-
Notifications
You must be signed in to change notification settings - Fork 34
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support Go dependency scanning for pull requests #1012
Changes from all commits
7c53f3f
e58b9c3
891a59e
4b347c1
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -15,8 +15,8 @@ pull_request: | |
vulnerability_database_endpoint: https://api.osv.dev/v1/query | ||
package_repository: | ||
url: https://registry.npmjs.org | ||
- name: go | ||
- name: Go | ||
vulnerability_database_type: osv | ||
vulnerability_database_endpoint: https://vuln.go.dev | ||
vulnerability_database_endpoint: https://api.osv.dev/v1/query | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Ah, I see, while |
||
package_repository: | ||
url: https://proxy.golang.org |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,104 @@ | ||
// Copyright 2023 Stacklok, Inc. | ||
// | ||
// Licensed under the Apache License, Version 2.0 (the "License"); | ||
// you may not use this file except in compliance with the License. | ||
// You may obtain a copy of the License at | ||
// | ||
// http://www.apache.org/licenses/LICENSE-2.0 | ||
// | ||
// Unless required by applicable law or agreed to in writing, software | ||
// distributed under the License is distributed on an "AS IS" BASIS, | ||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
// See the License for the specific language governing permissions and | ||
// limitations under the License. | ||
|
||
// Package diff provides the diff rule data ingest engine | ||
package diff | ||
|
||
import ( | ||
"testing" | ||
|
||
"github.com/stretchr/testify/assert" | ||
"google.golang.org/protobuf/proto" | ||
|
||
pb "github.com/stacklok/mediator/pkg/api/protobuf/go/mediator/v1" | ||
) | ||
|
||
func TestGoParse(t *testing.T) { | ||
t.Parallel() | ||
|
||
tests := []struct { | ||
description string | ||
content string | ||
expectedCount int | ||
expectedDependencies []*pb.Dependency | ||
}{ | ||
{ | ||
description: "Single addition", | ||
content: ` | ||
+cloud.google.com/go/compute v1.23.0 h1:tP41Zoavr8ptEqaW6j+LQOnyBBhO7OkOMAGrgLopTwY= | ||
+cloud.google.com/go/compute v1.23.0/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM= | ||
cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY= | ||
cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=`, | ||
expectedCount: 1, | ||
expectedDependencies: []*pb.Dependency{ | ||
{ | ||
Ecosystem: pb.DepEcosystem_DEP_ECOSYSTEM_GO, | ||
Name: "cloud.google.com/go/compute", | ||
Version: "v1.23.0", | ||
}, | ||
}, | ||
}, | ||
{ | ||
description: "Single removal", | ||
content: ` | ||
-cloud.google.com/go/compute v1.23.0 h1:tP41Zoavr8ptEqaW6j+LQOnyBBhO7OkOMAGrgLopTwY= | ||
-cloud.google.com/go/compute v1.23.0/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM= | ||
cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY= | ||
cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=`, | ||
expectedCount: 0, | ||
expectedDependencies: nil, | ||
}, | ||
{ | ||
description: "Mixed additions and removals", | ||
content: ` | ||
-cloud.google.com/go/compute v1.23.0 h1:tP41Zoavr8ptEqaW6j+LQOnyBBhO7OkOMAGrgLopTwY= | ||
-cloud.google.com/go/compute v1.23.0/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdiEZc9FEIbM= | ||
+cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY= | ||
+cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA= | ||
+dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk= | ||
+dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=`, | ||
expectedCount: 2, | ||
expectedDependencies: []*pb.Dependency{ | ||
{ | ||
Ecosystem: pb.DepEcosystem_DEP_ECOSYSTEM_GO, | ||
Name: "cloud.google.com/go/compute/metadata", | ||
Version: "v0.2.3", | ||
}, | ||
{ | ||
Ecosystem: pb.DepEcosystem_DEP_ECOSYSTEM_GO, | ||
Name: "dario.cat/mergo", | ||
Version: "v1.0.0", | ||
}, | ||
}, | ||
}, | ||
} | ||
for _, tt := range tests { | ||
tt := tt | ||
t.Run(tt.description, func(t *testing.T) { | ||
t.Parallel() | ||
got, err := goParse(tt.content) | ||
if err != nil { | ||
t.Fatalf("goParse() returned error: %v", err) | ||
} | ||
|
||
assert.Equal(t, tt.expectedCount, len(got), "mismatched dependency count") | ||
|
||
for i, expectedDep := range tt.expectedDependencies { | ||
if !proto.Equal(expectedDep, got[i]) { | ||
t.Errorf("mismatch at index %d: expected %v, got %v", i, expectedDep, got[i]) | ||
} | ||
} | ||
}) | ||
} | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
why did you change the name to start with an uppercase letter? btw I wonder if we should just compare the names in a case-insensitive manner so that we'd match all of go, Go, gO and GO.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
oh I understand now, OSV's databases are case-sensitive..I would honestly make the mediator ecosystems case-insensitive.. (but if you disagree, just tell me that it's a bad idea..).
tested with:
versus:
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes, the names are case-sensitive and can be found here: https://ossf.github.io/osv-schema/#affectedpackage-field
I've changed it to lower-case mediator-wise, thanks.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Re-tested:
![Screenshot 2023-09-26 at 13 39 16](https://private-user-images.githubusercontent.com/43523832/270628162-947f6b1f-20b5-4fbe-9bc0-891d34cf23b6.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjU0MDIzNjUsIm5iZiI6MTcyNTQwMjA2NSwicGF0aCI6Ii80MzUyMzgzMi8yNzA2MjgxNjItOTQ3ZjZiMWYtMjBiNS00ZmJlLTliYzAtODkxZDM0Y2YyM2I2LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MDMlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTAzVDIyMjEwNVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTU2Y2NmZDU3ODMyMWU2YWY4ZDhlYjhmYzc3YWZlNTJjYmVlNzAwMmVkN2JmYTA4YTQ5OWZhMjAyMjVkMGJjYTAmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.Pq4_tzmbw7M0zqeIdZYq5Jx13d6OQrtYCS3pxbLjdII)