Class: Necropsy::Guardrail::Baseline

Inherits:
Object
  • Object
show all
Defined in:
lib/necropsy/guardrail/baseline.rb

Defined Under Namespace

Classes: Comparison

Constant Summary collapse

SCHEMA_VERSION = 
2
MIGRATION_SCHEMA_VERSION = 
1
CLASSIFICATIONS = 
%w[unreachable unused blocked test_only_reachable].freeze

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(path:, findings:, schema_version: 1) ⇒ Baseline

Returns a new instance of Baseline.

Raises:



97
98
99
100
101
102
103
104
105
106
107
108
109
 
# File 'lib/necropsy/guardrail/baseline.rb', line 97

def initialize(path:, findings:, schema_version: 1)
  @path = path
  @schema_version = normalize_schema_version(schema_version)
  raise Error, "Unsupported baseline schema version: #{@schema_version}" unless [1, SCHEMA_VERSION].include?(@schema_version)

  @findings = findings.map do |finding|
    raise Error, 'Baseline findings must be mappings' unless finding.is_a?(Hash)

    finding.transform_keys(&:to_s).tap { |entry| validate_entry!(entry) }
  end
  validate_duplicate_identities!
  @fingerprints = @findings.filter_map { |finding| finding['fingerprint'] }.to_set
end

Instance Attribute Details

#fingerprints ⇒ Object (readonly)

Returns the value of attribute fingerprints.



20
21
22
 
# File 'lib/necropsy/guardrail/baseline.rb', line 20

def fingerprints
  @fingerprints
end

#path ⇒ Object (readonly)

Returns the value of attribute path.



20
21
22
 
# File 'lib/necropsy/guardrail/baseline.rb', line 20

def path
  @path
end

#schema_version ⇒ Object (readonly)

Returns the value of attribute schema_version.



20
21
22
 
# File 'lib/necropsy/guardrail/baseline.rb', line 20

def schema_version
  @schema_version
end

Class Method Details

.load(path) ⇒ Object

Raises:



22
23
24
25
26
27
28
29
30
31
32
33
34
 
# File 'lib/necropsy/guardrail/baseline.rb', line 22

def self.load(path)
  return new(path: path, findings: []) unless File.exist?(path)

  payload = YAML.safe_load_file(path, aliases: false)
  payload = {} if payload.nil?
  raise Error, 'Baseline must contain a YAML mapping' unless payload.is_a?(Hash)

  schema_version = schema_version_from(payload)
  findings = payload.fetch('findings', [])
  raise Error, 'Baseline findings must be an array' unless findings.is_a?(Array)

  new(path: path, findings: findings, schema_version: schema_version)
end

.write(report, path:, clock: Clock.new) ⇒ Object 



57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
 
# File 'lib/necropsy/guardrail/baseline.rb', line 57

def self.write(report, path:, clock: Clock.new)
  findings = report.actionable_candidates(min_confidence: :low).map do |finding|
    {
      'fingerprint' => finding.physical_fingerprint,
      'logical_fingerprint' => finding.logical_fingerprint,
      'classification' => finding.classification.to_s,
      'confidence' => finding.confidence.to_s,
      'node_id' => finding.node.id,
      'symbol_id' => finding.node.symbol_id,
      'definition_id' => finding.node.definition_id,
      'body_digest' => finding.node.body_digest,
      'file' => finding.node.file,
      'line' => finding.node.line
    }
  end
  payload = {
    'schema_version' => SCHEMA_VERSION,
    'version' => SCHEMA_VERSION,
    'identity' => 'physical_definition',
    'generated_at' => clock.time.iso8601,
    'findings' => findings
  }
  atomic_write(path, payload.to_yaml)
end

Instance Method Details

#compare(findings, migration: false) ⇒ Object 



116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
 
# File 'lib/necropsy/guardrail/baseline.rb', line 116

def compare(findings, migration: false)
  current = findings.sort_by { |finding| [finding.node.file, finding.node.line, finding.node.definition_id] }
  current_index = build_current_index(current)
  assignments = {}
  assignment_indexes = {}
  ambiguities = []

  @findings.each_with_index do |entry, index|
    resolution = resolve_entry(entry, current_index, migration: migration)
    if resolution[:review_required]
      ambiguities << ambiguity(entry, index, resolution, assignment_indexes)
      next
    end
    next if resolution[:candidates].empty?

    candidate = resolution[:candidates].first
    candidate_key = candidate&.physical_fingerprint
    if resolution[:candidates].one? && !assignment_indexes.key?(candidate_key)
      assignments[index] = candidate
      assignment_indexes[candidate_key] = index
    else
      ambiguities << ambiguity(entry, index, resolution, assignment_indexes)
    end
  end

  matched = assignments.values.uniq
  Comparison.new(
    matched_findings: matched,
    new_findings: current - matched,
    ambiguities: ambiguities,
    review_report: migration_review_report(ambiguities)
  )
end

#count_at_least(confidence) ⇒ Object 



154
155
156
157
158
159
160
 
# File 'lib/necropsy/guardrail/baseline.rb', line 154

def count_at_least(confidence)
  threshold = CONFIDENCE_LEVELS.fetch(confidence)
  @findings.count do |finding|
    level = finding['confidence']&.to_sym
    level && CONFIDENCE_LEVELS.fetch(level, -1) >= threshold
  end
end

#include?(finding) ⇒ Boolean

Returns:

  • (Boolean) 


111
112
113
114
 
# File 'lib/necropsy/guardrail/baseline.rb', line 111

def include?(finding)
  fingerprint = schema_version == SCHEMA_VERSION ? finding.physical_fingerprint : finding.logical_fingerprint
  fingerprints.include?(fingerprint)
end

#migrate(findings) ⇒ Object 



150
151
152
 
# File 'lib/necropsy/guardrail/baseline.rb', line 150

def migrate(findings)
  compare(findings, migration: true)
end