New line linting in the YAMLLINT process

[joshnck]

By default the YAML Lint rule for using unix newline \n is on and it will identify when DOS new line is used \r\n and call it wrong. My question is - does this actually matter? In my environment I've made a few manual exceptions to this without modifying PySigma at all and the rules parse just fine.

Is there any reason why we need this check? Are there any other YAML lint defaults that we should consider turning off?

[frack113]

hi,
\r\n is very Microsoft Windows focus.
On the other hand, \n is managed by every modem language or OS.

It is why the rules are in UTF-8 and with \n

[joshnck]

So is this standardization for the sake of standardization - or does using \r\n break something in the built in parsing/PySigma tools that I am not seeing?

[frack113]

It is standardization https://github.com/SigmaHQ/sigma-specification/blob/main/Sigma_specification.md#data
Python can manage the two way.

[joshnck]

Why do we keep indentation: disable instead of indentation: {spaces: 4} then?
Should we turn on quoted strings too?

quoted-strings:
    quote-type: single
    required: true

[frack113]

I have play a little with YAMLLINT but get many False Possitif

[joshnck]

I think the quoted-strings bit is a bad idea because we haven't enforced references or event names to be strings - there would be a lot of work to redo.

The indentations rule seems good though. There are some rules that clearly used two spaces instead of 4 and that should be an easy standard to fix and follow.

[joshnck]

Even just the fixed indentation requirement is leaving hundreds of failed results. I think this standard is good in theory - but maybe should have been implemented a while ago.

But I'd be happy to go back in and change the spacing on all of these rules if the community agrees this is the best approach moving forward. I'll fall on the sword that I stood up :)

[nasbench]

This not a priority in my opinion and most important rules were fixed a while ago.

We'll fix this later down the pipe there are other important issues to handle at the moment :)

[nasbench]

Hey @joshnck the yaml linter is now in use and is checking

• Trailing spaces
• Spaces between comments
• Enforces indentation to 4
• Enforce empty line at the EOF

You can see the changes in #4482

Thanks for the suggestions once again :)