Skip to content

Releases: mitre/hipcheck

3.6.3 - 2024-09-10

10 Sep 19:54
Compare
Choose a tag to compare

Release Notes

This release includes:

  • A new divz function for policy expressions, which implements with
    division and returns 0 when dividing by 0.
  • Two hc bugfixes:
    • Removed a possible panic when failing to evaluate policy expressions
    • Fixed broken policy expression policies when converting an older-style
      config file to the new "policy file" structure in memory
  • Two automation bugfixes:
    • Removal of a release deployment workaround
    • Fixing our broken Containerfile
  • Removal of unused code and files for "scripts" previously used for
    pull request analysis. We'd removed the code to support pull request analysis
    a while ago, but hadn't removed all of it. This completes that removal,
    and also means we no longer need to distribute a "scripts" folder.

Full Changelog: hipcheck-v3.6.2...hipcheck-v3.6.3

Install hipcheck 3.6.3

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/mitre/hipcheck/releases/download/hipcheck-v3.6.3/hipcheck-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy ByPass -c "irm https://github.com/mitre/hipcheck/releases/download/hipcheck-v3.6.3/hipcheck-installer.ps1 | iex"

Download hipcheck 3.6.3

File Platform Checksum
hipcheck-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
hipcheck-x86_64-apple-darwin.tar.xz Intel macOS checksum
hipcheck-x86_64-pc-windows-msvc.zip x64 Windows checksum
hipcheck-x86_64-unknown-linux-gnu.tar.xz x64 Linux checksum

3.6.2 - 2024-09-10

10 Sep 00:55
Compare
Choose a tag to compare

Release Notes

This is a small release to fix a bug in the release automation for 3.6.1.
For more information on the key content for this release, check out 3.6.1.

Huge thanks to Ashley and the rest of the Axo team for their quick action
to figure out this bug and get a workaround implemented!

Fixed

New Contributors

Full Changelog: hipcheck-v3.6.1...hipcheck-v3.6.2

Install hipcheck 3.6.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/mitre/hipcheck/releases/download/hipcheck-v3.6.2/hipcheck-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy ByPass -c "irm https://github.com/mitre/hipcheck/releases/download/hipcheck-v3.6.2/hipcheck-installer.ps1 | iex"

Download hipcheck 3.6.2

File Platform Checksum
hipcheck-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
hipcheck-x86_64-apple-darwin.tar.xz Intel macOS checksum
hipcheck-x86_64-pc-windows-msvc.zip x64 Windows checksum
hipcheck-x86_64-unknown-linux-gnu.tar.xz x64 Linux checksum

3.6.1 - 2024-09-09

10 Sep 00:38
Compare
Choose a tag to compare

3.6.1 is a patch release, but it features one exciting new,
still-experimental feature: support for plugins! Previously, if you wanted
to add a new source of data or a new form of analsis to Hipcheck, you needed
to modify Hipcheck itself. This placed some limitations on our ability to grow
Hipcheck, and more importantly it conflicted with a core design philosophy
of Hipcheck: that it should empower uses to express their policies about
using open source software (this is one of our Product Values, as expressed in
RFD #2).

With 3.6.1 users can now define custom plugins to provide new sources of
data and new analyses. There's a lot more for us to do with this, including
a lot of user experience polish, releasing our first SDK to make developing
plugins easier, creating and publishing documentation on how to create,
distribute, and use plugins, and more! For now though, this launch is our
official starting point where users can create, distribute, and run plugins.

For more details on the design of the new plugin system, check out
RFD #4. If you have questions
on how to work with plugins, you can always ask us in our GitHub Discussions
forum
!

Completion of the Plugin Minimum Viable Product

Automation Fixes & Improvements

Dependency Version Bumps

Full Changelog: hipcheck-v3.6.0...hipcheck-v3.6.1

3.6.0 - 2024-09-03

04 Sep 17:27
Compare
Choose a tag to compare

NOTE: No builds for this release due to a build configuration issue. We'll be cutting 3.6.1 soon which will have release artifacts.

This is a relatively small release, as we work on the initial implementation
of our new plugin system as described in RFD #4.

There are two fixes in this release:

Plus lots of work on implementing plugins (not yet ready for use):

Some improvements to the website and to CI testing:

Refactoring of the Hipcheck source code:

Updates to our release infrastructure:

And finally, many dependency version bumps:

New Contributors

Full Changelog: hipcheck-v3.5.0...hipcheck-v3.6.0

3.5.0 - 2024-08-05

05 Aug 19:10
Compare
Choose a tag to compare

Release Notes

Hipcheck 3.5.0 continues our focus on user experience improvements with
three major additions:

  • Improved target selection
  • The hc cache subcommand
  • Better progress reporting

Improved Target Selection

In Hipcheck 3.5.0 we've enhanced the ability to specify your target of
analysis
. This is Hipcheck's term for "the thing you want to analyze."
With this new version, you can now provide:

  • Package URLs (pURLs): pURLs are a specification for a unified way of
    referencing packages on a variety of popular package hosts. For example,
    the pURL pkg:npm/[email protected] refers to the package foobar version
    12.3.1 on NPM.
  • VCS URLs: VCS URLs come from the Python ecoystem, where they're used
    by PIP to refer to Git repositories with additional metadata embedded in
    the URL. They're also used by the SPDX Software Bill of Materials standard.
    A VCS URL looks like git+ssh://[email protected]/MyProject, with the
    VCS being used as a prefix to the rest of the protocol, separated by a +.
  • Git References: References are how Git refers to specific things you
    can checkout in a Git repository, including specific commits, branches,
    and tags. By default, Hipcheck checks out the latest (HEAD) commit of a
    repository, but you can now use the --ref flag to specify a different
    ref to check out.
  • CycloneDX SBOMs: Hipcheck can now accept CycloneDX Software Bills of
    Material in addition to SPDX ones, in either JSON or XML format.

Note that some of the methods above allow embedding some target-type
information directly, in ways that can contradict the --type flag when
running hc check. If the --type flag and the target specifier metadata
ever conflict, Hipcheck will produce an error rather than picking one option
over the other automatically.

The following commits were for this work:

  • remove use of Source, SourceRepo, Remote structs in favor of Target by @j-lanson in #229
  • added types for new target repo spec and resolution by @j-lanson in #210
  • add more robust 'target resolution' systemD by @mchernicoff in #227
  • add --ref support to remaining target seed kinds by @j-lanson in #244
  • CLI can infer target type from target pURL by @mchernicoff in #205
  • CLI can infer target type from target VCS URL by @mchernicoff in #209
  • Hipcheck can process SBOMs using CycloneDX (currently JSON only) standard by @mchernicoff in #237
  • Hipcheck can process SBOMs using CycloneDX XML files by @mchernicoff in #239
  • update remote-repo updating to support git refs by @j-lanson in #240
  • update local-repo copying to support git refs by @j-lanson in #242
  • distinguish TargetSeed and TargetSeedKind to transfer ref info from cli by @j-lanson in #243

hc cache subcommand

We've also added a new subcommand, hc cache, for managing the repository
cache that Hipcheck maintains. When Hipcheck runs, it creates a local clone
of the repository being analyzed (if the repository is already local, Hipcheck
still clones it into the repository cache to avoid mutating the original). Over
time, this repository cache will grow, and some repositories may be quite
large. The new hc cache subcommand lets the user see what's in the cache
with hc cache list, and delete elements in the cache with hc cache delete.

The following commits were for this work:

  • add hc cache subcommand for manually listing/deleting elements of the cache by @j-lanson in #224
  • add commit info to hc cache display and index file by @j-lanson in #245
  • local repos are also cloned to HC_CACHE by @j-lanson in #208
  • shortcut cache entry size calculation with cache index file by @j-lanson in #236

Progress Reporting

Hipcheck now shows a progress bar during execution, especially during
repository cloning, which can be quite slow for larger repositories. This is
intended to make it clearer how Hipcheck's time is being spent, and went it's
continuing to make progress vs. being stuck.

The following commits were for this work:

  • major refactor to enable better control of phases and progress bars by @vcfxb in #198
  • Variety of tweaks to the shell and phase infrastructure by @vcfxb in #213
  • Add progress bars when cloning repos (powered by the git2 crate). Integrate libgit2 trace messages into our logging by @vcfxb in #222

And More...

As always, there are more changes in a single version that can be adequately
described here. View the full changelog to see the rest:

Full Changelog: hipcheck-v3.4.0...hipcheck-v3.5.0

Install hipcheck 3.5.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/mitre/hipcheck/releases/download/hipcheck-v3.5.0/hipcheck-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -c "irm https://github.com/mitre/hipcheck/releases/download/hipcheck-v3.5.0/hipcheck-installer.ps1 | iex"

Download hipcheck 3.5.0

File Platform Checksum
hipcheck-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
hipcheck-x86_64-apple-darwin.tar.xz Intel macOS checksum
hipcheck-x86_64-pc-windows-msvc.zip x64 Windows checksum
hipcheck-x86_64-unknown-linux-gnu.tar.xz x64 Linux checksum

3.4.0 - 2024-07-04

04 Jul 23:04
Compare
Choose a tag to compare

Release Notes

Hipcheck 3.4.0 is an exciting release featuring 3 new subcommands!

  • hc setup: When you install the hc binary, whether through an install
    script with a release, with cargo binstall, or by building it yourself,
    you still need to get the configuration and data files Hipcheck requires.
    This new command gets those files for you, so you can start using Hipcheck
    quickly and easily!
  • hc update: This lets Hipcheck update itself to newer versions! Under the
    hood, we're using the self-updater built and provided by cargo-dist, the
    tool we use for cutting new releases with prebuilt binaries. The hc update
    command is a wrapper around that updater. This command does require that
    you use our install script to get the self-updater.
  • hc scoring: This tells you how Hipcheck is scoring results based on your
    current configuration. While you can see the weights for each analysis in
    your configuration file, it can be tedious to do the math yourself to find
    out exactly how much each analysis contributes to the overall score. This
    command does that math for you to make it easier.

Hipcheck also now has an official website!
Feel free to check it out, and let us know if you encounter any issues with it.

Added

  • Add new hc setup command:
  • Add new hc update command:
    • Adds hc update command to run the self-updater (if installed) to automatically bring Hipcheck up to date with a released version. Includes optional flags to update to versions other than the latest by @mchernicoff in #176
  • Add new hc scoring command:

Changed

Fixed

  • Fix broken Docker build:
    • Vendor libgit2 and openssl so that hipcheck builds in containers more consistently by @vcfxb in #177

Removed

  • Remove legacy CLI features that aren't actually implemented or supported:
    • Removes patch type as option for hc check or hc schema, as that was unsupported by @mchernicoff in #153
    • Remove pr analysis and scoring infrastructure by @j-lanson in #158

New Contributors

Full Changelog: hipcheck-v3.3.2...hipcheck-v3.4.0

Install hipcheck 3.4.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/mitre/hipcheck/releases/download/hipcheck-v3.4.0/hipcheck-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -c "irm https://github.com/mitre/hipcheck/releases/download/hipcheck-v3.4.0/hipcheck-installer.ps1 | iex"

Download hipcheck 3.4.0

File Platform Checksum
hipcheck-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
hipcheck-x86_64-apple-darwin.tar.xz Intel macOS checksum
hipcheck-x86_64-pc-windows-msvc.zip x64 Windows checksum
hipcheck-x86_64-unknown-linux-gnu.tar.xz x64 Linux checksum

v3.3.2

21 Jun 18:12
Compare
Choose a tag to compare

3.3.2 - 2024-06-21

This patch is intended to workaround a bug in cargo-dist which caused the
publication of 3.3.1 to fail to include all the expected artifacts. They're
working on fixing the bug, but in the short term this is a reasonable
workaround.

Changed

Full Changelog: hipcheck-v3.3.1...hipcheck-v3.3.2

Install hipcheck 3.3.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/mitre/hipcheck/releases/download/hipcheck-v3.3.2/hipcheck-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -c "irm https://github.com/mitre/hipcheck/releases/download/hipcheck-v3.3.2/hipcheck-installer.ps1 | iex"

Download hipcheck 3.3.2

File Platform Checksum
hipcheck-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
hipcheck-x86_64-apple-darwin.tar.xz Intel macOS checksum
hipcheck-x86_64-pc-windows-msvc.zip x64 Windows checksum
hipcheck-x86_64-unknown-linux-gnu.tar.xz x64 Linux checksum

v3.3.1

21 Jun 16:50
Compare
Choose a tag to compare

3.3.1

This patch release includes two general categories of fixes:

  • Getting Containerfile builds on new releases working.
  • Getting cargo-dist generation of binaries on new releases working.

Changed

Fixed

Full Changelog: hipcheck-v3.3.0...hipcheck-v3.3.1

v3.3.0

20 Jun 20:19
Compare
Choose a tag to compare

3.3.0

Hipcheck version 3.3.0 is mostly focused on refactors and internal
improvements, including a substantial refactor of the hc Command Line
Interface to be easier to use and easier for us to enhance in the future.
We've also continued to mature our tooling and processes around Hipcheck,
which should hopefully make future advancement easier.

RFDs

hc

Continuous Integration Workflows

  • Filter GitHub workflow to not run tests if changes to a push or pull-request are outside of code folders by @mchernicoff in #68
  • Add "Dependency Tree" task to CI by @alilleybrinker in #79
  • Publish tagged HC releases to Dockerhub by @j-lanson in #113
  • Add ability to manually exec push-to-dockerhub action by @j-lanson in #119

xtask

xtask is our internal development tooling.

  • Add license and description xtask/src/task/rfd.rs by @mchernicoff in #90
  • Add xtask changelog sanity check for git-cliff by @j-lanson in #92
  • Change xtask validate to xtask check when xtask ci is called by @mchernicoff in #89

Other Project Tooling

Dependency Version Bumps

New Contributors

Full Changelog: hipcheck-v3.2.1...hipcheck-v3.3.0

v3.2.1

14 May 18:21
Compare
Choose a tag to compare

3.2.1 - 2024-05-10

Nothing really new in Hipcheck itself. Publishing this version mostly to work
out issues with the machinery for publishing new releases and distributing
prebuilt binaries.

Added

Changed

Fixed

Full Changelog: hipcheck-v3.2.0...hipcheck-v3.3.0