Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Add artifact extractors #1531

Merged
merged 16 commits into from
Jan 28, 2025

Conversation

another-rex
Copy link
Collaborator

@another-rex another-rex commented Jan 24, 2025

  • Adds the python wheel.egg and java jar archive extractors.

  • renames artifacts source from lockfile to artifact, so output will actually be "artifact:".

  • Reenable some of the image scanning tests accidentally removed from a previous PR. The unrelated snapshot changes will be from that.

This PR is not ready to be merged in yet, waiting on a osv-scalibr change to be merged in first. (google/osv-scalibr#407)

Copy link
Contributor

@hogo6002 hogo6002 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

// Patch python package names to be normalized
if pkg.Ecosystem().Ecosystem == osvschema.EcosystemPyPI {
// per https://peps.python.org/pep-0503/#normalized-names
return strings.ToLower(cachedregexp.MustCompile(`[-_.]+`).ReplaceAllLiteralString(pkg.Inventory.Name, "-"))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we add a TODO to remove this after the API query change is deployed to production?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep good catch, I'll probably remove this entirely since I don't plan on merging this PR in until next week.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm it looks like there's more work to be done here:

  1. Offline scanning also needs to this normalization
  2. The code for identifying fix available/not available also needs this change.
    Added a TODO.

pkg/osvscanner/osvscanner.go Show resolved Hide resolved
@another-rex another-rex force-pushed the add-artifact-extractors branch from a459e05 to 75a1dba Compare January 28, 2025 23:01
@codecov-commenter
Copy link

codecov-commenter commented Jan 28, 2025

Codecov Report

Attention: Patch coverage is 89.65517% with 3 lines in your changes missing coverage. Please review.

Project coverage is 69.18%. Comparing base (9d55ac1) to head (9a02ddc).

Files with missing lines Patch % Lines
internal/imodels/imodels.go 91.66% 0 Missing and 1 partial ⚠️
pkg/osvscanner/filter.go 0.00% 1 Missing ⚠️
pkg/osvscanner/osvscanner.go 50.00% 0 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #1531      +/-   ##
==========================================
+ Coverage   68.98%   69.18%   +0.20%     
==========================================
  Files         200      200              
  Lines       18961    18988      +27     
==========================================
+ Hits        13080    13137      +57     
+ Misses       5162     5141      -21     
+ Partials      719      710       -9     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@another-rex another-rex merged commit 3ee976e into google:main Jan 28, 2025
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants