chore(deps): merge go-dep-parser into Trivy #6094

knqyf263 · 2024-02-09T18:15:20Z

Description

Merge go-dep-parser into Trivy

Issues

Close refactor: Merging go-dep-parser into Trivy #6105

Checklist

I've read the guidelines for contributing to this repository.
I've followed the conventions in the PR title.
I've added tests that prove my fix is effective or that my feature works.
I've updated the documentation with the relevant information (if needed).
I've added usage information (if the PR introduces new options)
I've included a "before" and "after" example to the description (if the PR is a user interface change).

Transfer repositoriy

* test(cargo): to lower * test(cargo): to lower

* Initial NuGet parser files, implemented test cases for three package sources. Signed-off-by: Johannes Tegnér <[email protected]> * Implemented parser, updated testcase to remove duplicated entries. Signed-off-by: Johannes Tegnér <[email protected]> * test(nuget): Added a test for multiple versions of the same package. Signed-off-by: Johannes Tegnér <[email protected]> * Cleanup of nuget parser (removal of comments which are not really needed). Signed-off-by: Johannes Tegnér <[email protected]> * Removed JSON mapping from nuget dependency struct (not needed as it's a read not write operation). Signed-off-by: Johannes Tegnér <[email protected]> * Added a test for legacy nuget packages (x.x.x.x - not semver versions). Signed-off-by: Johannes Tegnér <[email protected]> * Replaced old nuget test-files with new, generated from netcore image (added comments on generation steps). Signed-off-by: Johannes Tegnér <[email protected]> * Fixed nuget parsing algorithm to work the same way nuget works internally with package resolving. Signed-off-by: Johannes Tegnér <[email protected]> * Changed name of 'Dependencies' to 'Targets' in LockFile struct for nuget parser. Signed-off-by: Johannes Tegnér <[email protected]> * Wraped error in nuget parser with xerrors. Signed-off-by: Johannes Tegnér <[email protected]> * Updated nuget testdata for legacy packages and removed second loop for sub-packages, as they are added in top-level as Transitive type. Signed-off-by: Johannes Tegnér <[email protected]> * Replaced the complex file with a even more complex file (multi target!), updated parse to again use version. Signed-off-by: Johannes Tegnér <[email protected]> * refactor(nuget): simplify Co-authored-by: knqyf263 <[email protected]>

* feat: support jar/war/ear * feat(jar): support sha1 search * fix: do not return when MANIFEST.INF is invalid * feat: add log package * feat: search by artifactId * refactor: add runtime scope * feat: support multiple pom.properties * test: add test jar * fix: use fileProps * fix: replace '+' with ' ' * fix: return when artifactId or version are empty * refactor(jar): add a debug message * fix(log): use zap.SugaredLogger

* add support for go.sum (go-dep-parser#20) * modify test cases * keep pseudo version * rewrite test with testify * simplify semver parsing * wrap errors * go mod tidy

* make parser compatible with yaml2 * Fix linting

…rser#28) * feat(JarParse) return errors other than no artifact found error * feat(JarParse) fix review: return error by search sha1 network error * fix(JarParse) change error message

…-parser#27) Signed-off-by: Arunprasad Rajkumar <[email protected]>

* feat: use retryablehttp * feat: configure logger * feat(jar): increase retry wait * fix(jar): skip variables * test(jar): fix * feat: accept only 200 ok * feat(jar): suppress log messages

* changing base url to https * changing base url to https Co-authored-by: Sherif Fathalla <[email protected]> Co-authored-by: sherif <[email protected]>

Co-authored-by: Ankush K <[email protected]> Co-authored-by: Ankush K <[email protected]> Co-authored-by: Teppei Fukuda <[email protected]>

Co-authored-by: Teppei Fukuda <[email protected]>

…ep-parser#40) Co-authored-by: knqyf263 <[email protected]>

Co-authored-by: knqyf263 <[email protected]>

…290)

Signed-off-by: knqyf263 <[email protected]>

pkg/dependency/parser/io/io.go

nikpivkin

lgtm

DmitriyLewen

LGTM.
Left some small comments.

pkg/log/logger.go

pkg/dependency/parser/io/io.go

pkg/dependency/parser/java/jar/sonatype/sonatype.go

pkg/dependency/parser/types/types.go

Signed-off-by: knqyf263 <[email protected]>

DmitriyLewen

LGTM

Signed-off-by: knqyf263 <[email protected]>

knqyf263 · 2024-02-20T06:48:38Z

I was supposed to keep git history, but the Trivy project allows only "squash and merge". I accidentally lost history of go-dep-parser😭

knqyf263 and others added 30 commits April 29, 2019 10:47

Initial commit

a7c68fb

initial

0d39ee3

Add cargo parser (go-dep-parser#1)

619d607

add yarn parser (go-dep-parser#2)

0f776a9

delete debug lines and add comments (go-dep-parser#3)

96f76ad

fix yarn bug : start with @ package (go-dep-parser#4)

7c536d5

fixbug : parse private versioning yarn.lock (go-dep-parser#5)

fa272d4

Add poetry parser (go-dep-parser#6)

fcd9c64

Transfer repositoriy

461d09d

Merge pull request aquasecurity#8 from aquasecurity/transfer

03b7d94

Transfer repositoriy

test(cargo): make file names lower (go-dep-parser#11)

50f8b46

* test(cargo): to lower * test(cargo): to lower

chore(ci): add GitHub Actions (go-dep-parser#10)

8d6b5e4

fix(npm): handle deeply nested dependencies (go-dep-parser#15)

89c942c

add go.sum support (go-dep-parser#21)

9f3a81f

* add support for go.sum (go-dep-parser#20) * modify test cases * keep pseudo version * rewrite test with testify * simplify semver parsing * wrap errors * go mod tidy

feat: support go binary (go-dep-parser#19)

72ca3cc

Add yarn v2 lockfile compatibility (go-dep-parser#26)

9339f6f

* make parser compatible with yaml2 * Fix linting

fix(jar): return errors other than no artifact found error (go-dep-pa…

8969d06

…rser#28) * feat(JarParse) return errors other than no artifact found error * feat(JarParse) fix review: return error by search sha1 network error * fix(JarParse) change error message

fix: add an option to override http.Client used by jar parser (go-dep…

3dc02cd

…-parser#27) Signed-off-by: Arunprasad Rajkumar <[email protected]>

feat(jar): retry http accesses (go-dep-parser#29)

29319e0

* feat: use retryablehttp * feat: configure logger * feat(jar): increase retry wait * fix(jar): skip variables * test(jar): fix * feat: accept only 200 ok * feat(jar): suppress log messages

fix(gomod): skip an empty line (go-dep-parser#33)

13ae98f

gobinary: check first column to determine meaning (go-dep-parser#34)

5cb5abb

changing base url to https (go-dep-parser#36)

8464113

* changing base url to https * changing base url to https Co-authored-by: Sherif Fathalla <[email protected]> Co-authored-by: sherif <[email protected]>

add python/wheel support (go-dep-parser#24)

cc3ef3c

feat(python): support python requirements.txt (go-dep-parser#32)

cbaf5a3

Co-authored-by: Ankush K <[email protected]> Co-authored-by: Ankush K <[email protected]> Co-authored-by: Teppei Fukuda <[email protected]>

add python/egg support (go-dep-parser#23)

bddaa1c

Co-authored-by: Teppei Fukuda <[email protected]>

refactor(nuget): rename to nugetlock (go-dep-parser#42)

385a861

feat(library): add license field for lang-specific dependencies (go-d…

83efb4d

…ep-parser#40) Co-authored-by: knqyf263 <[email protected]>

Enhance nuget parser for packages.config (go-dep-parser#37)

8252711

Co-authored-by: knqyf263 <[email protected]>

DmitriyLewen and others added 5 commits February 2, 2024 14:50

fix(pnpm): use Name and Version fields if present (go-dep-parser#…

d47f6fa

…290)

feat(gradle): add dependency location support (go-dep-parser#291)

f98849f

prepare sub dir to integrate go-dep-parser

00315a5

Merge remote-tracking branch 'go-dep-parser/main' into go-dep-parser

6f37055

chore: merge go-dep-parser into Trivy

2cefec7

knqyf263 self-assigned this Feb 9, 2024

go mod tidy

4aa0e97

Signed-off-by: knqyf263 <[email protected]>

knqyf263 force-pushed the go-dep-parser branch from a0a0b49 to d947dfb Compare February 12, 2024 10:40

fix: lint errors

5ca4652

Signed-off-by: knqyf263 <[email protected]>

knqyf263 force-pushed the go-dep-parser branch from d947dfb to 5ca4652 Compare February 12, 2024 10:51

knqyf263 added 2 commits February 12, 2024 16:20

Merge branch 'main' into go-dep-parser

05285d1

Signed-off-by: knqyf263 <[email protected]>

fix(windows): replace filepath with path

2a51b75

knqyf263 marked this pull request as ready for review February 13, 2024 03:24

knqyf263 requested review from DmitriyLewen and nikpivkin February 13, 2024 03:24

knqyf263 mentioned this pull request Feb 13, 2024

fix(julia): fix parsing Julia v1.0 Manifests aquasecurity/go-dep-parser#292

Closed

nikpivkin reviewed Feb 13, 2024

View reviewed changes

pkg/dependency/parser/io/io.go Show resolved Hide resolved

nikpivkin approved these changes Feb 14, 2024

View reviewed changes

DmitriyLewen reviewed Feb 14, 2024

View reviewed changes

pkg/log/logger.go Outdated Show resolved Hide resolved

pkg/dependency/parser/io/io.go Show resolved Hide resolved

pkg/dependency/parser/java/jar/sonatype/sonatype.go Outdated Show resolved Hide resolved

pkg/dependency/parser/types/types.go Outdated Show resolved Hide resolved

knqyf263 added 2 commits February 14, 2024 14:29

chore(logger): fix a comment

906a149

Signed-off-by: knqyf263 <[email protected]>

refactor: remove unused consts

4783137

Signed-off-by: knqyf263 <[email protected]>

DmitriyLewen approved these changes Feb 14, 2024

View reviewed changes

Merge branch 'main' into go-dep-parser

5d83b1e

Signed-off-by: knqyf263 <[email protected]>

knqyf263 added this pull request to the merge queue Feb 19, 2024

Merged via the queue into aquasecurity:main with commit 74dc5b6 Feb 19, 2024
16 checks passed

knqyf263 deleted the go-dep-parser branch February 19, 2024 11:37

knqyf263 mentioned this pull request Feb 22, 2024

refactor: better integration of the parser into Trivy #6183

Merged

8 tasks

knqyf263 mentioned this pull request May 6, 2024

refactor: unify Library and Package structs #6633

Merged

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): merge go-dep-parser into Trivy #6094

chore(deps): merge go-dep-parser into Trivy #6094

knqyf263 commented Feb 9, 2024 •

edited

Loading

nikpivkin left a comment

DmitriyLewen left a comment

DmitriyLewen left a comment

knqyf263 commented Feb 20, 2024

chore(deps): merge go-dep-parser into Trivy #6094

chore(deps): merge go-dep-parser into Trivy #6094

Conversation

knqyf263 commented Feb 9, 2024 • edited Loading

Description

Issues

Checklist

nikpivkin left a comment

Choose a reason for hiding this comment

DmitriyLewen left a comment

Choose a reason for hiding this comment

DmitriyLewen left a comment

Choose a reason for hiding this comment

knqyf263 commented Feb 20, 2024

knqyf263 commented Feb 9, 2024 •

edited

Loading