-
Notifications
You must be signed in to change notification settings - Fork 2.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(go): construct dependencies of go.mod main module in the parser
#7977
Merged
+278
−68
Merged
Changes from 2 commits
Commits
Show all changes
6 commits
Select commit
Hold shift + click to select a range
ce05479
feat(gomod): construct deps for root pkg in parser
DmitriyLewen 2334f56
test: update broken tests
DmitriyLewen 29d73fb
refactor: don't check len(dependsOn)
DmitriyLewen 795f913
feat: handle orphan indirect depenencies
knqyf263 ef467df
fix(vex): add fail-safe
knqyf263 af615d1
fix: lint issues
knqyf263 File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -20,12 +20,6 @@ var ( | |
| }, | ||
| }, | ||
| }, | ||
| { | ||
| ID: "[email protected]", | ||
| Name: "stdlib", | ||
| Version: "v1.22.5", | ||
| Relationship: ftypes.RelationshipDirect, | ||
| }, | ||
| { | ||
| ID: "github.com/aquasecurity/[email protected]", | ||
| Name: "github.com/aquasecurity/go-version", | ||
|
|
@@ -38,6 +32,12 @@ var ( | |
| }, | ||
| }, | ||
| }, | ||
| { | ||
| ID: "[email protected]", | ||
| Name: "stdlib", | ||
| Version: "v1.22.5", | ||
| Relationship: ftypes.RelationshipDirect, | ||
| }, | ||
| { | ||
| ID: "github.com/davecgh/[email protected]", | ||
| Name: "github.com/davecgh/go-spew", | ||
|
|
@@ -82,10 +82,29 @@ var ( | |
| }, | ||
| } | ||
|
|
||
| GoModNormalDeps = ftypes.Dependencies{ | ||
| { | ||
| ID: "github.com/org/repo", | ||
| DependsOn: []string{ | ||
| "github.com/aquasecurity/[email protected]", | ||
| "[email protected]", | ||
| }, | ||
| }, | ||
| } | ||
|
|
||
| GoModNormalWithoutStdlib = slices.DeleteFunc(slices.Clone(GoModNormal), func(f ftypes.Package) bool { | ||
| return f.Name == "stdlib" | ||
| }) | ||
|
|
||
| GoModNormalWithoutStdlibDeps = ftypes.Dependencies{ | ||
| { | ||
| ID: "github.com/org/repo", | ||
| DependsOn: []string{ | ||
| "github.com/aquasecurity/[email protected]", | ||
| }, | ||
| }, | ||
| } | ||
|
|
||
| // execute go mod tidy in replaced folder | ||
| GoModReplaced = []ftypes.Package{ | ||
| { | ||
|
|
@@ -118,6 +137,14 @@ var ( | |
| Relationship: ftypes.RelationshipIndirect, | ||
| }, | ||
| } | ||
| GoModReplacedDeps = ftypes.Dependencies{ | ||
| { | ||
| ID: "github.com/org/repo", | ||
| DependsOn: []string{ | ||
| "github.com/aquasecurity/[email protected]", | ||
| }, | ||
| }, | ||
| } | ||
|
|
||
| // execute go mod tidy in replaced folder | ||
| GoModUnreplaced = []ftypes.Package{ | ||
|
|
@@ -152,6 +179,15 @@ var ( | |
| }, | ||
| } | ||
|
|
||
| GoModUnreplacedDeps = ftypes.Dependencies{ | ||
| { | ||
| ID: "github.com/org/repo", | ||
| DependsOn: []string{ | ||
| "github.com/aquasecurity/[email protected]", | ||
| }, | ||
| }, | ||
| } | ||
|
|
||
| // execute go mod tidy in replaced-with-version folder | ||
| GoModReplacedWithVersion = []ftypes.Package{ | ||
| { | ||
|
|
@@ -185,6 +221,15 @@ var ( | |
| }, | ||
| } | ||
|
|
||
| GoModReplacedWithVersionDeps = ftypes.Dependencies{ | ||
| { | ||
| ID: "github.com/org/repo", | ||
| DependsOn: []string{ | ||
| "github.com/aquasecurity/[email protected]", | ||
| }, | ||
| }, | ||
| } | ||
|
|
||
| // execute go mod tidy in replaced-with-version-mismatch folder | ||
| GoModReplacedWithVersionMismatch = []ftypes.Package{ | ||
| { | ||
|
|
@@ -230,6 +275,15 @@ var ( | |
| }, | ||
| } | ||
|
|
||
| defaultGoDepParserDeps = ftypes.Dependencies{ | ||
| { | ||
| ID: "github.com/org/repo", | ||
| DependsOn: []string{ | ||
| "github.com/aquasecurity/[email protected]", | ||
| }, | ||
| }, | ||
| } | ||
|
|
||
| // execute go mod tidy in replaced-with-local-path folder | ||
| GoModReplacedWithLocalPath = []ftypes.Package{ | ||
| { | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -36,6 +36,9 @@ func Test_gomodAnalyzer_Analyze(t *testing.T) { | |
| ID: "github.com/org/repo", | ||
| Name: "github.com/org/repo", | ||
| Relationship: types.RelationshipRoot, | ||
| DependsOn: []string{ | ||
| "github.com/aquasecurity/[email protected]", | ||
| }, | ||
| ExternalReferences: []types.ExternalRef{ | ||
| { | ||
| Type: types.RefVCS, | ||
|
|
@@ -86,6 +89,9 @@ func Test_gomodAnalyzer_Analyze(t *testing.T) { | |
| ID: "github.com/org/repo", | ||
| Name: "github.com/org/repo", | ||
| Relationship: types.RelationshipRoot, | ||
| DependsOn: []string{ | ||
| "github.com/sad/[email protected]", | ||
| }, | ||
| ExternalReferences: []types.ExternalRef{ | ||
| { | ||
| Type: types.RefVCS, | ||
|
|
@@ -126,6 +132,9 @@ func Test_gomodAnalyzer_Analyze(t *testing.T) { | |
| ID: "github.com/org/repo", | ||
| Name: "github.com/org/repo", | ||
| Relationship: types.RelationshipRoot, | ||
| DependsOn: []string{ | ||
| "github.com/aquasecurity/[email protected]", | ||
| }, | ||
| ExternalReferences: []types.ExternalRef{ | ||
| { | ||
| Type: types.RefVCS, | ||
|
|
@@ -178,6 +187,9 @@ func Test_gomodAnalyzer_Analyze(t *testing.T) { | |
| ID: "github.com/org/repo", | ||
| Name: "github.com/org/repo", | ||
| Relationship: types.RelationshipRoot, | ||
| DependsOn: []string{ | ||
| "github.com/aquasecurity/[email protected]", | ||
| }, | ||
| ExternalReferences: []types.ExternalRef{ | ||
| { | ||
| Type: types.RefVCS, | ||
|
|
||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Since we need to put empty elements in CycloneDX, shouldn't we include this relationship regardless of whether
len(dependsOn)is empty?https://cyclonedx.org/docs/1.6/json/#dependencies
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There is no difference now .
pkg.DependsOnwill benil(withlen(dependsOn) > 0check) or empty slice (without this check):trivy/pkg/fanal/analyzer/language/analyze.go
Line 103 in 1f5f348
When we add relationships in BOM core - we just check length of
DependsOnfield:trivy/pkg/sbom/io/encode.go
Lines 249 to 261 in 5dd94eb
But it can help with
TODO: Should check if the component has actually no dependencies or the dependency graph is not supported..empty slice - pkg supports dependency graph, but doesn't have dependencies.
nil - pkg doesn't support dependency graph.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
updated in 29d73fb