crashappsec / crashappsec/chalk
[Objective] More Metadata Collection
- Dominant language
- Nim
- Stars
- 436
- Forks
- 25
- PR merge metrics
- No merged PRs in 30d
Description
With our focus on trying to tie together data through an app's lifecycle, we certainly want to be on a never-ending treadmill to help collect data from important technologies. And, we want to make it easy to people to do the integrations they need for their own uses (and ideally contribute them back to the world).
In production, for instance, while we do have a reasonable start for local collection and AWS metadata collection, but there's more to do to there.
And, there is plenty we aren't doing at all, yet, such as cloud metadata for the other major public clouds. We don't do integration with k8s or cloud provider container runtimes.
Not to mention, we haven't paid enough attention to what other tools we should be integrating with in CI/CD for information. For instance, deep integrations w/ package management ecosystems seems likely to lead to some large benefits for users on a lot of fronts.
Additionally, we need to do a little more to facilitate people adding to our data collection facilities if they don't know Nim-- the API is designed so that you could link in plugins, but we would need a little bit more plumbing to actually leverage external plugins.
Additionally, there is metadata people would like to use Chalk to orchestrate collecting during CI/CD that we wouldn't support today, because it would slow build times too much. We should consider a general ability to support orchestration to collect out-of-band collection of metadata.
For instance, with a lot of security analysis tools some companies want to run on every build, like static analysis, we might want to support this via Chalk to facilitate the goal of tying everything together in as simple a way as possible.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reviewing the existing local and AWS metadata collection, then examine how the API could support external plugins and out-of-band CI/CD orchestration. The issue names no files or tests, and its multiple goals would need to be narrowed into a specific integration before implementation can begin.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, kubernetes, nim
- Domain
- ci-cd, cloud, devops, tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 15/100