Repository navigation
Batch: 2 fixes, one commit each - #49
Merged
Merged
Conversation
…ements/dev.txt, as a scan of its directory reads it, instead of refusing it as an unsupported manifest file (#47) For a requirements/dev.txt holding "-r requirements.txt" and "paramiko>=3.0", cryptodeps analyze requirements/dev.txt --offline exited 2 with "Error: analysis failed: unsupported manifest file: dev.txt", with and without --no-workspaces, while cryptodeps analyze . --offline read the same file. DetectAndParse, which reads a file passed as the argument, chose the parser from the file's name alone, while a scan of a directory chooses it from the path, which knows the requirements/ layout. DetectAndParse now uses the path lookup as well. When no parser matches, the path lookup returns the name lookup's error, so docs/notes.txt and x/Cargo.toml are still refused with "unsupported manifest file: notes.txt" and "unsupported manifest file: Cargo.toml", and exit 2. The scan of the file now lists paramiko and the unread -r line, its JSON report differs from the report for the scan of the directory only in timestamps and paths, and both exit 1. Fixes #47
… when reading dependencies, so "cryptography==42.0.0 \" with a --hash line after it has the version 42.0.0 (#48) pip reads a line that ends in a backslash together with the next line, so a requirements.txt holding "cryptography==42.0.0 \" and " --hash=sha256:..." on two lines pins cryptography 42.0.0. The dependency parser read one physical line at a time, so analyze --offline --format json reported "version": "42.0.0 \\" and the table printed cryptography@42.0.0 \. Dependencies are now read from the lines the unread-lines reader reads, with continued lines joined as pip joins them and numbered by their first line, and a requirement ends at its first per-requirement option, such as --hash. pip 26.0 ends it at the first space-separated token that begins with "-"; a tab before such a token ends it here too. That file now reports version 42.0.0 at line 1, its JSON output differs only in the version and timestamps, and the exit code is 1 before and after. The same cut leaves a --hash on the requirement's own line out of the version, which was "42.0.0 --hash=sha256:...". An -r line or a name @ URL line continued onto the next line is skipped as a whole: "-r \" followed by extra.txt was also read as a dependency named extra with the version .txt, and "paramiko @ \" followed by a URL as paramiko with the version "@ \". Both stay listed in unreadLines, unchanged. For testdata/fixtures/python-project the table output, and the JSON output apart from timestamps, are the same before and after. Fixes #48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request lands 2 commits in
internal/manifestandCHANGELOG.md.Included
Verified on this exact tree
go build ./...: exit 0go vet ./...: exit 0gofmt -l cmd internal pkg: no files listedgolangci-lint run ./...(golangci-lint 2.12.2): exit 3,can't load config: unsupported version of the configuration: ""golangci-lint run -c <copy of .golangci.yml converted by golangci-lint migrate> ./...: 8 issues (staticcheck: 8); the same command onorigin/main(c263b32): 8 issues (staticcheck: 8), the same 8 check IDs in the same filesgo test -json -race -p 4 -count=1 -coverprofile=<temporary file> ./...: exit 0; 16 packages, 13okand 3 with no test filesTestIntegration_FetchPyPIPackage(internal/analyzer/source), outputpip not available, skipping testNot included
None
Closes
Fixes #47
Fixes #48
How to merge
Rebase and merge, so that each change stays its own commit on
main.