Criterion for publishing a library parses a JSON like file

Learn
1

Hi! I’m a Phd student in the field of static analysis and security. Mainly my research topic is about consuming the output of static analysis(CodeQL mainly). I noticed there is only one parsing library on sarif file on hackage. It is primitive and out-of-dated.
I enhanced it to be compatible with the current sarif standard.

My enhancement is here.
I’m thinking to publish such library that parses a JSON-like file format on hackage.
I’d like feedback on what maturity level is expected before publishing it.

I wouldn’t say my interpretation on sarif standard is scientific, but at least systematical.
For a field of an object, if it contains keywords more than just must, the haskell representation is wrapped inside a Maybe. The entry for the decoding is the decodeSarifFileStrict function inside Data.SARIF.Log.hs

I tested the project with 9633 sarif files which are results of prototype pollution query on client side javascript.

From these files, i observe thatdecode sarif_content_bytestring = decode . encode . decode $ sarif_content_bytestring.

From the stats, we can at least assume that the project doesn’t lose any information.

The current status of the project:

Parsing supported: sarif-v2.1.0
API entrypoint: decode @DATA.SARIF.Log :: Data.ByteString.Lazy.ByteString -> DATA.SARIF.Log
Tests: 9633 golden tests
Error messages: sprinkled with things like parseJSON _ = fail "Unexpected value for xxxx"

Possible improvement on the library could be

  1. Make it consistent with code snippet written by previous contributor and me.
1 Like
2

Thanks for (trying to) contribute! Your question is not entirely clear. Are you asking if:

  • you can release your PR as a completely new library on Hackage?
  • you can release your PR as a new version of the existing sarif library?
  • you can get the current maintaintainer of sarif to release a new version from your PR?

For #1, the only official criteria are: you need a Hackage account and your package needs to satisfy cabal check. It’s a pretty low bar.

If you’re trying #2, to release serif-0.2.0 you need to first become a Hackage maintainer of the library. The process is described at Taking over a package - HaskellWiki, and the main precondition is that you try and fail at #3.

Tangentially, you mention you tested the project but the Cabal file doesn’t specify any test suite. That’s another possible improvement you could add.