Change ingestion to use Protobom #57
Conversation
|
Caution Review failedThe pull request is closed. WalkthroughThe recent changes enhance the Go project's dependency management and improve core functionalities. The Changes
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (invoked as PR comments)
Additionally, you can add CodeRabbit Configuration File (
|
Codecov ReportAttention: Patch coverage is
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Outside diff range, codebase verification and nitpick comments (1)
pkg/tools/ingest/sbom.go (1)
13-13: Updated comment forSBOMfunction.The comment now accurately reflects the function's purpose of ingesting SBOM files or directories. Ensure the comment remains updated with future changes.
Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
Files selected for processing (3)
- go.mod (2 hunks)
- pkg/graph/visualizer.go (3 hunks)
- pkg/tools/ingest/sbom.go (3 hunks)
Additional comments not posted (17)
go.mod (7)
12-12: Addition ofprotobomdependency.The addition of
github.com/protobom/protobom v0.4.3suggests the integration of Protobom for SBOM processing, aligning with the PR objectives. Ensure this dependency is necessary and used effectively.
25-25: Modification ofcyclonedx-godependency to indirect.Changing
github.com/CycloneDX/cyclonedx-go v0.9.0to an indirect dependency indicates it's no longer directly used. Verify if all direct usages have been replaced or removed.
28-28: Addition ofsemverdependency.The addition of
github.com/blang/semver/v4 v4.0.0as an indirect dependency might be for version management. Ensure its usage is justified.
31-31: Addition ofuuiddependency.The addition of
github.com/google/uuid v1.6.0as an indirect dependency suggests UUID generation is required. Verify its necessity.
35-35: Addition oflogrusdependency.The addition of
github.com/sirupsen/logrus v1.9.3as an indirect dependency suggests enhanced logging capabilities. Ensure its usage is consistent across the codebase.
36-36: Addition ofspdx/tools-golangdependency.The addition of
github.com/spdx/tools-golang v0.5.4as an indirect dependency might be for SPDX processing. Verify its necessity.
42-42: Addition ofprotobufdependency.The addition of
google.golang.org/protobuf v1.34.1as an indirect dependency aligns with Protobom integration. Ensure its usage is necessary and correct.pkg/tools/ingest/sbom.go (7)
10-10: Import of Protobom reader.The import of
github.com/protobom/protobom/pkg/readeraligns with the shift to Protobom for SBOM processing. Ensure this import is used effectively throughout the code.
45-45: Improved error handling for file opening.The error message is clear and provides context about the failure to open a file. This enhances debugging and user feedback.
48-49: Creation of Protobom reader.The creation of a new Protobom reader is a key part of the refactoring. Ensure that this reader is correctly initialized and used.
51-54: Parsing SBOM file with Protobom.The use of
r.ParseFile(filePath)simplifies SBOM parsing. Verify that this method handles all necessary SBOM formats and edge cases.
57-60: Retrieving node list from Protobom document.The retrieval of a node list directly from the document streamlines processing. Ensure that the node list is correctly populated and utilized.
Line range hint
67-81: Processing nodes and adding to graph storage.The new approach to processing nodes and adding them to storage is more direct. Ensure that node IDs and dependencies are correctly managed.
83-102: Handling of edges and dependencies.The refined handling of edges ensures no duplicate edges are created. Verify that all dependencies are correctly represented in the graph.
pkg/graph/visualizer.go (3)
91-92: Use ofcalculateSymbolSizeandgetColorForSize.The refactoring to use dedicated functions for symbol size and color improves clarity. Ensure these functions are correctly implemented and efficient.
159-191: Implementation ofgetColorForSize.This function dynamically assigns colors based on node size, enhancing visual representation. Ensure the color interpolation logic is correct.
193-205: Implementation ofcalculateSymbolSize.The function uses a logarithmic scale to determine node size, which is efficient for large ranges. Ensure the size mapping aligns with expected visual outcomes.
naveensrinivasan
force-pushed
the
neil/ingestWithProtobom
branch
from
a9e4d5b
to
d88ecb4
Compare
neilnaveen
force-pushed
the
neil/ingestWithProtobom
branch
from
d88ecb4
to
a9e4d5b
Compare
- Changed ingestion to use Protobom - Made the visualizer easier to understand
- Changed ingestion to use Protobom - Made the visualizer easier to understand
Included log instead fmt.Println
- Changed ingestion to use Protobom - Made the visualizer easier to understand
naveensrinivasan
force-pushed
the
neil/ingestWithProtobom
branch
from
a9e4d5b
to
024af69
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
Outside diff range, codebase verification and nitpick comments (2)
cmd/root/root.go (1)
17-19: Method modifications approved; suggest adding documentation.The changes to the
AddFlagsmethod are correctly implemented. It's recommended to add documentation or comments explaining the new flags for future maintainability.pkg/tools/ingest/sbom.go (1)
66-102: Refined node and dependency processing.The transition to using
protobomhas streamlined the node processing. The mapping of nodes to their Package URLs and the management of dependencies are clear and maintainable.However, consider adding more detailed logging or comments explaining the logic for handling nodes and dependencies, especially for complex graphs.
Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
Files selected for processing (5)
- cmd/root/root.go (2 hunks)
- go.mod (2 hunks)
- main.go (1 hunks)
- pkg/graph/visualizer.go (3 hunks)
- pkg/tools/ingest/sbom.go (3 hunks)
Files skipped from review as they are similar to previous changes (1)
- pkg/graph/visualizer.go
Additional comments not posted (7)
cmd/root/root.go (1)
12-14: Structural additions approved.The additions of
pprofEnabledandpprofAddrto theoptionsstruct are appropriate for enabling and configuring the pprof server.main.go (1)
16-17: Variable declarations approved.The addition of
pprofEnabledandpprofAddrvariables is necessary for the new profiling functionality.go.mod (1)
Line range hint
13-44: Dependency management changes approved; verify removal impact.The updates to the
go.modfile are well-aligned with the project's new requirements. However, ensure that the removal ofgithub.com/kr/prettydoes not impact any existing functionality.Run the following script to verify the impact of the removal:
Verification successful
Removal of
github.com/kr/prettyconfirmed without impactThe absence of
github.com/kr/prettyin both the codebase and thego.modfile confirms that its removal does not affect existing functionality. No further action is required.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the impact of removing `github.com/kr/pretty`. # Test: Search for usage of `github.com/kr/pretty`. Expect: No occurrences. rg --type go 'github.com/kr/pretty'Length of output: 35
Script:
#!/bin/bash # Description: Verify the presence of `github.com/kr/pretty` in go.mod to confirm its removal. # Test: Search for `github.com/kr/pretty` in go.mod. Expect: No occurrences. rg 'github.com/kr/pretty' go.modLength of output: 32
pkg/tools/ingest/sbom.go (4)
14-14: Updated function documentation.The comment update clarifies the function's purpose, aligning with the changes made to use the
protobomlibrary.
28-28: Review recursive SBOM processing and logging.The recursive processing of directories is correctly implemented. The added logging provides useful traceability for the ingestion process.
Also applies to: 34-34
48-48: Enhanced error handling.The error messages are now more descriptive, improving the debugging process. The use of
fmt.Errorfwith%wfor wrapping errors is a good practice.Also applies to: 57-57, 89-89, 96-96
51-57: Introduction ofprotobomreader for parsing.The use of
protobomreader simplifies the file parsing process, reducing the complexity and potential for bugs compared to the previous manual decoding.
Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com>
…d into neil/ingestWithProtobom
Summary by CodeRabbit
New Features
Bug Fixes
Refactor
Chores