Simple decoupled file based policy engine #27

johnandersen777 · 2023-03-31T04:36:50Z

Simple insert policy based engine based on presence of operation.policy.{insert,denied,failed} files. Currently only for use with use_lro=True. This is a simple way to enable evaluation of claims prior to submission by arbitrary policy engines which watch the workspace (fanotify, inotify, etc.).

Jump to viewing docs

References
- Associated mailing list thread
- Use Case: Attestations of alignment to S2C2F and org overlays ietf-scitt/use-cases#18
  - Recent discussion has revealed most of this use case will be focused on the policy / gatekeeper component and federation components of SCITT.
TODO
- Unittests
- Docs
  - asciicast
- failure -> failed typos
- error.detail
  - Would be great if detail was optionally an object. A string is of limited usefulness, the same issue was had with the SPDX 2.X series with regards to description fields.
    - Consistency fixes ietf-wg-scitt/draft-ietf-scitt-architecture#60 (comment)
    - using media types for errors ietf-wg-scitt/draft-ietf-scitt-architecture#62
  - https://mailarchive.ietf.org/arch/msg/scitt/c0t5zLUJtCQ9_Jrf7mykWXSIn94/
    - Future
      - Updating operationId to operationUrl is out of scope of this pull request.
Future
- Workflow based policy execution within documentation rather than simple bash example

…tion: Initial sketch Related: scitt-community/scitt-api-emulator#27 Alice Engineering Comms: 2022-10-17 Engineering Logs: #1406

docs/registration_policies.md

scitt_emulator/scitt.py

docs/registration_policies.md

OR13 · 2023-08-24T14:22:07Z

Conflicts exist now, I will merge 1 week after they are resolved unless there are changes requested.

johnandersen777 · 2023-08-25T20:28:51Z

Fantastic, thank you! Will resolve today

…

On Thu, Aug 24, 2023 at 07:22 Orie Steele ***@***.***> wrote: Conflicts exist now, I will merge 1 week after they are resolved unless there are changes requested. — Reply to this email directly, view it on GitHub <#27 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABNMXYKJT6XME6UFHTPHXS3XW5PRXANCNFSM6AAAAAAWOESPOU> . You are receiving this because you authored the thread.Message ID: ***@***.***>

SteveLasker

LGTM

Signed-off-by: John Andersen <johnandersenpdx@gmail.com>

…entation Signed-off-by: John Andersen <johnandersenpdx@gmail.com>

@darrelmiller

- Updated simple file based policy engine to align with @darrelmiller review of SCITT architecture documentation - His full review can be found at https://mailarchive.ietf.org/arch/msg/scitt/c0t5zLUJtCQ9_Jrf7mykWXSIn94/ - Do not attempt to load policy failed/denied JSON information if present triggering file empty Signed-off-by: John Andersen <john.s.andersen@intel.com>

Signed-off-by: John Andersen <johnandersenpdx@gmail.com>

… load Signed-off-by: John Andersen <johnandersenpdx@gmail.com>

Signed-off-by: John Andersen <johnandersenpdx@gmail.com>

…policy from service parameters insertPolicy Signed-off-by: John Andersen <johnandersenpdx@gmail.com>

Signed-off-by: John Andersen <johnandersenpdx@gmail.com>

@OR13

…st per @OR13 review Related: #1 (review) Signed-off-by: John Andersen <johnandersenpdx@gmail.com>

…rrantly encode jsonschema validator output into detail string Signed-off-by: John Andersen <johnandersenpdx@gmail.com>

johnandersen777 · 2023-08-26T00:54:39Z

Thanks all! I rebased in main. Looks like theres an error in the conda tests will fix asap

SteveLasker

LGTM

To ensure scitt_emulator module can be found Signed-off-by: John Andersen <johnandersenpdx@gmail.com>

johnandersen777 · 2023-08-30T00:24:21Z

The conda CI tests should be fixed now, for some reason it couldn't find the scitt_emulator module when executing the subprocess. Solved by setting PYTHONPATH to ensure to module is importable

johnandersen777 force-pushed the policy_engine branch 8 times, most recently from 3cbfc29 to 7faa017 Compare March 31, 2023 07:25

johnandersen777 marked this pull request as ready for review March 31, 2023 07:26

johnandersen777 force-pushed the policy_engine branch 4 times, most recently from 7e15387 to 542fea4 Compare March 31, 2023 08:03

johnandersen777 marked this pull request as draft March 31, 2023 08:06

johnandersen777 force-pushed the policy_engine branch 2 times, most recently from 8ed6f93 to 2787820 Compare March 31, 2023 10:21

johnandersen777 marked this pull request as ready for review March 31, 2023 10:21

johnandersen777 force-pushed the policy_engine branch 2 times, most recently from a72cdef to adea2b1 Compare April 2, 2023 14:56