Add vex.EffectiveStatement deprecate StatementFromID #30
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
puerco
force-pushed
the
latest-statement
branch
from
b9344ff
to
864a5ad
Compare
luhring
reviewed
Apr 18, 2023
| @@ -169,12 +169,39 @@ func (vexDoc *VEX) ToJSON(w io.Writer) error { | |||
| return nil | |||
| } | |||
|
|
|||
| // EffectiveStatement returns the latest VEX statement for a given product, that | |||
| // is the statement that contains the latest data about impact to a given product. | |||
| func (vexDoc *VEX) EffectiveStatement(product, vulnID string) (s *Statement) { | |||
There was a problem hiding this comment.
I'm wondering if it'd be simpler to start by calling SortStatements to do the time sort.
And then you can go latest-to-oldest, doing the "does this statement refer to the given product?" check, and return the statement the first time the answer is "yes". WDYT?
This commit adds a new method vex.EffectiveStatement that takes a product and a vulnerability ID and returns the latest known impact statement. It also deprectares StatementFromID as that function is wrongly designed (product is required to know the latest impact statement). Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
cpanato
approved these changes
Jun 10, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This commit adds a new method to
vex.EffectiveStatementthat takes a product and a vulnerability ID and returns the latest known impact statement.It also adds a deprecation notice to
vex.StatementFromID()as that function is wrongly designed (the product is required to know the latest impact statement). I added a hack to make it more or less do what it was intended to, but it will still be removed at some point.Fixes #29
Signed-off-by: Adolfo García Veytia (Puerco) puerco@chainguard.dev