heimdall2 icon indicating copy to clipboard operation
heimdall2 copied to clipboard

Version control for an OHDF file in Heimdall Server

Open wdower opened this issue 1 year ago • 0 comments

If you save over the same filename in Heimdall (i.e. by uploading the same scan filename twice) it should keep the first version in version control.

Right now, if you upload a file to the server that has the same name as an existing file, the older one is simply overwritten. This means that if you do something like set up an automated scan that periodically scans one single target, and you want to compare those scans using Comparison View to see how the target's security is trending (which is a very important part of Heimdall!) you have to be sure to make each filename unique before you upload it (such as by appending a timestamp). Heimdall should really be robust enough to track old versions of HDF so that people don't cut themselves by uploading a colliding name.

This feature will become more necessary when we:

  • Enable Checklist editor (#3315). That will allow the editing of OHDF files; users will want to be able to backdate the file if they make a mistake.
  • Make Heimdall and the OHDF schema "target-aware" (related to #5350) -- if we give Heimdall a concept of "systems" in addition to just "OHDF files" like it does now, people are going to want to simply upload files named after that system and expect Heimdall to keep track of its history.

Expected features:

  • As a Heimdall user, I want to be able to view, edit, and download an older version of an OHDF file I uploaded to Heimdall from before I edited it with the checklist editor or added a manual attestation to the data.
  • As a Heimdall user, I want to be able to easily restore an old version of an OHDF file to be the current "active" version of a scan result, just in case I make a mistake editing.
  • As a pipeline engineer, I want to be able to see the original, unedited OHDF file that Heimdall first saw (i.e. the first version in version control) so that I can make sure I know what my automated pipeline sent to the Heimdall server.

wdower avatar Dec 18 '23 22:12 wdower