🐛 Find variant checks by parent MRN #1408
Conversation
Compliance only knows about parent MRNs and not variant MRNs. To allow a mapping from compliance control to executed check, we need to store the check with it's parent MRN. Signed-off-by: Christian Zunker <christian@mondoo.com>
czunker
force-pushed
the
czunker/compliance2variant_checks
branch
from
b808ebe
to
92be54e
Compare
Signed-off-by: Christian Zunker <christian@mondoo.com>
czunker
force-pushed
the
czunker/compliance2variant_checks
branch
from
6180370
to
9ec2c19
Compare
Signed-off-by: Christian Zunker <christian@mondoo.com>
policy/resolver.go
Outdated
| @@ -657,8 +662,15 @@ func (s *LocalServices) tryResolve(ctx context.Context, bundleMrn string, assetF | |||
| rj.RefreshChecksum() | |||
| } | |||
|
|
|||
| // resolvedPolicyExecutionChecksum is the GraphExceutionChecksum of the policy and the framework | |||
There was a problem hiding this comment.
This doesn't feel right. There is a function called BundleExecutionChecksum. I think this manipulation needs to be done there. The graph execution checksum is passed into this function so we can see if we have something for it or it needs to be recomputed. To me, that means all graph execution checksums need to be calculated the same way
There was a problem hiding this comment.
BundleExecutionChecksum is called on line L484. But it does not know about reporting jobs or any other job.
Everything about jobs is kept out of any checksum up to this point. Even the checksums of the reporting jobs get refreshed after the jobs are included in a checksum refresh. L661-L663 vs. L658.
The reporting jobs' checksums are included in refreshChecksums on L710, but at this point they are empty.
I don't know whether this is a bug or intent.
There was a problem hiding this comment.
As just discussed, I moved this into the BundleExecutionChecksum:
https://github.com/mondoohq/cnspec/pull/1408/files#diff-01d77c6835a56d0f0539b547e1b48fe04335555a2e6809f62ad629dff934bb21R102-R106
Signed-off-by: Christian Zunker <christian@mondoo.com>
Signed-off-by: Christian Zunker <christian@mondoo.com>
| @@ -234,9 +234,9 @@ policies: | |||
| require.NoError(t, err) | |||
| require.NotNil(t, rp) | |||
| require.Len(t, rp.CollectorJob.ReportingJobs, 5) | |||
| ignoreJob := rp.CollectorJob.ReportingJobs["8Sis0SvMbtI="] | |||
| ignoreJob := rp.CollectorJob.ReportingJobs["q7gxFtwx4zg="] | |||
There was a problem hiding this comment.
These UUIDs changed, because the new BundleExecutionChecksum is included in the UUIDs: https://github.com/mondoohq/cnspec/blob/main/policy/resolver.go#L536
Compliance only knows about parent MRNs and not variant MRNs. To allow a mapping from compliance control to executed check, we need to store the check with it's parent MRN.