
Security News
Crates.io Implements Trusted Publishing Support
Crates.io adds Trusted Publishing support, enabling secure GitHub Actions-based crate releases without long-lived API tokens.
An AaC plugin to perform automated quality checks for the shall statements in your AaC model.
This plugin will scan your architecture for any req
entries and will use an LLM to evaluate
the quality of the shall
field. The plugin is configured to evaluate your shall statement
using the following attributes:
If the shall
is evaluated to be of sufficient quality, the aac check
will pass. Otherwise, you will receive a
failure message produced by the AI with an assessment of each attribute and an overall score. Failure results
from an overall score of C (Medium)
or lower from the AI.
If you haven't already, install Architecture-as-Code (AaC):
pip install aac
Next install this AaC-Req-QA plugin:
pip install aac-req-qa
Set the environment variables needed to access an OpenAI endpoint. This may be a commercial endpoint in OpenAI or Azure OpenAI or a self-hosted endpoint using a tool like Ollama or vLLM.
mistral
for local (i.e. Ollama), gpt-4
for OpenAI or AzureIf you wish to use an Azure OpenAI set the following environment variables.
If you have a proxy, set the proxy environment variables.
true
or false
(default: true
).Although this is a bit cumbersome, it is necessary as there is no other way to provide configuration data within AaC, particularly for constraint plugins. Remember to protect your secrets when configuring these environment variables.
This plugin provides a new command called eval-req
that will execute the requirements QA
on a specified AaC file. This will perform an evaluation of each req
in the AaC file based on
INCOSE requirements quality guidelines, and will give you all the AI output for each requirement.
Be aware, this performs a requirement-by-requirement evaluation with no context of surrounding
requirements in the specification. It is often very difficult to meet all INCOSE guidelines
in a single requirement statement. It will also perform separate AI evaluation calls for each
requirement which can take a lot of time. If you wish to perform fewer AI calls and evaluate your
requirements as a set, use the eval-spec
command instead.
This plugin provides a new command called eval-spec
that will execute the requirements specification QA
on a specified AaC file. This will perform a wholistic review of the requirement specification and all
the included requirements against the INCOSE requirements quality guidelines. For instances where
the quality of requirements need to be assessed in context, this is a good solution.
Because this is using an LLM, it is a non-deterministic process and cannot be guaranteed to perform consistently. The LLM is tuned to reduce variation and provide reliable, repeatable performance to the greatest extent possible, but no guarantees can be made with the current state-of-the art LLM models.
Performance is completely dependent on the performance of the LLM provided by the endpoint. This has been tested with Azure OpenAI using GPT-4 as well as Mistral 7B run within Ollama and had acceptable performance in both. Performance with other models may be better or worse.
We're adapting the analyze claims pattern from the open source Fabric project to evaluate requirements. Huge thanks to the Fabric team for the innovation and examples.
FAQs
Unknown package
We found that aac-req-qa demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Crates.io adds Trusted Publishing support, enabling secure GitHub Actions-based crate releases without long-lived API tokens.
Research
/Security News
Undocumented protestware found in 28 npm packages disrupts UI for Russian-language users visiting Russian and Belarusian domains.
Research
/Security News
North Korean threat actors deploy 67 malicious npm packages using the newly discovered XORIndex malware loader.