Security News
cURL Project and Go Security Teams Reject CVSS as Broken
cURL and Go security teams are publicly rejecting CVSS as flawed for assessing vulnerabilities and are calling for more accurate, context-aware approaches.
@atomist/aspect-sdm
Advanced tools
SDM for calculating fingerprints and serving up drift reports
A tool for visualizing technology usage and drift across an organization.
The cloud native era has led to an explosion of repositories, which we lack tools to understand and manage at scale. See Rod Johnson's blog This Will Surprise You for further discussion.
An Atomist aspect captures a concern in your project, in anything available from git: repository content (code and configuration) and git data such as branch counts and committer activity. Aspects support the following use cases:
This project focuses on the visualization use case. Visualizations are exposed via d3 sunburst charts and via a REST API returning JSON documents.
There is out of the box support for investigating the following aspects of your project:
Analysis is extensible using the Atomist Project
API. Implementing and registering additional aspects will result in additional visualization links after re-analysis and restarting the application.
An example visualization, showing Docker images used across two GitHub organizations:
To visualize your org:
org-visualizer
Please use Node 10+.
First, install with npm ci
.
Next, build with npm run build
Data about each repository is stored locally in a PostgreSQL database.
Start Postgres, connect to it, and run the create.ddl script to set up the database.
If you want to wipe out your data and start over, this will also accomplish that.
> psql
psql> \i ddl/create.ddl
For anything other than the default Postgres connection parameters and db org_viz
:
Configure the Postgres database details in client.config.json
in your ~/.atomist
:
{
"sdm": {
"postgres": {
"user": "<postgres user>",
"password": "<postgres password",
"host": "<postgres host>",
"port": "<postgres port>",
"database": "org_viz"
}
}
}
If ~/.atomist/client.config.json
does not exist, create it with the above content.
You will need the following installed on your machine for the out of the box aspects to work:
git
binarymvn
must be on the path.All artifacts referenced in Maven or Node projects must be accessible when the analysis runs.
You can check this by manually running mvn
or npm i
on the relevant projects.
You can start quickly by loading data from four open source organizations by running the script
load-demo-data.sh
.
The analyze
command is part of this org-visualizer project.
It works as at Atomist command, which runs through the atomist
CLI.
npm i -g @atomist/cli
atomist start --local
To analyze a GitHub organization, run the following command:
atomist analyze github repositories
Enter the GitHub owner name (e.g., 'atomist') at the prompt.
When prompted for a query, hit enter to skip.
To access private repositories, ensure that your GitHub token is available to
Node processes via a GITHUB_TOKEN
environment variable.
To analyze local directories, wherever they were cloned from, specify the full path of the parent directory of the repositories, as follows:
atomist analyze local --l /Users/rodjohnson/atomist/projects/spring-team/
Run
atomist analyze [local|github]
with--update true
flag to force updates to existing analyses. Do this if you have updated your analyzer code. (See Extending below.)
Use the --cloneUnder [dir]
option to supply a stable directory under which all cloning should be performed.
Otherwise, temporary files will be used.
If using a stable directory, make sure the directory exists and is writable by the
org-visualizer
process. And keep an eye on disk usage, as these directories are not transient and will not be deleted automatically.
When the server is running with atomist start --local
, you can see the visualizations.
Go to http://localhost:2866.
There are four architectural layers:
atomist analyze
or, in regular use, by an Atomist SDM.This project includes some well known aspects but it is intended for you to add your own.
Do this by updating the aspects
function defined in the aspects.ts
file. Simply add aspects to this array:
export function aspects(): Aspect[] {
return [
DockerFrom,
TypeScriptVersion,
//... add your aspects here
After updating your code you will need to rerun existing analyses. Run
atomist analyze [local|github] --update true
again to force updates on existing data.
See the developer guide for more information.
The Atomist service keeps analyses up to date automatically across all your repositories. It can also help to achieve consistency and convergence in eligible aspects by updating projects, and enabling workflows on change.
See https://atomist.com/developer.html for further information.
Created by Atomist. Need Help? Join our Slack workspace.
FAQs
SDM for calculating fingerprints and serving up drift reports
The npm package @atomist/aspect-sdm receives a total of 55 weekly downloads. As such, @atomist/aspect-sdm popularity was classified as not popular.
We found that @atomist/aspect-sdm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
cURL and Go security teams are publicly rejecting CVSS as flawed for assessing vulnerabilities and are calling for more accurate, context-aware approaches.
Security News
Bun 1.2 enhances its JavaScript runtime with 90% Node.js compatibility, built-in S3 and Postgres support, HTML Imports, and faster, cloud-first performance.
Security News
Biden's executive order pushes for AI-driven cybersecurity, software supply chain transparency, and stronger protections for federal and open source systems.