Skip to content

Commit

Permalink
Update README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
lcopeland authored Nov 7, 2024
1 parent 36fb20c commit f1acc4c
Showing 1 changed file with 3 additions and 10 deletions.
13 changes: 3 additions & 10 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,17 +3,15 @@ A tool to pull all the `known_package` standard violations for a catalog and the

### What is this repository for and when do I need to use this? ###

You don't need to unless it solves a workflow challenge involving the `known_packages` standard. This scrpt is intended to be used as an example of how a frequently requested product feature can be handled using the API. The `known_packages` standard will trigger for all internal packages that a company uses, essentially any package that is unknown to the upstream repositories. This can create a lot of noise for companies that use a lot of internal packages and the request to be able to package name match via regex has been a common request for a few years. This script automates matching packages that have triggered the known_package standard in a catalog, creates an override for the packages that match and then writes the misses to a .csv report for further investigation. If you're unfamiliar with Regex, try asking Jeeves.
You don't need to unless it solves a workflow challenge involving the `known_packages` standard. The `known_packages` standard will trigger for all internal packages that a company uses, essentially any package that is unknown to the upstream repositories. This can create a lot of noise for companies that use a lot of internal packages. This script automates matching packages that have triggered the known_package standard in a catalog, creates an override for the packages that match and then writes the misses to a .csv report for further investigation.

**Note:** Creating overrides in an automated fasion should be done with care. Start with patterns that you're confident with, review the packages that are misses and also audit the override export report to ensure that a packages override isn't being created for a truly unknown package.

**Note:** This iteration of regerride creates a package override without specifying specific releases and results in a wildcard being set for the release. This approach has drawnbacks from a security perspective. I'm evaluating adding a package lookup to pull the version information and making the overrides more granular.
**Note:** This iteration of regerride creates a package override without specifying specific releases and results in a wildcard being set for the release. This approach has drawnbacks from a security perspective.

### How do I get set up? ###

* Ensure you have python 3.9 or higher installed
* I recommend testing using a python virtual environment

* Ensure you have python 3.9 or higher installed.

### Configure Environment Variables and add patterns to package_patterns.txt ###

Expand All @@ -25,8 +23,3 @@ There are five variables that need to be set in order for the script to execute
* OVERRIDE_STATUS - an override can have a status of `approved` or `denied`

The regex patterns are added to a control file calls `package_patterns.txt`. Add one or more package name patterns for the script to look for matches.

### Who do I talk to if I have questions? ###

* Larry Copeland
* [Team Customer Success](https://tidelift.slack.com/archives/C01EN3MKKBQ)

0 comments on commit f1acc4c

Please sign in to comment.