Skip to content

Releases: mitre/hipcheck

3.7.0 - 2024-10-10

10 Oct 17:09
@github-actions github-actions
hipcheck-v3.7.0
2e38e5b
Compare
Choose a tag to compare
3.7.0 - 2024-10-10 Latest
Latest

Release Notes

3.7.0 - 2024-10-10

UPCOMING: We Will No Longer Publish to Crates.io starting with 3.8.0

We recently merged RFD #7, "Simplified Release Procedures",
which explains that starting with version 3.8.0 (the next minor version), we'll
no longer be publishing Hipcheck itself to Crates.io. The reasons for this are
explained in the RFD, but essentially the need to publish to Crates.io has been
placing constraints on our ability to evolve Hipcheck in ways that are becoming
untenable.

Starting in 3.8.0, users will no longer be able to use cargo install or
cargo binstall to get the latest versions of Hipcheck.

Introduction of a Plugin SDK for Rust

With 3.7.0, we're introducing a new Plugin SDK for Rust, with the hipcheck-sdk
crate! This crate is intended to make it easier to write Hipcheck plugins in
Rust by handling the generation of proper gRPC handling code and of Hipcheck's
"query protocol," which coordinates the interaction between hc and each
plugin.

Improvements to Policy Expressions

Policy expressions are how Hipcheck users turn plugin output, which is JSON
data, into "pass/fail" results which can be used for risk scoring. In this
release, we added support for datetime and time span in policy expressions, and
improved the handling of JSON pointers for destructuring data from plugin
output. We also fixed some bugs associated with the handling of floating point
data.

  • add placeholder for JSON pointer late-binding in policy expr by @j-lanson in #399
  • Lex JSON Pointers in Policy Expressions by @cstepanian in #403
  • Allow any Expr at the top level of a Policy Expression by @cstepanian in #405
  • Parse JSON Pointers as Policy Expressions by @cstepanian in #406
  • Adds datetime and span primitives to the policy expression syntax by @mchernicoff in #419
  • Adds operations for datetime and span policy expression primitives by @mchernicoff in #441
  • policy expr type errors due to ".0" floating points in JSON being treated as ints by @j-lanson in #451

Improved Support for Other Architecture

With the plugin system, Hipcheck needs to match the architecture you're running
on with the architectures supported by plugins, to ensure that the plugins it
downloads can run on your machine. Previously, this involved some compile-time
checks which meant Hipcheck would fail to compile on architectures which were
not explicitly supported. These changes loosen those constraints to instead
permit the use of an --arch flag to specify the target triple to use.

  • add --arch flag to hc check subcommand to allow architecture detection override by @j-lanson in #433
  • allow use of unknown arches through commandline by @j-lanson in #434

Beginning to Split Existing Data Sources and Analyses into Plugins

With the introduction of the plugin system, we left our existing data sources
and analyses as built-ins. They pretend to be plugins in the interface exposed
to users, but are still built into hc itself. We've now started the process
of extracting these out into their own plugins. In the future we'd like to not
have any built in data sources or analyses, and to instead let hc be the
coordination and execution system which delegates the actual data collection
and analysis to plugins exclusively.

  • created plugin version of github api queries by @j-lanson in #475

Code Cleanup

The changes to introduce the plugin system left a lot of cruft on the table to
be removed, which we're now working on doing.

Bumping Dependency Versions

Full Changelog: hipcheck-v3.6.3...hipcheck-v3.7.0

Install hipcheck 3.7.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/mitre/hipcheck/releases/download/hipcheck-v3.7.0/hipcheck-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy ByPass -c "irm https://github.com/mitre/hipcheck/releases/download/hipcheck-v3.7.0/hipcheck-installer.ps1 | iex"

Download hipcheck 3.7.0

File Platform Checksum
hipcheck-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
hipcheck-x86_64-apple-darwin.tar.xz Intel macOS checksum
[hipcheck-x86_64-pc-windows-msvc.zip](https://github.com/mitre/hipc...
Read more
Assets 19

3.6.3 - 2024-09-10

10 Sep 19:54
@github-actions github-actions
hipcheck-v3.6.3
f52beea
Compare
Choose a tag to compare
3.6.3 - 2024-09-10

Release Notes

This release includes:

  • A new divz function for policy expressions, which implements with
    division and returns 0 when dividing by 0.
  • Two hc bugfixes:
    • Removed a possible panic when failing to evaluate policy expressions
    • Fixed broken policy expression policies when converting an older-style
      config file to the new "policy file" structure in memory
  • Two automation bugfixes:
    • Removal of a release deployment workaround
    • Fixing our broken Containerfile
  • Removal of unused code and files for "scripts" previously used for
    pull request analysis. We'd removed the code to support pull request analysis
    a while ago, but hadn't removed all of it. This completes that removal,
    and also means we no longer need to distribute a "scripts" folder.

Full Changelog: hipcheck-v3.6.2...hipcheck-v3.6.3

Install hipcheck 3.6.3

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/mitre/hipcheck/releases/download/hipcheck-v3.6.3/hipcheck-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy ByPass -c "irm https://github.com/mitre/hipcheck/releases/download/hipcheck-v3.6.3/hipcheck-installer.ps1 | iex"

Download hipcheck 3.6.3

File Platform Checksum
hipcheck-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
hipcheck-x86_64-apple-darwin.tar.xz Intel macOS checksum
hipcheck-x86_64-pc-windows-msvc.zip x64 Windows checksum
hipcheck-x86_64-unknown-linux-gnu.tar.xz x64 Linux checksum
Assets 19
Loading

3.6.2 - 2024-09-10

10 Sep 00:55
@github-actions github-actions
hipcheck-v3.6.2
8b172b1
Compare
Choose a tag to compare
3.6.2 - 2024-09-10

Release Notes

This is a small release to fix a bug in the release automation for 3.6.1.
For more information on the key content for this release, check out 3.6.1.

Huge thanks to Ashley and the rest of the Axo team for their quick action
to figure out this bug and get a workaround implemented!

Fixed

New Contributors

Full Changelog: hipcheck-v3.6.1...hipcheck-v3.6.2

Install hipcheck 3.6.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/mitre/hipcheck/releases/download/hipcheck-v3.6.2/hipcheck-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy ByPass -c "irm https://github.com/mitre/hipcheck/releases/download/hipcheck-v3.6.2/hipcheck-installer.ps1 | iex"

Download hipcheck 3.6.2

File Platform Checksum
hipcheck-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
hipcheck-x86_64-apple-darwin.tar.xz Intel macOS checksum
hipcheck-x86_64-pc-windows-msvc.zip x64 Windows checksum
hipcheck-x86_64-unknown-linux-gnu.tar.xz x64 Linux checksum
Assets 19
Loading

3.6.1 - 2024-09-09

10 Sep 00:38
@alilleybrinker alilleybrinker
hipcheck-v3.6.1
820d7e9
Compare
Choose a tag to compare
3.6.1 - 2024-09-09

3.6.1 is a patch release, but it features one exciting new,
still-experimental feature: support for plugins! Previously, if you wanted
to add a new source of data or a new form of analsis to Hipcheck, you needed
to modify Hipcheck itself. This placed some limitations on our ability to grow
Hipcheck, and more importantly it conflicted with a core design philosophy
of Hipcheck: that it should empower uses to express their policies about
using open source software (this is one of our Product Values, as expressed in
RFD #2).

With 3.6.1 users can now define custom plugins to provide new sources of
data and new analyses. There's a lot more for us to do with this, including
a lot of user experience polish, releasing our first SDK to make developing
plugins easier, creating and publishing documentation on how to create,
distribute, and use plugins, and more! For now though, this launch is our
official starting point where users can create, distribute, and run plugins.

For more details on the design of the new plugin system, check out
RFD #4. If you have questions
on how to work with plugins, you can always ask us in our GitHub Discussions
forum!

Completion of the Plugin Minimum Viable Product

Automation Fixes & Improvements

Dependency Version Bumps

Full Changelog: hipcheck-v3.6.0...hipcheck-v3.6.1

Assets 2
Loading

3.6.0 - 2024-09-03

04 Sep 17:27
@alilleybrinker alilleybrinker
hipcheck-v3.6.0
ffc73a6
Compare
Choose a tag to compare
3.6.0 - 2024-09-03

NOTE: No builds for this release due to a build configuration issue. We'll be cutting 3.6.1 soon which will have release artifacts.

This is a relatively small release, as we work on the initial implementation
of our new plugin system as described in RFD #4.

There are two fixes in this release:

Plus lots of work on implementing plugins (not yet ready for use):

Some improvements to the website and to CI testing:

Refactoring of the Hipcheck source code:

Updates to our release infrastructure:

And finally, many dependency version bumps:

New Contributors

Full Changelog: hipcheck-v3.5.0...hipcheck-v3.6.0

Assets 2
Loading

3.5.0 - 2024-08-05

05 Aug 19:10
@github-actions github-actions
hipcheck-v3.5.0
652b4b8
Compare
Choose a tag to compare
3.5.0 - 2024-08-05

Release Notes

Hipcheck 3.5.0 continues our focus on user experience improvements with
three major additions:

  • Improved target selection
  • The hc cache subcommand
  • Better progress reporting

Improved Target Selection

In Hipcheck 3.5.0 we've enhanced the ability to specify your target of
analysis. This is Hipcheck's term for "the thing you want to analyze."
With this new version, you can now provide:

  • Package URLs (pURLs): pURLs are a specification for a unified way of
    referencing packages on a variety of popular package hosts. For example,
    the pURL pkg:npm/foobar@12.3.1 refers to the package foobar version
    12.3.1 on NPM.
  • VCS URLs: VCS URLs come from the Python ecoystem, where they're used
    by PIP to refer to Git repositories with additional metadata embedded in
    the URL. They're also used by the SPDX Software Bill of Materials standard.
    A VCS URL looks like git+ssh://git@git.example.com/MyProject, with the
    VCS being used as a prefix to the rest of the protocol, separated by a +.
  • Git References: References are how Git refers to specific things you
    can checkout in a Git repository, including specific commits, branches,
    and tags. By default, Hipcheck checks out the latest (HEAD) commit of a
    repository, but you can now use the --ref flag to specify a different
    ref to check out.
  • CycloneDX SBOMs: Hipcheck can now accept CycloneDX Software Bills of
    Material in addition to SPDX ones, in either JSON or XML format.

Note that some of the methods above allow embedding some target-type
information directly, in ways that can contradict the --type flag when
running hc check. If the --type flag and the target specifier metadata
ever conflict, Hipcheck will produce an error rather than picking one option
over the other automatically.

The following commits were for this work:

  • remove use of Source, SourceRepo, Remote structs in favor of Target by @j-lanson in #229
  • added types for new target repo spec and resolution by @j-lanson in #210
  • add more robust 'target resolution' systemD by @mchernicoff in #227
  • add --ref support to remaining target seed kinds by @j-lanson in #244
  • CLI can infer target type from target pURL by @mchernicoff in #205
  • CLI can infer target type from target VCS URL by @mchernicoff in #209
  • Hipcheck can process SBOMs using CycloneDX (currently JSON only) standard by @mchernicoff in #237
  • Hipcheck can process SBOMs using CycloneDX XML files by @mchernicoff in #239
  • update remote-repo updating to support git refs by @j-lanson in #240
  • update local-repo copying to support git refs by @j-lanson in #242
  • distinguish TargetSeed and TargetSeedKind to transfer ref info from cli by @j-lanson in #243

hc cache subcommand

We've also added a new subcommand, hc cache, for managing the repository
cache that Hipcheck maintains. When Hipcheck runs, it creates a local clone
of the repository being analyzed (if the repository is already local, Hipcheck
still clones it into the repository cache to avoid mutating the original). Over
time, this repository cache will grow, and some repositories may be quite
large. The new hc cache subcommand lets the user see what's in the cache
with hc cache list, and delete elements in the cache with hc cache delete.

The following commits were for this work:

  • add hc cache subcommand for manually listing/deleting elements of the cache by @j-lanson in #224
  • add commit info to hc cache display and index file by @j-lanson in #245
  • local repos are also cloned to HC_CACHE by @j-lanson in #208
  • shortcut cache entry size calculation with cache index file by @j-lanson in #236

Progress Reporting

Hipcheck now shows a progress bar during execution, especially during
repository cloning, which can be quite slow for larger repositories. This is
intended to make it clearer how Hipcheck's time is being spent, and went it's
continuing to make progress vs. being stuck.

The following commits were for this work:

  • major refactor to enable better control of phases and progress bars by @vcfxb in #198
  • Variety of tweaks to the shell and phase infrastructure by @vcfxb in #213
  • Add progress bars when cloning repos (powered by the git2 crate). Integrate libgit2 trace messages into our logging by @vcfxb in #222

And More...

As always, there are more changes in a single version that can be adequately
described here. View the full changelog to see the rest:

Full Changelog: hipcheck-v3.4.0...hipcheck-v3.5.0

Install hipcheck 3.5.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/mitre/hipcheck/releases/download/hipcheck-v3.5.0/hipcheck-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -c "irm https://github.com/mitre/hipcheck/releases/download/hipcheck-v3.5.0/hipcheck-installer.ps1 | iex"

Download hipcheck 3.5.0

File Platform Checksum
hipcheck-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
hipcheck-x86_64-apple-darwin.tar.xz Intel macOS checksum
hipcheck-x86_64-pc-windows-msvc.zip x64 Windows checksum
hipcheck-x86_64-unknown-linux-gnu.tar.xz x64 Linux checksum
Assets 19
Loading

3.4.0 - 2024-07-04

04 Jul 23:04
@github-actions github-actions
hipcheck-v3.4.0
8818c22
Compare
Choose a tag to compare
3.4.0 - 2024-07-04

Release Notes

Hipcheck 3.4.0 is an exciting release featuring 3 new subcommands!

  • hc setup: When you install the hc binary, whether through an install
    script with a release, with cargo binstall, or by building it yourself,
    you still need to get the configuration and data files Hipcheck requires.
    This new command gets those files for you, so you can start using Hipcheck
    quickly and easily!
  • hc update: This lets Hipcheck update itself to newer versions! Under the
    hood, we're using the self-updater built and provided by cargo-dist, the
    tool we use for cutting new releases with prebuilt binaries. The hc update
    command is a wrapper around that updater. This command does require that
    you use our install script to get the self-updater.
  • hc scoring: This tells you how Hipcheck is scoring results based on your
    current configuration. While you can see the weights for each analysis in
    your configuration file, it can be tedious to do the math yourself to find
    out exactly how much each analysis contributes to the overall score. This
    command does that math for you to make it easier.

Hipcheck also now has an official website!
Feel free to check it out, and let us know if you encounter any issues with it.

Added

  • Add new hc setup command:
  • Add new hc update command:
    • Adds hc update command to run the self-updater (if installed) to automatically bring Hipcheck up to date with a released version. Includes optional flags to update to versions other than the latest by @mchernicoff in #176
  • Add new hc scoring command:

Changed

Fixed

  • Fix broken Docker build:
    • Vendor libgit2 and openssl so that hipcheck builds in containers more consistently by @vcfxb in #177

Removed

  • Remove legacy CLI features that aren't actually implemented or supported:
    • Removes patch type as option for hc check or hc schema, as that was unsupported by @mchernicoff in #153
    • Remove pr analysis and scoring infrastructure by @j-lanson in #158

New Contributors

Full Changelog: hipcheck-v3.3.2...hipcheck-v3.4.0

Install hipcheck 3.4.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/mitre/hipcheck/releases/download/hipcheck-v3.4.0/hipcheck-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -c "irm https://github.com/mitre/hipcheck/releases/download/hipcheck-v3.4.0/hipcheck-installer.ps1 | iex"

Download hipcheck 3.4.0

File Platform Checksum
hipcheck-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
hipcheck-x86_64-apple-darwin.tar.xz Intel macOS checksum
hipcheck-x86_64-pc-windows-msvc.zip x64 Windows checksum
hipcheck-x86_64-unknown-linux-gnu.tar.xz x64 Linux checksum
Assets 19
Loading

v3.3.2

21 Jun 18:12
@github-actions github-actions
hipcheck-v3.3.2
f9ad61c
Compare
Choose a tag to compare
v3.3.2

3.3.2 - 2024-06-21

This patch is intended to workaround a bug in cargo-dist which caused the
publication of 3.3.1 to fail to include all the expected artifacts. They're
working on fixing the bug, but in the short term this is a reasonable
workaround.

Changed

Full Changelog: hipcheck-v3.3.1...hipcheck-v3.3.2

Install hipcheck 3.3.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/mitre/hipcheck/releases/download/hipcheck-v3.3.2/hipcheck-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -c "irm https://github.com/mitre/hipcheck/releases/download/hipcheck-v3.3.2/hipcheck-installer.ps1 | iex"

Download hipcheck 3.3.2

File Platform Checksum
hipcheck-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
hipcheck-x86_64-apple-darwin.tar.xz Intel macOS checksum
hipcheck-x86_64-pc-windows-msvc.zip x64 Windows checksum
hipcheck-x86_64-unknown-linux-gnu.tar.xz x64 Linux checksum
Assets 19
Loading

v3.3.1

21 Jun 16:50
@alilleybrinker alilleybrinker
hipcheck-v3.3.1
341dbf8
Compare
Choose a tag to compare
v3.3.1

3.3.1

This patch release includes two general categories of fixes:

  • Getting Containerfile builds on new releases working.
  • Getting cargo-dist generation of binaries on new releases working.

Changed

Fixed

Full Changelog: hipcheck-v3.3.0...hipcheck-v3.3.1

Assets 2
Loading

v3.3.0

20 Jun 20:19
@alilleybrinker alilleybrinker
hipcheck-v3.3.0
331218b
Compare
Choose a tag to compare
v3.3.0

3.3.0

Hipcheck version 3.3.0 is mostly focused on refactors and internal
improvements, including a substantial refactor of the hc Command Line
Interface to be easier to use and easier for us to enhance in the future.
We've also continued to mature our tooling and processes around Hipcheck,
which should hopefully make future advancement easier.

RFDs

hc

Continuous Integration Workflows

  • Filter GitHub workflow to not run tests if changes to a push or pull-request are outside of code folders by @mchernicoff in #68
  • Add "Dependency Tree" task to CI by @alilleybrinker in #79
  • Publish tagged HC releases to Dockerhub by @j-lanson in #113
  • Add ability to manually exec push-to-dockerhub action by @j-lanson in #119

xtask

xtask is our internal development tooling.

  • Add license and description xtask/src/task/rfd.rs by @mchernicoff in #90
  • Add xtask changelog sanity check for git-cliff by @j-lanson in #92
  • Change xtask validate to xtask check when xtask ci is called by @mchernicoff in #89

Other Project Tooling

Dependency Version Bumps

New Contributors

Full Changelog: hipcheck-v3.2.1...hipcheck-v3.3.0

Assets 2
Loading