Skip to content

Commit 6343e4f

Browse files
knqyf263knqyf263
authored
feat: add relationships (aquasecurity#6563)
Signed-off-by: knqyf263 <[email protected]>
1 parent a018ee1 commit 6343e4f

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

65 files changed

+4349
-2243
lines changed

‎integration/testdata/composer.lock.json.golden‎

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎integration/testdata/conan.json.golden‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@
2929
},
3030
"Version": "1.0.8",
3131
"Indirect": true,
32+
"Relationship": "indirect",
3233
"Layer": {},
3334
"Locations": [
3435
{
@@ -45,6 +46,7 @@
4546
},
4647
"Version": "2.4.8",
4748
"Indirect": true,
49+
"Relationship": "indirect",
4850
"Layer": {},
4951
"Locations": [
5052
{
@@ -61,6 +63,7 @@
6163
},
6264
"Version": "1.1.1q",
6365
"Indirect": true,
66+
"Relationship": "indirect",
6467
"Layer": {},
6568
"Locations": [
6669
{
@@ -77,6 +80,7 @@
7780
},
7881
"Version": "8.43",
7982
"Indirect": true,
83+
"Relationship": "indirect",
8084
"DependsOn": [
8185
"bzip2/1.0.8",
8286
"zlib/1.2.12"
@@ -96,6 +100,7 @@
96100
"PURL": "pkg:conan/[email protected]"
97101
},
98102
"Version": "1.9.4",
103+
"Relationship": "direct",
99104
"DependsOn": [
100105
"pcre/8.43",
101106
"zlib/1.2.12",
@@ -119,6 +124,7 @@
119124
},
120125
"Version": "3.39.2",
121126
"Indirect": true,
127+
"Relationship": "indirect",
122128
"Layer": {},
123129
"Locations": [
124130
{
@@ -135,6 +141,7 @@
135141
},
136142
"Version": "1.2.12",
137143
"Indirect": true,
144+
"Relationship": "indirect",
138145
"Layer": {},
139146
"Locations": [
140147
{

‎integration/testdata/npm-with-dev.json.golden‎

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,6 @@
2828
"PURL": "pkg:npm/[email protected]"
2929
},
3030
"Version": "2.0.6",
31-
"Indirect": true,
3231
"Layer": {},
3332
"Locations": [
3433
{
@@ -47,7 +46,6 @@
4746
"Licenses": [
4847
"MIT"
4948
],
50-
"Indirect": true,
5149
"Layer": {},
5250
"Locations": [
5351
{
@@ -63,7 +61,6 @@
6361
"PURL": "pkg:npm/[email protected]"
6462
},
6563
"Version": "4.0.0",
66-
"Indirect": true,
6764
"Layer": {},
6865
"Locations": [
6966
{
@@ -79,7 +76,6 @@
7976
"PURL": "pkg:npm/[email protected]"
8077
},
8178
"Version": "1.4.0",
82-
"Indirect": true,
8379
"DependsOn": [
8480
"[email protected]"
8581
],
@@ -98,7 +94,6 @@
9894
"PURL": "pkg:npm/[email protected]"
9995
},
10096
"Version": "4.1.1",
101-
"Indirect": true,
10297
"Layer": {},
10398
"Locations": [
10499
{
@@ -117,7 +112,6 @@
117112
"Licenses": [
118113
"MIT"
119114
],
120-
"Indirect": true,
121115
"DependsOn": [
122116
"[email protected]"
123117
],
@@ -136,7 +130,6 @@
136130
"PURL": "pkg:npm/[email protected]"
137131
},
138132
"Version": "15.7.2",
139-
"Indirect": true,
140133
"DependsOn": [
141134
"[email protected]",
142135
"[email protected]",
@@ -160,7 +153,6 @@
160153
"Licenses": [
161154
"MIT"
162155
],
163-
"Indirect": true,
164156
"DependsOn": [
165157
"[email protected]",
166158
"[email protected]",
@@ -185,7 +177,6 @@
185177
"Licenses": [
186178
"MIT"
187179
],
188-
"Indirect": true,
189180
"Layer": {},
190181
"Locations": [
191182
{
@@ -204,7 +195,6 @@
204195
"Licenses": [
205196
"MIT"
206197
],
207-
"Indirect": true,
208198
"DependsOn": [
209199
"[email protected]",
210200
"[email protected]"
@@ -224,7 +214,6 @@
224214
"PURL": "pkg:npm/[email protected]"
225215
},
226216
"Version": "0.13.6",
227-
"Indirect": true,
228217
"DependsOn": [
229218
"[email protected]",
230219
"[email protected]"
@@ -244,7 +233,6 @@
244233
"PURL": "pkg:npm/[email protected]"
245234
},
246235
"Version": "1.2.0",
247-
"Indirect": true,
248236
"Layer": {},
249237
"Locations": [
250238
{
@@ -264,7 +252,6 @@
264252
"Licenses": [
265253
"MIT"
266254
],
267-
"Indirect": true,
268255
"Layer": {},
269256
"Locations": [
270257
{

‎integration/testdata/npm.json.golden‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,6 @@
2828
"PURL": "pkg:npm/[email protected]"
2929
},
3030
"Version": "2.0.6",
31-
"Indirect": true,
3231
"Layer": {},
3332
"Locations": [
3433
{
@@ -47,7 +46,6 @@
4746
"Licenses": [
4847
"MIT"
4948
],
50-
"Indirect": true,
5149
"Layer": {},
5250
"Locations": [
5351
{
@@ -63,7 +61,6 @@
6361
"PURL": "pkg:npm/[email protected]"
6462
},
6563
"Version": "4.0.0",
66-
"Indirect": true,
6764
"Layer": {},
6865
"Locations": [
6966
{
@@ -79,7 +76,6 @@
7976
"PURL": "pkg:npm/[email protected]"
8077
},
8178
"Version": "1.4.0",
82-
"Indirect": true,
8379
"DependsOn": [
8480
"[email protected]"
8581
],
@@ -98,7 +94,6 @@
9894
"PURL": "pkg:npm/[email protected]"
9995
},
10096
"Version": "4.1.1",
101-
"Indirect": true,
10297
"Layer": {},
10398
"Locations": [
10499
{
@@ -117,7 +112,6 @@
117112
"Licenses": [
118113
"MIT"
119114
],
120-
"Indirect": true,
121115
"DependsOn": [
122116
"[email protected]"
123117
],
@@ -136,7 +130,6 @@
136130
"PURL": "pkg:npm/[email protected]"
137131
},
138132
"Version": "15.7.2",
139-
"Indirect": true,
140133
"DependsOn": [
141134
"[email protected]",
142135
"[email protected]",
@@ -160,7 +153,6 @@
160153
"Licenses": [
161154
"MIT"
162155
],
163-
"Indirect": true,
164156
"DependsOn": [
165157
"[email protected]",
166158
"[email protected]",
@@ -185,7 +177,6 @@
185177
"Licenses": [
186178
"MIT"
187179
],
188-
"Indirect": true,
189180
"Layer": {},
190181
"Locations": [
191182
{
@@ -204,7 +195,6 @@
204195
"Licenses": [
205196
"MIT"
206197
],
207-
"Indirect": true,
208198
"DependsOn": [
209199
"[email protected]",
210200
"[email protected]"
@@ -224,7 +214,6 @@
224214
"PURL": "pkg:npm/[email protected]"
225215
},
226216
"Version": "0.13.6",
227-
"Indirect": true,
228217
"DependsOn": [
229218
"[email protected]",
230219
"[email protected]"
@@ -244,7 +233,6 @@
244233
"PURL": "pkg:npm/[email protected]"
245234
},
246235
"Version": "1.2.0",
247-
"Indirect": true,
248236
"Layer": {},
249237
"Locations": [
250238
{

‎integration/testdata/nuget.json.golden‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
"PURL": "pkg:nuget/[email protected]"
2929
},
3030
"Version": "12.0.3",
31+
"Relationship": "direct",
3132
"Layer": {},
3233
"Locations": [
3334
{
@@ -43,6 +44,7 @@
4344
"PURL": "pkg:nuget/[email protected]"
4445
},
4546
"Version": "5.7.0",
47+
"Relationship": "direct",
4648
"DependsOn": [
4749
"[email protected]"
4850
],

‎integration/testdata/poetry.json.golden‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
"PURL": "pkg:pypi/[email protected]"
2929
},
3030
"Version": "8.1.3",
31+
"Relationship": "direct",
3132
"DependsOn": [
3233
"[email protected]"
3334
],
@@ -41,6 +42,7 @@
4142
},
4243
"Version": "0.4.6",
4344
"Indirect": true,
45+
"Relationship": "indirect",
4446
"Layer": {}
4547
},
4648
{
@@ -50,6 +52,7 @@
5052
"PURL": "pkg:pypi/[email protected]"
5153
},
5254
"Version": "0.14",
55+
"Relationship": "direct",
5356
"Layer": {}
5457
}
5558
],

‎integration/testdata/pom-cyclonedx.json.golden‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,8 +91,7 @@
9191
{
9292
"ref": "3ff14136-e09f-4df9-80ea-000000000002",
9393
"dependsOn": [
94-
"pkg:maven/com.example/[email protected]",
95-
"pkg:maven/com.fasterxml.jackson.core/[email protected]"
94+
"pkg:maven/com.example/[email protected]"
9695
]
9796
},
9897
{

‎integration/testdata/pubspec.lock.json.golden‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
"PURL": "pkg:pub/[email protected]"
2929
},
3030
"Version": "0.13.2",
31+
"Relationship": "direct",
3132
"Layer": {}
3233
},
3334
{
@@ -38,6 +39,7 @@
3839
},
3940
"Version": "1.3.1",
4041
"Indirect": true,
42+
"Relationship": "indirect",
4143
"Layer": {}
4244
}
4345
],

‎integration/testdata/yarn.json.golden‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
"Licenses": [
3232
"MIT"
3333
],
34+
"Relationship": "direct",
3435
"Layer": {},
3536
"Locations": [
3637
{

‎pkg/dependency/parser/c/conan/parse.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"strings"
66

77
"github.com/liamg/jfather"
8+
"github.com/samber/lo"
89
"golang.org/x/exp/slices"
910
"golang.org/x/xerrors"
1011

@@ -70,7 +71,7 @@ func (p *Parser) Parse(r xio.ReadSeekerAt) ([]types.Library, []types.Dependency,
7071

7172
// Determine if the package is a direct dependency or not
7273
direct := slices.Contains(directDeps, i)
73-
lib.Indirect = !direct
74+
lib.Relationship = lo.Ternary(direct, types.RelationshipDirect, types.RelationshipIndirect)
7475

7576
parsed[i] = lib
7677
}

0 commit comments

Comments
 (0)