Attestation is redundantly downloaded into temporary files
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 210
- Forks
- 36
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 2
Description
As part of the analysis process regarding attestation files, data received from the various possible sources is stored into a temporary file before being analysed. This functionality was originally created for users passing their own attestation files to Macaron at runtime, but has been reused in cases where it is not the ideal solution. Instead, attestation files that are downloaded from remote sources should be analysed while still in memory. Storage of the provenance data is already handled by the database as appropriate.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the analysis process and the handling of data from the various possible sources. Compare remote-source downloads with the runtime path for user-provided attestation files, then inspect how provenance is stored in the database. Done means remotely downloaded attestations are analysed in memory without redundant temporary files, while user-provided files still work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100