crashappsec / crashappsec/chalk

[Objective] More Metadata Collection

Open
#16 0 comments 0 reactions 0 assignees View on GitHub
objective
Dominant language
Nim
Stars
436
Forks
25
PR merge metrics
No merged PRs in 30d

Description

With our focus on trying to tie together data through an app's lifecycle, we certainly want to be on a never-ending treadmill to help collect data from important technologies. And, we want to make it easy to people to do the integrations they need for their own uses (and ideally contribute them back to the world).

In production, for instance, while we do have a reasonable start for local collection and AWS metadata collection, but there's more to do to there.

And, there is plenty we aren't doing at all, yet, such as cloud metadata for the other major public clouds. We don't do integration with k8s or cloud provider container runtimes.

Not to mention, we haven't paid enough attention to what other tools we should be integrating with in CI/CD for information. For instance, deep integrations w/ package management ecosystems seems likely to lead to some large benefits for users on a lot of fronts.

Additionally, we need to do a little more to facilitate people adding to our data collection facilities if they don't know Nim-- the API is designed so that you could link in plugins, but we would need a little bit more plumbing to actually leverage external plugins.

Additionally, there is metadata people would like to use Chalk to orchestrate collecting during CI/CD that we wouldn't support today, because it would slow build times too much. We should consider a general ability to support orchestration to collect out-of-band collection of metadata.

For instance, with a lot of security analysis tools some companies want to run on every build, like static analysis, we might want to support this via Chalk to facilitate the goal of tying everything together in as simple a way as possible.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reviewing the existing local and AWS metadata collection, then examine how the API could support external plugins and out-of-band CI/CD orchestration. The issue names no files or tests, and its multiple goals would need to be narrowed into a specific integration before implementation can begin.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes, nim
Domain
ci-cd, cloud, devops, tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
15/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.