Hello all,

Most of the Rules implemented in ComplianceAsCode/content (if not all of them) have been focused on checking and remediating a specific configuration. Typically configurations that are easy to automate.
For example, ensuring that packages installed have the signature verified is implemented by a rule checking  that the repo files have "gpgcheck = 1".

But there are cases where automation is not reasonably achievable, they would require hard coding parameters or an extensive tailoring harness for the rule.
For example, how to ensure that configured repositories are the ones officially supported by the distro.
In these cases the check needs to be done by some other process, maybe manually checking the repositories enabled, or some administrative process guarantees it.

I don't know details of the auditory nor how these non-automatable requirements are handled.
So I wonder if an Informational Rule that would collect the data for manual analysis would be of help.
Following the examples, this informational rule would collect the list of repositories enabled, and present it / aggregate it somehow.

Regards,
--

Watson Sato

Software Engineer

Red Hat EMEA