Add datadog certifier #2366
Add datadog certifier #2366
Conversation
Signed-off-by: robert-cronin <[email protected]>
|
As a general comment, I wonder if we want to call it something more specific than "DataDog"? "DataDog Malicious Packages DataSet" is unwieldy, but I'm concerned that there might be some future thing that pulls from DataDog proper and the name is already taken. I don't have any great ideas and this may not be a concern worth worrying about right now, but I wanted to raise it. |
| // if no versions specified in dataset, skip | ||
| if len(maliciousVersions) == 0 { | ||
| // package known but no malicious versions listed? | ||
| continue | ||
| } | ||
|
|
||
| // certify only if the package has a specified version and that exact version is known malicious | ||
| if pkgInput.Version == nil { | ||
| logger.Debugf("Package %s has no version specified, skipping...", purl) | ||
| continue | ||
| } |
There was a problem hiding this comment.
Am I reading it correctly that we'll ignore things like "aiohtttps" (in PyPI) because it applies to all versions?
There was a problem hiding this comment.
I am not sure, I initially thought that an empty malicious version list meant no malicious versions found and thats what the code currently does, but is it instead the case that an empty list means all versions are known malicious? I couldn't find anything in the datadog malicious dataset repo to suggest this.
There was a problem hiding this comment.
I believe the empty list means all versions are known malicious. For example "aiohtttps" is a typosquat of the "aiohttps" (notice the third 't'). I opened DataDog/malicious-software-packages-dataset#135 to request clarification, but I'm confident in my interpretation.
yeah, that is a solid point, if DataDog eventually spin out other datasets, I can see how that might cause some confusion. The data itself mostly comes from GuardDog but I think not exclusively. Maybe we can go with something like |
Description of the PR
Fixes #2345
I am not sure if there is a need for a parser or attestation since were just ingesting CertifyBad for a particular pURL, but if there is a need to represent the source information in a predicate, I'd be happy to try and figure out how to add that in.
PR Checklist
-sflag togit commit.make generatehas been runmake generatehas been runmake generatehas been runcollectsubprotobuf has been changed,make protohas been run