Feature/transitive require #678

avgkoster · 2023-10-27T12:23:26Z

Server:

Added support for branch selection when scanning the repository - gitBranch, specified along with other parameters in the request to /sbom
Fixed an error due to which the server did not process the GIT URL, added validation by URL type

JS analysis --required-only

Now, when using the --required-only parameter, if imports of transitives of potential required dependencies were found in the files, then such a dependency is considered required, its imports are also placed in occurrences
In required dependencies, occurrences now also come across imports of transitives from this dependency (additional enrichment)

…meter gitBranch for server 3. Fix Bug with set gitURL in server Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

This reverts commit 9ef6d8c. Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

prabhu · 2023-10-27T18:41:31Z

package.json

@@ -63,6 +63,7 @@
    "cheerio": "^1.0.0-rc.12",
    "edn-data": "^1.0.0",
    "find-up": "^6.3.0",
+    "git-url-parse": "^13.1.1",


Let's avoid this dependency altogether and remove the console.log

which console.log are we talking about?

prabhu · 2023-10-27T18:43:48Z

utils.test.js

@@ -1703,8 +1703,8 @@ test("parsePkgLock v3", async () => {
    projectName: "cdxgen"
  });
  deps = parsedList.pkgList;
-  expect(deps.length).toEqual(1204);
-  expect(parsedList.dependenciesList.length).toEqual(1204);
+  expect(deps.length).toEqual(1210);


Why is the count going up? Could you check if we are creating duplicates?

prabhu · 2023-10-29T12:49:39Z

Thank you. Could you kindly sign the commit by following the below instructions?

https://github.com/CycloneDX/cdxgen/pull/678/checks?check_run_id=18159669929

…meter gitBranch for server 3. Fix Bug with set gitURL in server Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

This reverts commit 9ef6d8c. Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

…ster/cdxgen into feature/transitive_require

Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

avgkoster · 2023-10-29T13:31:50Z

I had problems with commits, in order not to clog up the repository, I will close this PR and open a new one taking into account the review

avgkoster · 2023-10-29T13:55:06Z

#681 - new PR

prabhu · 2023-10-29T14:05:59Z

utils.js

+      if (impPkgs.includes(alias) || all_includes.length) {
+        let importedModules = new Set();
+        pkg.scope = "required";
+        for (const subevidence of all_includes) {


Wondering if we there is a way to avoid this nested loop. For large boms with 1000s of components this might be slow. wdyt?

To shorten the execution time, I think it is possible to make a condition under which, if we do not find direct imports in required dependencies, then only then try to look for sub-dependencies.
But I also think that displaying in occurrences all imports (even those where there were direct ones), and not just direct ones, can be useful.

avgkoster mentioned this pull request Oct 27, 2023

JavaScript analyzer does not output evidence if a transitive of direct is called #674

Closed

avgkoster and others added 9 commits October 27, 2023 18:52

1. Add analyze transitive dep in required components (js) 2. Add para…

e63501f

…meter gitBranch for server 3. Fix Bug with set gitURL in server Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

fix lint

96dfad6

Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

fix lint#2

56488ae

Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

fix lint CycloneDX#4

325529e

Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

last fix lint

8069a79

Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

add git-url-parse

78fd6c5

Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

fix server

3a599e7

Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

Revert "fix server"

aa9299a

This reverts commit 9ef6d8c. Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

Update utils.test.js, add new dep

7f00537

Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

avgkoster force-pushed the feature/transitive_require branch from a0b612f to 7f00537 Compare October 27, 2023 13:55

prabhu reviewed Oct 27, 2023

View reviewed changes

avgkoster added 2 commits October 29, 2023 17:42

Removed gir-url parse pkg, remove parsedUrl in console.log

11b5e0f

Del unused dep, fix lint

0abeddc

avgkoster and others added 13 commits October 29, 2023 17:53

1. Add analyze transitive dep in required components (js) 2. Add para…

0ef02cf

…meter gitBranch for server 3. Fix Bug with set gitURL in server Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

fix lint

802de1d

Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

fix lint#2

631744d

Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

fix lint CycloneDX#4

744985b

Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

last fix lint

a8bdb50

Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

add git-url-parse

72428f4

Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

fix server

d42e8a9

Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

Revert "fix server"

2581787

This reverts commit 9ef6d8c. Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

Update utils.test.js, add new dep

eda2560

Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

Removed gir-url parse pkg, remove parsedUrl in console.log

c326fb1

Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

Del unused dep, fix lint

8344f61

Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

Merge branch 'feature/transitive_require' of https://github.com/avgko…

ce3e8dc

…ster/cdxgen into feature/transitive_require

fix deps, lint

7a8a65a

Signed-off-by: Konstantin Ruzavin <36166921+avgkoster@users.noreply.github.com>

avgkoster closed this Oct 29, 2023

avgkoster mentioned this pull request Oct 29, 2023

fix required-only,add girBranch to server #681

Merged

prabhu reviewed Oct 29, 2023

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature/transitive require #678

Feature/transitive require #678

avgkoster commented Oct 27, 2023 •

edited

Loading

prabhu Oct 27, 2023

avgkoster Oct 27, 2023

prabhu Oct 27, 2023

prabhu commented Oct 29, 2023

avgkoster commented Oct 29, 2023 •

edited

Loading

avgkoster commented Oct 29, 2023

prabhu Oct 29, 2023

avgkoster Oct 29, 2023

Feature/transitive require #678

Feature/transitive require #678

Conversation

avgkoster commented Oct 27, 2023 • edited Loading

prabhu Oct 27, 2023

Choose a reason for hiding this comment

avgkoster Oct 27, 2023

Choose a reason for hiding this comment

prabhu Oct 27, 2023

Choose a reason for hiding this comment

prabhu commented Oct 29, 2023

avgkoster commented Oct 29, 2023 • edited Loading

avgkoster commented Oct 29, 2023

prabhu Oct 29, 2023

Choose a reason for hiding this comment

avgkoster Oct 29, 2023

Choose a reason for hiding this comment

avgkoster commented Oct 27, 2023 •

edited

Loading

avgkoster commented Oct 29, 2023 •

edited

Loading