Include reporting jobs in graph execution checksum for resolved policy

Signed-off-by: Christian Zunker <christian@mondoo.com>

policy/reportingjob.go

@@ -37,5 +37,14 @@ func (r *ReportingJob) RefreshChecksum() {
  checksum = checksum.Add(notify[i])
  }
  }
+
+ {
+ mrns := make([]string, len(r.Mrns))
+ copy(mrns, r.Mrns)
+ sort.Strings(mrns)
+ for i := range mrns {
+ checksum = checksum.Add(mrns[i])
+ }
+ }
  r.Checksum = checksum.String()
 }

policy/resolver.go

@@ -650,21 +650,30 @@ func (s *LocalServices) tryResolve(ctx context.Context, bundleMrn string, assetF
  Str("bundle", bundleMrn).
  Msg("resolver> phase 5: resolve controls [ok]")
 
- // phase 6: refresh all checksums
- s.refreshChecksums(executionJob, collectorJob)
-
  // the final phases are done in the DataLake
  for _, rj := range collectorJob.ReportingJobs {
  rj.RefreshChecksum()
  }
 
+ // phase 6: refresh all checksums
+ // This uses the ReportingJobs checksums, so calculate them first.
+ s.refreshChecksums(executionJob, collectorJob)
+
+ // resolvedPolicyExecutionChecksum is the GraphExceutionChecksum of the policy and the framework
+ // it does not change if any of the jobs changes, only if the policy or the framework changes
+ rpChecksumInclJobs := checksums.New
+ rpChecksumInclJobs.Add(resolvedPolicyExecutionChecksum) // nolint: staticcheck
+ rpChecksumInclJobs.Add(executionJob.Checksum) // nolint: staticcheck
+ rpChecksumInclJobs.Add(collectorJob.Checksum) // nolint: staticcheck
+
  resolvedPolicy := ResolvedPolicy{
- GraphExecutionChecksum: resolvedPolicyExecutionChecksum,
- Filters: matchingFilters,
- FiltersChecksum: assetFiltersChecksum,
- ExecutionJob: executionJob,
- CollectorJob: collectorJob,
- ReportingJobUuid: reportingJob.Uuid,
+ GraphExecutionChecksum: rpChecksumInclJobs.String(),
+ // GraphExecutionChecksum: resolvedPolicyExecutionChecksum,
+ Filters: matchingFilters,
+ FiltersChecksum: assetFiltersChecksum,
+ ExecutionJob: executionJob,
+ CollectorJob: collectorJob,
+ ReportingJobUuid: reportingJob.Uuid,
  }
 
  err = s.DataLake.SetResolvedPolicy(ctx, bundleMrn, &resolvedPolicy, V2Code, false)