Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(internal): add Maven native dependency client #1207

Merged
merged 10 commits into from
Sep 4, 2024
Merged

Conversation

cuixq
Copy link
Contributor

@cuixq cuixq commented Aug 26, 2024

#1045

This PR adds a dependency client fetching from Maven Central repository:

  • the client is based on the Maven registry API client
  • fetched projects and metadata are cached

@codecov-commenter
Copy link

codecov-commenter commented Aug 26, 2024

Codecov Report

Attention: Patch coverage is 18.63118% with 214 lines in your changes missing coverage. Please review.

Project coverage is 65.09%. Comparing base (7fdf3fc) to head (fb08aec).

Files with missing lines Patch % Lines
...nternal/resolution/client/maven_registry_client.go 0.00% 167 Missing ⚠️
...rnal/resolution/datasource/maven_registry_cache.go 0.00% 32 Missing ⚠️
internal/resolution/datasource/maven_registry.go 79.06% 6 Missing and 3 partials ⚠️
cmd/osv-scanner/fix/main.go 0.00% 5 Missing ⚠️
internal/utility/maven/maven.go 75.00% 0 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #1207      +/-   ##
==========================================
- Coverage   65.96%   65.09%   -0.87%     
==========================================
  Files         168      170       +2     
  Lines       14152    14400     +248     
==========================================
+ Hits         9335     9374      +39     
- Misses       4299     4506     +207     
- Partials      518      520       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@cuixq cuixq marked this pull request as ready for review August 27, 2024 06:24
@cuixq cuixq changed the title feat: add Maven native dependency client feat(internal): add Maven native dependency client Aug 27, 2024
Copy link
Member

@michaelkedar michaelkedar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice!

internal/resolution/datasource/maven_registry_cache.go Outdated Show resolved Hide resolved
insights pb.InsightsClient
}

func NewMavenRegistryClient(registry string) (*MavenRegistryClient, error) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For future private registry support, this will probably need to support multiple registries at a time, right?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes I think so

internal/resolution/client/maven_registry_client.go Outdated Show resolved Hide resolved

return &MavenRegistryClient{
api: datasource.NewMavenRegistryAPIClient(registry),
insights: pb.NewInsightsClient(conn),
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since the InsightsClient is only seems to be used for PreFetch, it might be ok to just create it there, instead of storing it in the MavenRegistryClient

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the only difference is that we are not able to return the error of making the insights client but this seems fine - the worst result is that we are not not going to pre-fetch anything.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

actually this may be better that failure on insights client won't block us of making a registry client.

return gob.NewDecoder(f).Decode(&c.api)
}

func (c *MavenRegistryClient) PreFetch(ctx context.Context, imports []resolve.RequirementVersion, manifestPath string) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For my own reference: I actually dislike needing to make PreFetch an interface method of each DependencyClient, since it's almost the same for each client, and also because it needs the deps.dev API to work.

After this is merged, I want to look into making PreFetch a standalone function that calls every resolve.Client method for caching, and use something like singleflight to avoid making identical network requests multiple times.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah I think this is a good idea, I am also thinking about making some cache interface with setter and getter so we don't need to lock and unlock every time.

@cuixq cuixq merged commit a4e1386 into google:main Sep 4, 2024
13 checks passed
@cuixq cuixq deleted the native branch September 4, 2024 01:14
michaelkedar added a commit that referenced this pull request Sep 18, 2024
…t` interface and prevent repeated datasource network calls (#1224)

What I mentioned in
#1207 (comment)

Make `PreFetch` a standalone function that takes in a client that uses
every `DependencyClient` method call.
Since the underlying datasources tend to use the same request for
multiple methods, I've made a `requestCache` type that uses logic based
on the
[singleflight](https://cs.opensource.google/go/x/sync/+/refs/tags/v0.8.0:singleflight/singleflight.go;l=91)
package to prevent the same requests being made multiple times. I've
simplified it a bit by skipping the bespoke handling of panics /
`runtime.Goexit`.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants