mitre / inspecjs

MIGRATED: A Typescript Library for working with InSpec data

MIGRATED

THIS REPOSITORY OF INSPECJS IS NO LONGER IN USE. INSPECJS HAS BEEN MIGRATED INTO A MONOREPO WITH HEIMDALL. THIS CAN BE FOUND HERE: https://github.com/mitre/heimdall2/tree/master/libs/inspecjs IMPORTANT: InspecJS is still independently published to NPM; however, this occurs upon each release of Heimdall

To update schemas install quicktype with npm install -g quicktype and use npm run gen-types

Local Testing

In order to test your inspecjs changes in another application (for example Heimdall), perform the following steps:

1. Make your changes
2. Run npm build
3. In the repository you would like to test your inspecjs changes against, run npm link path/to/inspecjs
4. Any subsequent changes to inspecjs will require an npm build in inspecjs, but not a re-link

Creating a Release

Note: This action requires appropriate privileges on the repository to perform.

1. Ensure you have pulled the latest copy of the code locally onto your machine.
2. Using npm version, run npm version <explicit version> or alternatively use one of the appropriate npm keywords: 'major', 'minor', 'patch', 'premajor', 'preminor', 'prepatch', or 'prerelease' to bump the version. This will push a new tag to Github.
3. Navigate to Releases on Github and edit the release notes that Release Drafter has created for you, and assign them to the tag that you just pushed.

NOTICE

This software is currently in EARLY ALPHA DEVELOPMENT. No guarantees whatsoever are made to its safety, reliability, or accuracy with regards to the parsing and analyzing of inspec files. Do NOT use in production, and do NOT expect current API to remain stable. Use at your own risk.

NOTICE

© 2018 The MITRE Corporation.

Approved for Public Release; Distribution Unlimited. Case Number 18-3678.

NOTICE

MITRE hereby grants express written permission to use, reproduce, distribute, modify, and otherwise leverage this software to the extent permitted by the licensed terms provided in the LICENSE.md file included with this project.

NOTICE

This software was produced for the U. S. Government under Contract Number HHSM-500-2012-00008I, and is subject to Federal Acquisition Regulation Clause 52.227-14, Rights in Data-General.

No other use other than that granted to the U. S. Government, or to those acting on behalf of the U. S. Government under that Clause is authorized without the express written permission of The MITRE Corporation.

For further information, please contact The MITRE Corporation, Contracts Management Office, 7515 Colshire Drive, McLean, VA 22102-7539, [phone].

inspecjs's Issues

Update the `package.json` with needed information fields for publication

• https://docs.npmjs.com/files/package.json
• https://hackernoon.com/how-to-publish-your-package-on-npm-7fc1f5aae600
• https://areknawo.com/whats-what-package-json-cheatsheet/

There are some missing fields in the pacakge.json which we should add for formality.

• name: inspecjs
• version: <$version>
• description: 'A javascript library for working with InSpec data and MITREs Heimdall Data Format'
• author: The MITRE Corporation
• license: Apache-2.0
• repository:
  • url: https://github.com/mitre/inspecjs
  • type: git

  "name": "heimdall-lite",
  "version": "2.0.5",
  "description": "Heimdall Lite 2.0 is a JavaScript based security results viewer and review tool supporting multiple security results formats, such as: InSpec, SonarQube, OWASP-Zap and Fortify which you can load locally, from S3 and other data sources.",
  "private": true, <== not sure if this should be true or false
  "repository": {
    "type": "git",
    "url": "https://github.com/mitre/heimdall-lite"
  },
  "license": "Apache-2.0",
  "branch": "/blob/master/",
  "readme": "README.md",
  "changelog": "CHANGELOG.md",
  "issues": "/issues/new/choose",
  "scripts": {
    "serve": "vue-cli-service serve",
    "build": "vue-cli-service build",
    "lint": "vue-cli-service lint",
    "test:unit": "vue-cli-service test:unit"
  },

Review the `package.json` to ensure we are useing Deps and DevDeps correctly

https://hackernoon.com/how-to-publish-your-package-on-npm-7fc1f5aae600
https://areknawo.com/whats-what-package-json-cheatsheet/

update README with standard verbiage

Create a github project to gather the goals of the first release

Error doesn't make sense to the user when uploading heimdall_tools jsons

https://github.com/mitre/inspecjs/blob/master/src/fileparse.ts
"Unable to convert inspec json output. Please verify it's from an up-to-date version of the program!"

Error doesn't make sense to the user when uploading heimdall_tools jsons

add npm release process

Formalize PR and release process

This should probably have been done a while ago considering my effective departure from the project, but here goes.

Currently, the process is as follows.

• I create a branch, create necessary changes
• I npm build and npm link, then test in heimdall lite.
• If satisfied with the results, i merge the branch into master, increment the version, and git push / git publish.

Realistically, the following changes should be made:

• The merge process should be replaced with a formalized PR process
• The testing in heimdal lite should be replaced with a more automated jest suite.
• The release process should be made into a script (or perhaps github action) that creates a tagged release, updates a changelog, etc.

As far as specifics, that's really for others to decide.

Add node-semver to the project

• https://github.com/npm/node-semver

We should add this to the build, package and release process.

Standardize the README