feat: add --existing-policy flag in verify-policy command for example policies #1189

Demolus13 · 2025-09-28T14:06:09Z

Summary

This Pull Request introduces a new --existing-policy flag to the verify-policy command, allowing users to run example policies by name without specifying a file path. It also adds support for policy templates.

The new --existing-policy (-e) flag executes a predefined policy template by name. If the template exists, it populates the <PACKAGE_PURL> placeholder with the value from the --package-url (-purl) argument and runs the policy. If the template name is not found, it lists all available templates.

Example policies

A malware detection policy for the package (based on the malware detection tutorial)

macaron analyze -purl pkg:pypi/[email protected]
macaron verify-policy --database output/macaron.db --existing-policy malware-detection -purl pkg:pypi/django

A malware detection policy for the package and all its dependencies (based on the malware detection tutorial)

python3.11 -m venv /tmp/.django_venv
/tmp/.django_venv/bin/pip install django==5.0.6
macaron analyze -purl pkg:pypi/[email protected] --python-venv "/tmp/.django_venv" --deps-depth=1  
macaron verify-policy --database output/macaron.db --existing-policy malware-detection-dependencies -purl pkg:pypi/django

Analyzing GitHub Actions (tutorial)

macaron analyze -purl pkg:maven/org.apache.logging.log4j/[email protected]
macaron verify-policy --database output/macaron.db --existing-policy check-github-actions -purl pkg:maven/org.apache.logging.log4j/log4j-core

Description of changes

Added a --existing-policy (-e) argument to the verify-policy CLI command, enabling users to select and run example policies from the built-in resources.
Updated the policy loading logic to support both file-based and named example policies. If a policy name is provided, the command loads the corresponding template from the resources/policies/datalog directory.
Added support for the --package-url (-purl) argument to substitute the <PACKAGE_PURL> placeholder in policy templates.
Added new example policy templates for common use cases.
Added new test cases for --existing-policy (-e) flag in tests/policy_engine/test_existing_policy.py

Related issues

N/A

Checklist

I have reviewed the contribution guide.
My PR title and commits follow the Conventional Commits convention.
My commits include the "Signed-off-by" line.
I have signed my commits following the instructions provided by GitHub. Note that we run GitHub's commit verification tool to check the commit signatures. A green verified label should appear next to all of your commits on GitHub.
I have updated the relevant documentation, if applicable.
I have tested my changes and verified they work as expected.

behnazh-w

Please add a unit test to tests/policy_engine/test_policy.py. Also add an integration test.

behnazh-w · 2025-10-30T01:25:52Z

src/macaron/__main__.py

        with open(verify_policy_args.file, encoding="utf-8") as file:
            policy_content = file.read()
+    elif verify_policy_args.policy:
+        policy_dir = os.path.join(macaron.MACARON_PATH, "resources/policies/datalog")


We avoid using / in strings and instead use the os.path.join method to construct the path.

Suggested change

policy_dir = os.path.join(macaron.MACARON_PATH, "resources/policies/datalog")

policy_dir = os.path.join(macaron.MACARON_PATH, "resources", "policies", "datalog")

behnazh-w · 2025-10-30T01:29:46Z

src/macaron/__main__.py

            policy_content = file.read()
+    elif verify_policy_args.policy:
+        policy_dir = os.path.join(macaron.MACARON_PATH, "resources/policies/datalog")
+        available_policies = [policy[:-12] for policy in os.listdir(policy_dir) if policy.endswith(".dl.template")]


It would be good to avoid hardcoding [:-12].

Suggested change

available_policies = [policy[:-12] for policy in os.listdir(policy_dir) if policy.endswith(".dl.template")]

policy_suffix = ".dl.template"

available_policies = [

os.path.splitext(policy)[0].replace(policy_suffix, "")

for policy in os.listdir(policy_dir)

if policy.endswith(policy_suffix)

]

behnazh-w · 2025-10-30T06:40:56Z

src/macaron/__main__.py

+        policy_path = os.path.join(policy_dir, f"{verify_policy_args.policy}.dl.template")
+        with open(policy_path, encoding="utf-8") as file:
+            policy_content = file.read()
+        if verify_policy_args.package_url:


Let's check that the PURL using the packageurl library, which is already a dependency of Macaron:

try: PackageURL.from_string(verify_policy_args.package_url) except ValueError as error: logger.error("The package url %s is not valid.", verify_policy_args.package_url) return os.EX_USAGE

behnazh-w · 2025-10-30T06:48:17Z

src/macaron/__main__.py

    vp_parser.add_argument("-d", "--database", required=True, type=str, help="Path to the database.")
+    vp_parser.add_argument("-purl", "--package-url", help="PackageURL for policy template.")
    vp_group.add_argument("-f", "--file", type=str, help="Path to the Datalog policy.")
+    vp_group.add_argument("-p", "--policy", help="Example policy to run.")


Suggested change

vp_group.add_argument("-p", "--policy", help="Example policy to run.")

vp_group.add_argument("-e", "--existing-policy", help="Name of the existing policy to run.")

Signed-off-by: Demolus13 <[email protected]>

…olicy command Signed-off-by: Demolus13 <[email protected]>

Signed-off-by: Demolus13 <[email protected]>

behnazh-w · 2025-11-04T05:58:30Z

src/macaron/resources/policies/datalog/malware-detection-dependencies.dl.template

+
+apply_policy_to("check-dependencies", component_id) :-
+    is_component(component_id, purl),
+    match("<PACKAGE_PURL>@.*", purl).


What if the user provides a PURL that contains version as well? Then the policy won't match the PURL.

Does removing @.* resolve the issue?

from

match("<PACKAGE_PURL>@.*", purl).

to

match("<PACKAGE_PURL>", purl).

Yes, but that would mean we can't use wildcards, which are useful for creating more generic policies that apply to all versions. Alternatively, we could allow the wildcard within the PURL argument itself 🤔

oracle-contributor-agreement bot added the OCA Verified All contributors have signed the Oracle Contributor Agreement. label Sep 28, 2025

Demolus13 self-assigned this Sep 28, 2025

Demolus13 force-pushed the pgovale/example-policies branch from 30b51e3 to ce3dfd5 Compare October 7, 2025 06:22

behnazh-w reviewed Oct 30, 2025

View reviewed changes

behnazh-w marked this pull request as ready for review October 30, 2025 06:55

Demolus13 force-pushed the pgovale/example-policies branch 2 times, most recently from ae722e9 to a2203de Compare October 31, 2025 06:55

Demolus13 changed the title ~~feat: add --policy flag in verify-policy command for example policies~~ feat: add --existing-policy flag in verify-policy command for example policies Nov 1, 2025

Demolus13 added 6 commits November 4, 2025 10:05

feat: add --policy flag in verify-policy command for example policies

d8e6020

Signed-off-by: Demolus13 <[email protected]>

feat: add policy template modification for standardization

cf53381

Signed-off-by: Demolus13 <[email protected]>

feat: add sample policies

75e5c42

Signed-off-by: Demolus13 <[email protected]>

chore: improve handling of policy templates and verify packageurl

a55e050

Signed-off-by: Demolus13 <[email protected]>

refactor: change -p (--policy) to -e (--existing-policy) for verify-p…

ec11626

…olicy command Signed-off-by: Demolus13 <[email protected]>

chore: add simple tests for existing-policy flag

ff9fff7

Signed-off-by: Demolus13 <[email protected]>

Demolus13 force-pushed the pgovale/example-policies branch from 40dbe23 to ff9fff7 Compare November 4, 2025 04:36

behnazh-w reviewed Nov 4, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: add --existing-policy flag in verify-policy command for example policies #1189

feat: add --existing-policy flag in verify-policy command for example policies #1189

Uh oh!

Demolus13 commented Sep 28, 2025 •

edited

Loading

Uh oh!

behnazh-w left a comment

Uh oh!

behnazh-w Oct 30, 2025

Uh oh!

behnazh-w Oct 30, 2025

Uh oh!

behnazh-w Oct 30, 2025

Uh oh!

behnazh-w Oct 30, 2025

Uh oh!

behnazh-w Nov 4, 2025

Uh oh!

Demolus13 Nov 4, 2025

Uh oh!

behnazh-w Nov 4, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	policy_dir = os.path.join(macaron.MACARON_PATH, "resources/policies/datalog")
	policy_dir = os.path.join(macaron.MACARON_PATH, "resources", "policies", "datalog")

	vp_group.add_argument("-p", "--policy", help="Example policy to run.")
	vp_group.add_argument("-e", "--existing-policy", help="Name of the existing policy to run.")

feat: add --existing-policy flag in verify-policy command for example policies #1189

Are you sure you want to change the base?

feat: add --existing-policy flag in verify-policy command for example policies #1189

Uh oh!

Conversation

Demolus13 commented Sep 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Description of changes

Related issues

Checklist

Uh oh!

behnazh-w left a comment

Choose a reason for hiding this comment

Uh oh!

behnazh-w Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

behnazh-w Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

behnazh-w Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

behnazh-w Oct 30, 2025

Choose a reason for hiding this comment

Uh oh!

behnazh-w Nov 4, 2025

Choose a reason for hiding this comment

Uh oh!

Demolus13 Nov 4, 2025

Choose a reason for hiding this comment

Uh oh!

behnazh-w Nov 4, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Demolus13 commented Sep 28, 2025 •

edited

Loading