Built-in Policy Support

[abhisek]

vet has been very opinionated to not be opinionated in its decision of risk so far. While it does a lot of things such as scanning source code, identify package dependencies, their usage in code, malicious packages etc. there is no in built (hardcoded) opinion on what is a threat and when to fail a scan. This opinion comes from policies written as Common Expressions Language (CEL).

Users must write and feed policies (as code) to vet to be able to use it as guardrails. Overtime we have received requests to support common policies out of box, such as opinionated defaults.

We can consider having out of box policies that can be referenced instead of a custom policy file such as vet scan --policy builtin:critical-set. In this example, vet will leverage an internally defined policy named critical-set instead of trying to look-up from file.

Whats your thought and what is the desired user experience?

[KunalSin9h]

I think we can have something like

vet scan --use-default-policy

[abhisek]

vet scan --use-default-policy

What if we need to ship multiple policies? The problem with default policy is, its very hard to get right.

[KunalSin9h]

How about we have a centralized report (frontend UI) of public or community maintained policy. And i can use then or add my own.

vet scan --use-remote-policy @myorg/policy

We can provide some polices from our side as well

vet scan --use-remote-policy @safedep/default