222
logger.critical('The policy file "%s" does not exist.', verify_policy_args.file)
@@ -232,7 +244,8 @@ def verify_policy(verify_policy_args: argparse.Namespace) -> int:
232244
with open(policy_path, encoding="utf-8") as file:
233245
policy_content = file.read()
234246
try:
235-
PackageURL.from_string(verify_policy_args.package_url)
247+
validation_package_url = verify_policy_args.package_url.replace("*", "")
248+
PackageURL.from_string(validation_package_url)
236249
policy_content = policy_content.replace("<PACKAGE_PURL>", verify_policy_args.package_url)
237250
except ValueError as err:
238251
logger.error("The package url %s is not valid. Error: %s", verify_policy_args.package_url, err)
@@ -603,6 +616,7 @@ def main(argv: list[str] | None = None) -> None:
603616
vp_parser.add_argument("-purl", "--package-url", help="PackageURL for policy template.")
604617
vp_group.add_argument("-f", "--file", type=str, help="Path to the Datalog policy.")
605618
vp_group.add_argument("-e", "--existing-policy", help="Name of the existing policy to run.")
619+
vp_group.add_argument("-l", "--list-policies", action="store_true", help="List the existing policy to run.")
606620
vp_group.add_argument("-s", "--show-prelude", action="store_true", help="Show policy prelude.")
607621

608622
# Find the repo and commit of a passed PURL, or the commit of a passed PURL and repo.

src/macaron/resources/policies/datalog/check-github-actions.dl.template

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,4 @@ Policy("github_actions_vulns", component_id, "GitHub Actions Vulnerability Detec
55

66
apply_policy_to("github_actions_vulns", component_id) :-
77
is_component(component_id, purl),
8-
match("<PACKAGE_PURL>*", purl).
8+
match("<PACKAGE_PURL>", purl).

src/macaron/resources/policies/datalog/malware-detection-dependencies.dl.template

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,4 @@ Policy("check-dependencies", component_id, "Check the dependencies of component.
77

88
apply_policy_to("check-dependencies", component_id) :-
99
is_component(component_id, purl),
10-
match("<PACKAGE_PURL>*", purl).
10+
match("<PACKAGE_PURL>", purl).

src/macaron/resources/policies/datalog/malware-detection.dl.template

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,4 @@ Policy("check-component", component_id, "Check component artifacts.") :-
66

77
apply_policy_to("check-component", component_id) :-
88
is_component(component_id, purl),
9-
match("<PACKAGE_PURL>*", purl).
9+
match("<PACKAGE_PURL>", purl).

tests/policy_engine/test_existing_policy.py

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,9 @@
1313

1414
def test_verify_existing_policy_success(tmp_path: Path) -> None:
1515
"""When an existing policy is provided and package-url is valid, verify_policy returns EX_OK."""
16-
db_file = tmp_path / "macaron.db"
17-
db_file.write_text("")
16+
db_file = os.path.join(tmp_path, "macaron.db")
17+
with open(db_file, "w", encoding="utf-8") as f:
18+
f.write("")
1819

1920
# Use a MagicMock for the handler.
2021
mock_handler = MagicMock()
@@ -48,8 +49,9 @@ def test_verify_existing_policy_success(tmp_path: Path) -> None:
4849

4950
def test_verify_existing_policy_not_found(tmp_path: Path) -> None:
5051
"""Requesting a non-existent policy returns usage error."""
51-
db_file = tmp_path / "macaron.db"
52-
db_file.write_text("")
52+
db_file = os.path.join(tmp_path, "macaron.db")
53+
with open(db_file, "w", encoding="utf-8") as f:
54+
f.write("")
5355
policy_args = argparse.Namespace(
5456
database=str(db_file),
5557
show_prelude=False,

0 commit comments

Comments
 (0)