question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Code quality improvements

See original GitHub issue

This issue tracks the different things that can be done to improve the code quality. If you want to fix some one of the issues please comment on this issue, so I can update it.

pylint

We currently have a large list of warnings that we ignore. Those have to be reviewed and removed where possible.

Current warnings:

  • W1509: #932
  • C0103
  • C0115:
  • C0116:
  • C0201: #932
  • C0209: #932
  • C0301
  • C0302
  • C0111
  • W0102: #939
  • W0511
  • W0602: #946
  • W0603
  • W0703
  • W1201: #914, #932
  • W1203: #932
  • E1120: #932
  • R0801
  • R0902
  • R0903
  • R0904
  • R0912
  • R0913
  • R0914
  • R0915
  • R0201: #938
  • R0911
  • R1729: #932
  • R1732: #937

flake8 integration

Flake8 does catches some errors that pylint does not and vice versa. We should integrate it into our style checks. List of potential useful plugins:

- flake8-bugbear
- flake8-comprehensions
- flake8-simplify
- flake8-builtins

MyPy

We currently not enforce types. This makes it harder to reason about some functions and allows for subtile errors. A strict mypy configuration currently returns about 2000 warnings that can probably removed by going through Keylime and adding type annotations.

Configuration used:

[mypy]
plugins = sqlmypy
strict = True
follow_imports = silent
ignore_missing_imports = True

pyright

Static code analysis reports several typing issues in most Python files. Investigate if we should integrate it.

TODOs:

  • Add initial Mypy configuration: #930
  • Add type hints to every file
    • TPM abstraction code
    • verifier
    • registrar
    • tenant
    • ca_util
  • Add Mypy to tox setup

LGTM, semgrep and Bandit

There are multiple tools for analyzing the AST of the Python code and finding common security and code quality issues. We should at least integrate one of them into our CI.

Fuzzing methods that take user controlled input with something like https://github.com/google/atheris can also be useful (mentioned by @kkaarreell).

TODOs

Converting dicts to classes

For the agent event loop we use a dict to store all the necessary state of an agent. This is not ideal because it is hard to reason about what is actually in this dict. We should convert this dict to a class that holds all the required state. For this class we can then also provide conversion functions from and to the ORM class.

Unit tests

Most of the older code in Keylime is only covered by the restful test or the e2e tests. We should add unit tests for this code and refactor it to make it more testable where necessary.

New code should be ideally only added with unit tests.

Automatic code formatting

The current code has no clear style guidelines. We should try to enforce a style with automated tooling.

TODOs:

Removal of config.REQUIRE_ROOT

With #900 merged this flag should be fully removed.

Removal of vTPM code

Originally Keylime supported vTPMs a feature from Xen. This is no longer the case and the deep quote feature is not implemented in swtpm. Most of the code is already removed but there is still some broken skeleton code in there which should be removed.

I think we can move the issue on how to trust the underlying hypervisor out of Keylime and into the platform that manages the hypervisor (e.g. OpenStack).

Removal of STUB TPM logic

There are some parts of Keylime that have code for canned values. There seems to be no documentation on how to use that code and newer parts of Keylime do not implement it. I think this code can be removed.

Removing dependency of the TPM abstraction for the registrar and verifier

Both components initialize an abstract TPM without actually using a TPM. The registrar uses a software implementation of TPM_MakeCredential and the verifier uses tpm2_checkquote and tpm2_eventlog. https://github.com/keylime/enhancements/issues/59 already proposes to move the quote verification code into a separate module which is more flexible and easier to test.

Once the rust agent is the official one, the entire TPM abstraction code could then be removed.

Issue Analytics

  • State:open
  • Created 2 years ago
  • Comments:10 (10 by maintainers)

github_iconTop GitHub Comments

3reactions
aplanascommented, Mar 22, 2022

Maybe use black to unify the code format?

1reaction
mdroccocommented, Oct 18, 2022

Yes that one and most of the functions in tpm_main.py that are not used by the server components.

Sounds good, I will keep ignoring them.

If we have fixed enough of the warnings it make sense to integrate it into our pre-commit hooks.

I am about to complete my first batch of fixes, I will create a PR as soon as I am reasonably happy with it.

Read more comments on GitHub >

github_iconTop Results From Across the Web

4 tips to improve code quality - Work Life by Atlassian
4 tips to improve code quality · 1. Embrace coding conventions · 2. Use a code linter · 3. Adopt continuous integration ·...
Read more >
8 Practices to Ensure Better Code Quality | by Kasun Rajapakse
8 Practices to Ensure Better Code Quality · 1. Use Linter at IDE Level · 2. Right Balance of Comments · 3. Test...
Read more >
Reasons and Strategies To Improve Code Quality
To give you a brief, you can improve the code quality by favoring high cohesion, loose coupling, commenting whys, using code linters, adding ......
Read more >
Best Practices to Improve Code Quality - Encora
Best Practices · Code repetition must be avoided · The code should be readable. · Do not reinvent the wheel. · Commenting and...
Read more >
How to Improve Your Code Quality: 5 Simple Tips! - Codiga
Follow Coding Conventions · Use Automated Code Review Tools · Write Clear & Concise Comments · Use Smart Code Snippets · Use Highly-Supported ......
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found