Repository navigation
Classify scope from the declared root and from syft lock entries - #25
Conversation
ClassifyScope took any node with dependencies and no dependents as a root. For a lock file that doesn't list the project, such as poetry.lock, that made the top-level dependencies roots, so they dropped out and their dependencies were reported as direct. The CycloneDX metadata.component bom-ref is now kept as Document.Component.ID. A declared root (that or a DESCRIBES target) with dependency edges is the only root. Without one, roots are inferred as before, except that packages syft records as coming from poetry.lock, pdm.lock, pnpm-lock.yaml or a yarn v1 yarn.lock are direct dependencies rather than roots. Roots reports the root IDs and whether they were declared. Fixes git-pkgs#23
syft writes SPDX dependency edges as DEPENDENCY_OF, which the parser kept as they were, so ClassifyScope found no graph. The SPDX parsers now normalise "B DEPENDENCY_OF A" to "A DEPENDS_ON B", as the README already said they normalise dependency edges. PackageSourceInfo is kept as Package.SourceInfo, and the lock file detection reads the path at its end when there is no syft location property, so it works for syft's SPDX output too. It now goes by the lock file's name for both formats rather than syft's metadata type.
andrew
left a comment
andrew
left a comment
There was a problem hiding this comment.
Please correct the Roots() declaration flag and add regression coverage for explicitly declared roots without outgoing dependency edges.
| roots[id] = true | ||
| } | ||
| } | ||
| return roots, top, false |
There was a problem hiding this comment.
This returns declared=false even when every returned root is explicitly declared. For example, parsing an SPDX document with DOCUMENT DESCRIBES app and no dependency edges makes Roots() return ([app], false). The supplied Poetry fixtures also return only the declared directory root with false after the lock-file heuristic excludes the inferred dependency roots. Callers therefore cannot use the flag to identify the declared project as documented. Please derive the flag from the returned roots and add regression tests for these cases.
There was a problem hiding this comment.
Fixed in 9dced53. declared is now true when every returned root is declared, so a DESCRIBES target without edges gives ([app], true), and so do the poetry, pdm, pnpm and yarn v1 fixtures. A declared root next to an inferred one still gives false. Added tests for the SPDX case and the mixed case, and the syft fixtures now check the flag.
Roots returned declared=false whenever the declared root had no edges of its own, even when no other root was inferred: an SPDX document that only DESCRIBES the app, or syft's output for a poetry, pdm, pnpm or yarn v1 lock file, where the scanned directory is the only root. The flag now says whether every returned root is declared.
|
Thanks, fixed the |
A top-level dependency without dependencies of its own appears in no DEPENDS_ON edge, so it was never inferred as a root and got no scope. In a lock file that leaves the project out, such a package is a direct dependency. It is classified so only when other packages of its lock file have edges, so a lock file the graph leaves out stays unclassified.
|
One more case in da468b1, found with syft 1.55.0: a top-level dependency with no dependencies of its own ( I also checked a monorepo with two |
Fixes #23.
Document.Component.IDkeeps the CycloneDXmetadata.componentbom-ref (and is written back byEncode).DESCRIBEStarget, hasDEPENDS_ONedges, it is the only root. Other nodes without dependents are no longer taken as roots.syft:location:0:pathproperty in CycloneDX, the path endingPackageSourceInfoin SPDX. I ran syft 1.55.0 over a small project per lock format:yarn v1 and berry both write
yarn.lock, so one that has a berry workspace entry (version0.0.0-use.local) is left to inference.DEPENDENCY_OF, which the parser kept as they were, soClassifyScopereturned an empty map for every syft SPDX document. Both SPDX parsers now normaliseB DEPENDENCY_OF AtoA DEPENDS_ON B, as the README already says they normalise dependency edges.PackageSourceInfois kept asPackage.SourceInfo.Roots()returns the root IDs and whether they were declared, so a caller can tell the project from an inferred root. The README describes all of this.The syft outputs, CycloneDX and SPDX, are in
testdata/*/syft-lock. The projectless cases fail without the change in both formats, and every SPDX case did before.