Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Corrects scenario where no src_dir is set - 6.x #246

Merged
merged 3 commits into from
Feb 16, 2024

Conversation

cerrussell
Copy link
Collaborator

@cerrussell cerrussell commented Feb 13, 2024

Trying to get the src_dir from the bom path is good, but we need to still set src_dir to the current working directory if depscan hasn't been run using the --bom argument (or when the bom does not actually exist). Otherwise, we will run into problems as we later assume src_dir has been set and try to use it, which will result in an exception.

    if not src_dir or src_dir == ".":
        if src_dir == "." or args.search_purl:
            src_dir = os.getcwd()
        # Try to infer from the bom file
        elif args.bom and os.path.exists(args.bom):
            src_dir = os.path.dirname(os.path.realpath(args.bom))

This PR corrects the problem, as well as a couple other minor improvements to improve quality and maintainability.

@cerrussell cerrussell force-pushed the fix/no-src-dir-6.x branch 2 times, most recently from e49cbb8 to ae28cbf Compare February 13, 2024 05:27
@prabhu
Copy link
Member

prabhu commented Feb 13, 2024

Needs some more fixes I guess.

Traceback (most recent call last):
  File "/home/runner/work/dep-scan/dep-scan/depscan/cli.py", line 1154, in <module>
    main()
  File "/home/runner/work/dep-scan/dep-scan/depscan/cli.py", line 1074, in main
    vdb_results, pkg_aliases, sug_version_dict, purl_aliases = scan(
  File "/home/runner/work/dep-scan/dep-scan/depscan/cli.py", line 356, in scan
    override_results, _, _ = utils.search_pkgs(
  File "/home/runner/work/dep-scan/dep-scan/depscan/lib/utils.py", line 229, in search_pkgs
    variations = normalize.create_pkg_variations(pkg)
  File "/home/runner/work/dep-scan/dep-scan/depscan/lib/normalize.py", line 103, in create_pkg_variations
    if "golang" not in vendor and name not in [
TypeError: argument of type 'NoneType' is not iterable

@cerrussell
Copy link
Collaborator Author

@prabhu Yes, I did not take into account that the vendor key might be present but the value NoneType. Fixed now.

@prabhu
Copy link
Member

prabhu commented Feb 13, 2024

Take #251 once it is merged to get the CI fix.

Signed-off-by: Caroline Russell <caroline@appthreat.dev>
Signed-off-by: Caroline Russell <caroline@appthreat.dev>
@prabhu
Copy link
Member

prabhu commented Feb 13, 2024

Traceback (most recent call last):
  File "/home/runner/work/dep-scan/dep-scan/depscan/cli.py", line 1154, in <module>
    main()
  File "/home/runner/work/dep-scan/dep-scan/depscan/cli.py", line 1074, in main
    vdb_results, pkg_aliases, sug_version_dict, purl_aliases = scan(
                                                               ^^^^^
  File "/home/runner/work/dep-scan/dep-scan/depscan/cli.py", line 347, in scan
    sug, aliases = process_suggestions(k, v)
                   ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/runner/work/dep-scan/dep-scan/depscan/cli.py", line 401, in process_suggestions
    vendor, name, version = full_pkg.split(":")
    ^^^^^^^^^^^^^^^^^^^^^
ValueError: too many values to unpack (expected 3)
Error: Process completed with exit code 1.

@prabhu prabhu self-requested a review February 13, 2024 22:58
Signed-off-by: Caroline Russell <caroline@appthreat.dev>
@cerrussell cerrussell merged commit 0b3d5e1 into release/6.x Feb 16, 2024
25 checks passed
@cerrussell cerrussell deleted the fix/no-src-dir-6.x branch February 16, 2024 03:51
prabhu added a commit that referenced this pull request Feb 29, 2024
* Clarify bounty targets in insights (#220)

* Clarify bounty targets in insights

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Update pyproject.toml

Signed-off-by: prabhu <prabhu@appthreat.com>

---------

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>
Signed-off-by: prabhu <prabhu@appthreat.com>

* Do not cancel action runs (#228)

* Do not cancel action runs

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Reduce duplicate runs

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

---------

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Update java version (#229)

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Fix oras-py version

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Publish release images

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Fixes #233 in v6 (#235)

* Fixes #233 in v6

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Let's drop support for > 3.10

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

---------

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Check sponsorship for github actions, update workflows (#237)

* Update workflow actions.

Signed-off-by: Caroline Russell <caroline@appthreat.dev>

* Check for sponsorship when using the depscan action on GitHub.

Signed-off-by: Caroline Russell <caroline@appthreat.dev>

---------

Signed-off-by: Caroline Russell <caroline@appthreat.dev>

* Fix AttributeError raised when env variable not present.

Signed-off-by: Caroline Russell <caroline@appthreat.dev>

* Switch to tar xz version for v6 (#240)

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Expand the scope of npm alias to search for vendor with the name npm (#243)

* Expand the scope of npm alias to search for vendor with the name npm

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Lint fixes

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

---------

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Improves sub-tree display (#244)

* Improves sub-tree display

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Try using the default vdb home

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

---------

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Trim CI. Fixes a CSAF error (#251)

* Fixes #248 in v6

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Fixes #248 in v6

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

---------

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Support for gem with platform name in the version number (#253)

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Corrects scenario where no src_dir is set - 6.x (#246)

* Corrects scenario where no src_dir is set.

Signed-off-by: Caroline Russell <caroline@appthreat.dev>

* Bugfix for NoneType.

Signed-off-by: Caroline Russell <caroline@appthreat.dev>

* Bugfix in process_suggestions.

Signed-off-by: Caroline Russell <caroline@appthreat.dev>

---------

Signed-off-by: Caroline Russell <caroline@appthreat.dev>

* Use nodejs 20 LTS (#255)

* Use nodejs 20 LTS

Signed-off-by: prabhu <prabhu@appthreat.com>

* Print node version

Signed-off-by: prabhu <prabhu@appthreat.com>

---------

Signed-off-by: prabhu <prabhu@appthreat.com>

* fix KeyError in purl and version (#261)

ignore components without purl and version

* PR# 263 for v6 (#264)

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

* Added more alias for js audit (#268)

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

---------

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>
Signed-off-by: prabhu <prabhu@appthreat.com>
Signed-off-by: Caroline Russell <caroline@appthreat.dev>
Co-authored-by: Caroline Russell <caroline@appthreat.dev>
Co-authored-by: almaz045 <63047433+almaz045@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants