-
Notifications
You must be signed in to change notification settings - Fork 2.4k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
chore(deps): merge go-dep-parser into Trivy (#6094)
Signed-off-by: Arunprasad Rajkumar <arajkuma@redhat.com> Signed-off-by: guoguangwu <guoguangwu@magic-shield.com> Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: knqyf263 <knqyf263@gmail.com> Co-authored-by: Masahiro <mur4m4s4.331@gmail.com> Co-authored-by: Tomoya Amachi <tomoya.amachi@gmail.com> Co-authored-by: Masahiro <lomycisw@gmail.com> Co-authored-by: Liz Rice <liz@lizrice.com> Co-authored-by: Johannes <johannes@jitesoft.com> Co-authored-by: aprp <doelaudi@gmail.com> Co-authored-by: rahul2393 <rahulyadavsep92@gmail.com> Co-authored-by: Arunprasad Rajkumar <ar.arunprasad@gmail.com> Co-authored-by: Emrecan BATI <emrecanbati@gmail.com> Co-authored-by: sherif84 <12298259+sherif84@users.noreply.github.com> Co-authored-by: Sherif Fathalla <sfathall@akamai.com> Co-authored-by: sherif <sherif.mailbox@gmail.com> Co-authored-by: Sam Lane <samuel.lane@hotmail.com> Co-authored-by: Ankush K <akhobragade@gmail.com> Co-authored-by: Ankush K <akhobragade42@gmail.com> Co-authored-by: Tauseef <tauseefmlk@gmail.com> Co-authored-by: Daniel <danfaizer@gmail.com> Co-authored-by: Matthieu MOREL <mmorel-35@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: afdesk <work@afdesk.com> Co-authored-by: AndreyLevchenko <levchenko.andrey@gmail.com> Co-authored-by: Kobus van Schoor <10784365+kobus-v-schoor@users.noreply.github.com> Co-authored-by: Jan-Otto Kröpke <github@jkroepke.de> Co-authored-by: jerbob92 <jerbob92@users.noreply.github.com> Co-authored-by: DmitriyLewen <91113035+DmitriyLewen@users.noreply.github.com> Co-authored-by: Shira Cohen <97398476+ShiraCohen33@users.noreply.github.com> Co-authored-by: astevenson-microsoft <78623826+astevenson-microsoft@users.noreply.github.com> Co-authored-by: Kyriakos Georgiou <kgeorgiou@users.noreply.github.com> Co-authored-by: mycodeself <mycodeself@users.noreply.github.com> Co-authored-by: DavidSalame <75929252+davidsalame1@users.noreply.github.com> Co-authored-by: Tom Fay <tom@teamfay.co.uk> Co-authored-by: Tom Fay <tomfay@microsoft.com> Co-authored-by: François Poirotte <fpoirotte@users.noreply.github.com> Co-authored-by: Guy Ben-Aharon <baguy3@gmail.com> Co-authored-by: Catminusminus <37803616+Catminusminus@users.noreply.github.com> Co-authored-by: Lior Vaisman Argon <97836016+VaismanLior@users.noreply.github.com> Co-authored-by: Matthieu Maitre <mmaitre@microsoft.com> Co-authored-by: Andrea Scarpino <andrea@scarpino.dev> Co-authored-by: MorAlon1 <101275199+MorAlon1@users.noreply.github.com> Co-authored-by: liorj-orca <96177663+liorj-orca@users.noreply.github.com> Co-authored-by: Nikita Pivkin <100182843+nikpivkin@users.noreply.github.com> Co-authored-by: guangwu <guoguangwu@magic-shield.com> Co-authored-by: Nikita Pivkin <nikita.pivkin@smartforce.io> Co-authored-by: DmitriyLewen <dmitriy.lewen@smartforce.io> Co-authored-by: yuriShafet <5830215+yuriShafet@users.noreply.github.com> Co-authored-by: Octogonapus <firey45@gmail.com>
- Loading branch information
47 people
authored
Feb 19, 2024
1 parent
32a02a9
commit 74dc5b6
Showing
384 changed files
with
63,319 additions
and
79 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -19,6 +19,7 @@ linters-settings: | |
| locale: US | ||
| ignore-words: | ||
| - licence | ||
| - optimise | ||
| gosec: | ||
| excludes: | ||
| - G101 | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,133 @@ | ||
| package conan | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "io" | ||
| "strings" | ||
|
|
||
| "github.com/liamg/jfather" | ||
| "golang.org/x/exp/slices" | ||
| "golang.org/x/xerrors" | ||
|
|
||
| dio "github.com/aquasecurity/trivy/pkg/dependency/parser/io" | ||
| "github.com/aquasecurity/trivy/pkg/dependency/parser/log" | ||
| "github.com/aquasecurity/trivy/pkg/dependency/parser/types" | ||
| ) | ||
|
|
||
| type LockFile struct { | ||
| GraphLock GraphLock `json:"graph_lock"` | ||
| } | ||
|
|
||
| type GraphLock struct { | ||
| Nodes map[string]Node `json:"nodes"` | ||
| } | ||
|
|
||
| type Node struct { | ||
| Ref string `json:"ref"` | ||
| Requires []string `json:"requires"` | ||
| StartLine int | ||
| EndLine int | ||
| } | ||
|
|
||
| type Parser struct{} | ||
|
|
||
| func NewParser() types.Parser { | ||
| return &Parser{} | ||
| } | ||
|
|
||
| func (p *Parser) Parse(r dio.ReadSeekerAt) ([]types.Library, []types.Dependency, error) { | ||
| var lock LockFile | ||
| input, err := io.ReadAll(r) | ||
| if err != nil { | ||
| return nil, nil, xerrors.Errorf("failed to read canon lock file: %w", err) | ||
| } | ||
| if err := jfather.Unmarshal(input, &lock); err != nil { | ||
| return nil, nil, xerrors.Errorf("failed to decode canon lock file: %w", err) | ||
| } | ||
|
|
||
| // Get a list of direct dependencies | ||
| var directDeps []string | ||
| if root, ok := lock.GraphLock.Nodes["0"]; ok { | ||
| directDeps = root.Requires | ||
| } | ||
|
|
||
| // Parse packages | ||
| parsed := make(map[string]types.Library) | ||
| for i, node := range lock.GraphLock.Nodes { | ||
| if node.Ref == "" { | ||
| continue | ||
| } | ||
| lib, err := parseRef(node) | ||
| if err != nil { | ||
| log.Logger.Debug(err) | ||
| continue | ||
| } | ||
|
|
||
| // Determine if the package is a direct dependency or not | ||
| direct := slices.Contains(directDeps, i) | ||
| lib.Indirect = !direct | ||
|
|
||
| parsed[i] = lib | ||
| } | ||
|
|
||
| // Parse dependency graph | ||
| var libs []types.Library | ||
| var deps []types.Dependency | ||
| for i, node := range lock.GraphLock.Nodes { | ||
| lib, ok := parsed[i] | ||
| if !ok { | ||
| continue | ||
| } | ||
|
|
||
| var childDeps []string | ||
| for _, req := range node.Requires { | ||
| if child, ok := parsed[req]; ok { | ||
| childDeps = append(childDeps, child.ID) | ||
| } | ||
| } | ||
| if len(childDeps) != 0 { | ||
| deps = append(deps, types.Dependency{ | ||
| ID: lib.ID, | ||
| DependsOn: childDeps, | ||
| }) | ||
| } | ||
|
|
||
| libs = append(libs, lib) | ||
| } | ||
| return libs, deps, nil | ||
| } | ||
|
|
||
| func parseRef(node Node) (types.Library, error) { | ||
| // full ref format: package/version@user/channel#rrev:package_id#prev | ||
| // various examples: | ||
| // 'pkga/0.1@user/testing' | ||
| // 'pkgb/0.1.0' | ||
| // 'pkgc/system' | ||
| // 'pkgd/0.1.0#7dcb50c43a5a50d984c2e8fa5898bf18' | ||
| ss := strings.Split(strings.Split(strings.Split(node.Ref, "@")[0], "#")[0], "/") | ||
| if len(ss) != 2 { | ||
| return types.Library{}, xerrors.Errorf("Unable to determine conan dependency: %q", node.Ref) | ||
| } | ||
| return types.Library{ | ||
| ID: fmt.Sprintf("%s/%s", ss[0], ss[1]), | ||
| Name: ss[0], | ||
| Version: ss[1], | ||
| Locations: []types.Location{ | ||
| { | ||
| StartLine: node.StartLine, | ||
| EndLine: node.EndLine, | ||
| }, | ||
| }, | ||
| }, nil | ||
| } | ||
|
|
||
| // UnmarshalJSONWithMetadata needed to detect start and end lines of deps | ||
| func (n *Node) UnmarshalJSONWithMetadata(node jfather.Node) error { | ||
| if err := node.Decode(&n); err != nil { | ||
| return err | ||
| } | ||
| // Decode func will overwrite line numbers if we save them first | ||
| n.StartLine = node.Range().Start.Line | ||
| n.EndLine = node.Range().End.Line | ||
| return nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,139 @@ | ||
| package conan_test | ||
|
|
||
| import ( | ||
| "os" | ||
| "sort" | ||
| "strings" | ||
| "testing" | ||
|
|
||
| "github.com/stretchr/testify/assert" | ||
| "github.com/stretchr/testify/require" | ||
|
|
||
| "github.com/aquasecurity/trivy/pkg/dependency/parser/c/conan" | ||
| "github.com/aquasecurity/trivy/pkg/dependency/parser/types" | ||
| ) | ||
|
|
||
| func TestParse(t *testing.T) { | ||
| tests := []struct { | ||
| name string | ||
| inputFile string // Test input file | ||
| wantLibs []types.Library | ||
| wantDeps []types.Dependency | ||
| }{ | ||
| { | ||
| name: "happy path", | ||
| inputFile: "testdata/happy.lock", | ||
| wantLibs: []types.Library{ | ||
| { | ||
| ID: "pkga/0.0.1", | ||
| Name: "pkga", | ||
| Version: "0.0.1", | ||
| Locations: []types.Location{ | ||
| { | ||
| StartLine: 13, | ||
| EndLine: 22, | ||
| }, | ||
| }, | ||
| }, | ||
| { | ||
| ID: "pkgb/system", | ||
| Name: "pkgb", | ||
| Version: "system", | ||
| Indirect: true, | ||
| Locations: []types.Location{ | ||
| { | ||
| StartLine: 23, | ||
| EndLine: 29, | ||
| }, | ||
| }, | ||
| }, | ||
| { | ||
| ID: "pkgc/0.1.1", | ||
| Name: "pkgc", | ||
| Version: "0.1.1", | ||
| Locations: []types.Location{ | ||
| { | ||
| StartLine: 30, | ||
| EndLine: 35, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| wantDeps: []types.Dependency{ | ||
| { | ||
| ID: "pkga/0.0.1", | ||
| DependsOn: []string{ | ||
| "pkgb/system", | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| { | ||
| name: "happy path. lock file with revisions support", | ||
| inputFile: "testdata/happy2.lock", | ||
| wantLibs: []types.Library{ | ||
| { | ||
| ID: "openssl/3.0.3", | ||
| Name: "openssl", | ||
| Version: "3.0.3", | ||
| Locations: []types.Location{ | ||
| { | ||
| StartLine: 12, | ||
| EndLine: 22, | ||
| }, | ||
| }, | ||
| }, | ||
| { | ||
| ID: "zlib/1.2.12", | ||
| Name: "zlib", | ||
| Version: "1.2.12", | ||
| Indirect: true, | ||
| Locations: []types.Location{ | ||
| { | ||
| StartLine: 23, | ||
| EndLine: 30, | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| wantDeps: []types.Dependency{ | ||
| { | ||
| ID: "openssl/3.0.3", | ||
| DependsOn: []string{ | ||
| "zlib/1.2.12", | ||
| }, | ||
| }, | ||
| }, | ||
| }, | ||
| { | ||
| name: "happy path. lock file without dependencies", | ||
| inputFile: "testdata/empty.lock", | ||
| }, | ||
| { | ||
| name: "sad path. wrong ref format", | ||
| inputFile: "testdata/sad.lock", | ||
| }, | ||
| } | ||
|
|
||
| for _, tt := range tests { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| f, err := os.Open(tt.inputFile) | ||
| require.NoError(t, err) | ||
| defer f.Close() | ||
|
|
||
| gotLibs, gotDeps, err := conan.NewParser().Parse(f) | ||
| require.NoError(t, err) | ||
|
|
||
| sort.Slice(gotLibs, func(i, j int) bool { | ||
| ret := strings.Compare(gotLibs[i].Name, gotLibs[j].Name) | ||
| if ret != 0 { | ||
| return ret < 0 | ||
| } | ||
| return gotLibs[i].Version < gotLibs[j].Version | ||
| }) | ||
|
|
||
| assert.Equal(t, tt.wantLibs, gotLibs) | ||
| assert.Equal(t, tt.wantDeps, gotDeps) | ||
| }) | ||
| } | ||
| } |
Oops, something went wrong.