aucolalecse - normalizations broken after upgrade to yaml.v2

[andrewkroh]

In #156, the project migrated from gopkg.in/yaml.v2 to yaml.v3. None of the tests detected a failure, but the unmarshaling of normalizations.yaml was broken. The test below detects the change.

The reason appears to be twofold:

1. The Unmarshaler interface signature changed. https://pkg.go.dev/gopkg.in/yaml.v3#Unmarshaler
2. YAML anchors no longer deep-merge.

diff --git a/aucoalesce/normalize_test.go b/aucoalesce/normalize_test.go
index 478a01f..6d86358 100644
--- a/aucoalesce/normalize_test.go
+++ b/aucoalesce/normalize_test.go
@@ -18,7 +18,6 @@
 package aucoalesce
 
 import (
-	"io/ioutil"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -31,14 +30,24 @@ func TestNormInit(t *testing.T) {
 }
 
 func TestLoadNormalizationConfig(t *testing.T) {
-	b, err := ioutil.ReadFile("normalizations.yaml")
+	_, recordTypes, err := LoadNormalizationConfig(normalizationDataYAML)
 	if err != nil {
 		t.Fatal(err)
 	}
 
-	if _, _, err := LoadNormalizationConfig(b); err != nil {
-		t.Fatal(err)
+	if len(recordTypes["USER_ROLE_CHANGE"]) != 1 {
+		t.Fatal("expected single normalization")
 	}
+	n := recordTypes["USER_ROLE_CHANGE"][0]
+
+	assert.Equal(t, n.Subject.PrimaryFieldName.Values, []string{"auid"})
+	assert.Equal(t, n.Subject.SecondaryFieldName.Values, []string{"acct", "id", "uid"})
+
+	assert.Equal(t, n.Object.PrimaryFieldName.Values, []string{"selected-context"})
+	assert.Equal(t, n.Object.SecondaryFieldName.Values, []string{"addr", "hostname"})
+	assert.Equal(t, n.Object.What, "user-session")
+
+	assert.Equal(t, n.How.Values, []string{"exe", "terminal"})
 }
 
 var stringsYAML = `

[andrewkroh]

Fixed by #170.