Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

python language support #122

Merged
merged 19 commits into from
Mar 4, 2020
Merged

python language support #122

merged 19 commits into from
Mar 4, 2020

Conversation

hdonnay
Copy link
Member

@hdonnay hdonnay commented Feb 17, 2020

This PR adds support for scanning and matching python packages.

@hdonnay hdonnay force-pushed the hank/pip branch 2 times, most recently from 0e4e937 to 5a78d3b Compare February 18, 2020 15:58
Copy link
Contributor

@ldelossa ldelossa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lots o' questions - didnt dig into the actual versioning stuff - took a high level look at changes.

Makefile Show resolved Hide resolved
alpine/packagescanner.go Outdated Show resolved Hide resolved
indexreport.go Outdated Show resolved Hide resolved
indexreport.go Outdated Show resolved Hide resolved
internal/indexer/controller/controller.go Outdated Show resolved Hide resolved
internal/indexer/postgres/teststore.go Show resolved Hide resolved
internal/matcher/controller.go Show resolved Hide resolved
internal/matcher/controller.go Show resolved Hide resolved
internal/matcher/controller.go Outdated Show resolved Hide resolved
internal/vulnstore/postgres/get.go Outdated Show resolved Hide resolved
@hdonnay hdonnay marked this pull request as ready for review February 28, 2020 22:22
@ldelossa ldelossa changed the title python lanauge support python language support Mar 2, 2020
Copy link
Contributor

@ldelossa ldelossa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think some docs are in order for this PR as some new features have been added. The docs should reflect how a developer can go about using the new custom versioning type in their own code, what it means to be "authoritative" and any changes to the current matching flow should be expressed.

@@ -147,9 +147,13 @@ func (f *fetcher) fetch(ctx context.Context, layer *claircore.Layer) error {
br := bufio.NewReader(tr)
// Look at the content-type and optionally fix it up.
ct := resp.Header.Get("content-type")
log.Debug().
Str("content-type", ct).
Msg("reported content-type")
switch {
case ct == "" ||
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: single case switch statement is equivalent to "if" with more code.

Copy link
Contributor

@ldelossa ldelossa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This review covers the Version/Range implementation and Python support.

var buf strings.Builder
b := make([]byte, 0, 16) // 16 byte wide scratch buffer

buf.WriteByte('{')
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not love that this code exists here, as it feels like something the Range type should provide. However I understand the placement here since this is the "postgres" representation of the data.

What if we use a defined type:

type PGRange claircore.Range

func (r *PGRange) String() {
...
}

This cleans up the code, keeps the string representation in the pg package, and the method set on this defined type only contains the string() method.

v := &record.Package.NormalizedVersion
var lit strings.Builder
b := make([]byte, 0, 16)
lit.WriteString("'{")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A defined type on "Version" can remove this builder code from the body of the query code.

"github.com/quay/claircore/test"
)

func Test_GetQueryBuilder_Deterministic_Args(t *testing.T) {
const (
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

much better 👍

//
// The Dev revision is promoted earlier in the int slice if there's no Pre or
// Post revision, and sorts as earlier than a Pre revision.
func (v *Version) Version() (c claircore.Version) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: methods which transform type from one package to another I see normally named "ToVersion" or "ToCCVersion" There's a bit of overloading of this term.

//
// The result will be 0 if a==b, -1 if a < b, and +1 if a > b. If the Versions
// are of different kinds, the Kinds will be compared lexographically.
func (v *Version) Compare(x *Version) int {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we hardcode a compare method, what is the point of having "kind" on our Version? We are essentially hard coding one "kind" a "kind" that sorts linearly from 0-9

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The point of kind is so that application code can ensure it's making not making nonsensical comparisons, like trying to compare a pep440 version with an rpm version, as they may encode differently.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not understand how something can encode differently, but still use this compare method which infers encoding.

python/ecosystem.go Show resolved Hide resolved
}
}

func NewCoalescer(_ context.Context) (indexer.Coalescer, error) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: separate file.

python/ecosystem.go Show resolved Hide resolved
@@ -19,7 +19,8 @@ func (*Matcher) Name() string {

// Filter implements driver.Matcher.
func (*Matcher) Filter(record *claircore.IndexRecord) bool {
return record.Distribution.DID == "rhel"
return record.Distribution != nil &&
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why this random change and only for rhel?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It was the only instance I ran into while testing.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

makes me a bit skeptical that it maybe an issue somewhere else, maybe just confirm its not.

_ driver.VersionFilter = (*Matcher)(nil)
)

// Matcher attempts to
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Incomplete comment

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

will fix

Copy link
Contributor

@ldelossa ldelossa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@hdonnay hdonnay merged commit ad81962 into master Mar 4, 2020
@hdonnay hdonnay deleted the hank/pip branch March 4, 2020 20:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

3 participants