Boulder: Consider forking zlint to add lints based on our specific CP/CPS
We do pre-issuance linting using zlint to ensure that we are compliant with the baseline requirements and various root program requirements. As Bug 1715455 shows, it is possible to still misissue by being in violation of one's own CP/CPS, rather than in violation of root program requirements. We should consider forking zlint to add a new directory of lints based on the contents of our own CP/CPS.
aarongable
All 4 comments
Do you need to fork ZLint for this? As a library user I think it should be possible to compose a lint.Registry with lints of your own from outside the ZLint src tree that you can use with the same linting interface. If it turns out that there's something that prevents that from working well I'd be interested in trying to help fix it upstream in ZLint. Forking is always an option but I expect other CAs have this use-case too and I think it makes sense to support it upstream.
cpu
on 17 Jun 2021
Yeah, I'd prefer to do it without forking as well. In the period of time between coming up with this idea and filing this bug I took a very quick look at the zlint docs. The section on "Lint Sources" didn't mention bringing your own, nor did the section on "Extending Zlint", so I just assumed there weren't affordances for doing so. But I haven't looked any further than that. I'll definitely take a closer look when we actually try to implement this.
aarongable
on 17 Jun 2021
Ooh, I wonder if we could actually store the lints in the CP/CPS repo itself, and then vendor that repo into boulder like any other dependency. That's probably too much of a pain from an automation / CI / ease-of-editing perspective but I kinda like the idea of guaranteeing they're in sync.
aarongable
on 17 Jun 2021
Providing out-of-tree lints was a use-case I had in mind when I did the refactoring that allowed excluding categories of lints but I don't think it's been tried in practice (or captured in docs :sweat:). There might be some bumps in the road but I think it should be achievable :crossed_fingers:
cpu
on 17 Jun 2021
Related issues
cpu
路
3Comments
standenemy
路
5Comments
cpu
路
4Comments
rolandshoemaker
路
5Comments
sheurich
路
5Comments
Most helpful comment
Ooh, I wonder if we could actually store the lints in the CP/CPS repo itself, and then vendor that repo into boulder like any other dependency. That's probably too much of a pain from an automation / CI / ease-of-editing perspective but I kinda like the idea of guaranteeing they're in sync.