Enable conan support #781
Enable conan support #781
Conversation
github-actions
bot
removed
the
safe to test
github-actions
bot
removed
the
safe to test
| } | ||
|
|
||
| func (conan *ConanPackageHandler) installConanDependencies(conanFile string) (err error) { | ||
| commandArgs := []string{"install", conanFile, "--build=missing"} |
There was a problem hiding this comment.
Before installing Conan dependencies with a default command we must check if an Install command was provided by the user (it is found in auditParams if exist), and if so- we should run it instead of the default command (since it might not work)
| if err = conan.updateConanFile(conanFileTxt, vulnDetails); err != nil { | ||
| return | ||
| } | ||
| return conan.installConanDependencies(conanFileTxt) |
There was a problem hiding this comment.
Why do we have to install after fixing the descriptor? Installation always comes with a risk of failure. Can't we just update the descriptor?
| if err = conan.updateConanFile(conanFilePy, vulnDetails); err != nil { | ||
| return | ||
| } | ||
| return conan.installConanDependencies(conanFilePy) |
There was a problem hiding this comment.
Why do we have to install after fixing the descriptor? Installation always comes with a risk of failure. Can't we just update the descriptor?
| return | ||
| } | ||
|
|
||
| func (conan *ConanPackageHandler) installConanDependencies(conanFile string) (err error) { |
There was a problem hiding this comment.
Before running an install command we must check if we should resolve dependencies from Artifactory. if a deps_repo was provided we must configure Artifactory along with this deps repo and the registry we resolve from
orto17
added
the
safe to test
github-actions
bot
removed
the
safe to test
orto17
added
the
safe to test
github-actions
bot
removed
the
safe to test
| return fmt.Errorf("impacted package %s not found, fix failed", vulnDetails.ImpactedDependencyName) | ||
| } | ||
| if err = os.WriteFile(conanFileName, []byte(fixedFile), 0600); err != nil { | ||
| err = fmt.Errorf("an error occured while writing the fixed version of %s to the requirements file:\n%s", vulnDetails.ImpactedDependencyName, err.Error()) |
There was a problem hiding this comment.
| err = fmt.Errorf("an error occured while writing the fixed version of %s to the requirements file:\n%s", vulnDetails.ImpactedDependencyName, err.Error()) | |
| err = fmt.Errorf("an error occured while writing the fixed version of %s to the requirements file '%s': %s", conanFileName, vulnDetails.ImpactedDependencyName, err.Error()) |
github-actions
bot
removed
the
safe to test
github-actions
bot
removed
the
safe to test
|
📦 Vulnerable Dependencies✍️ Summary
🔬 Research DetailsDescription: |
This PR includes support of conan requirements file update. It does not support installation of the suggested fixes. In order to update the dependencies, the user should run a 'conan install' command with the suggested conan file..