Fix for the issue #163 - Vet is not able to detect setup.py manifest … #164
Conversation
…given a directory as scan input
SafeDep OSS VetPolicy Checks
|
Deploying with
|
| Latest commit: |
ff68142
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://8654b39e.safedep-vet.pages.dev |
| Branch Preview URL: | https://experimental.safedep-vet.pages.dev |
| @@ -87,18 +88,31 @@ func FindParser(lockfilePath, lockfileAs string) (Parser, error) { | |||
| } | |||
| } | |||
|
|
|||
| pw, _ := findExperimentalParser(lockfilePath, lockfileAs) | |||
There was a problem hiding this comment.
I don't think we should include experimental parsers automatically while scanning a directory because they primarily consist of parsers that does not have a standardised (unique) input file names. For example, SPDX / CycloneDX SBOM can be in any JSON file within the directory. setup.py can be an application code and not a manifest in which case there is a possibility that our parser will fail (which is fine) or generate false positive (which we should avoid).
This is the reason why we have separate list of experimental parsers that can be used explicitly using --lockfile-as and not selected automatically during a directory scan.
There was a problem hiding this comment.
No Problem, i will switch to another tool that will support setup.py because I need to parse it. Most of the python libraries will have setup.py.
…given a directory as scan input