Hello all,
Most of the Rules implemented in ComplianceAsCode/content
<
https://github.com/ComplianceAsCode/content> (if not all of them) have
been focused on checking and remediating a specific configuration.
Typically configurations that are easy to automate.
For example, ensuring that packages installed have the signature verified
is implemented by a rule checking that the repo files have "gpgcheck = 1".
But there are cases where automation is not reasonably achievable, they
would require hard coding parameters or an extensive tailoring harness for
the rule.
For example, how to ensure that configured repositories are the ones
officially supported by the distro.
In these cases the check needs to be done by some other process, maybe
manually checking the repositories enabled, or some administrative process
guarantees it.
I don't know details of the auditory nor how these non-automatable
requirements are handled.
So I wonder if an Informational Rule that would collect the data for manual
analysis would be of help.
Following the examples, this informational rule would collect the list of
repositories enabled, and present it / aggregate it somehow.
Regards,
--
Watson Sato
Software Engineer
Red Hat EMEA <
https://www.redhat.com>
<
https://www.redhat.com>