Documentation
¶
Overview ¶
Package lockmode is the repo-mode analyzer shared by the PyPI and npm plugins: inventory a checkout's lock files, then decide advisories against what they declare.
It is one package rather than two evaluators because, unlike image mode, there is nothing ecosystem-specific left to reason about. Image mode has a site-packages layout and an import graph per language; a lock file has been reduced by internal/lockfile to a list of coordinates and a development flag, and every question repo mode can answer is a question about those two things. What still differs -- how a name is normalized, how a purl is spelled, what the packages are called in prose -- is data, and lives in Config.
The three answers it can give are the whole of repo mode:
named package absent from the lock files not_present, component_not_present present but declared development-only not_in_execute_path otherwise linked
The gap between that and image mode's table is the import graph, and it is not an oversight. Resolving a specifier needs an installed dependency tree, and materializing one means running the target's build -- arbitrary code from the thing being audited. Repo mode declines, and the "linked" row says out loud that no graph was resolved rather than letting the silence read as a weaker form of the same answer.
Index ¶
- func ParsePURL(s string) (name, typ string, ok bool)
- type Analyzer
- func (a Analyzer) Analyze(_ context.Context, _ *target.Source, items []ecosystem.WorkItem) ([]ecosystem.Finding, error)
- func (a Analyzer) Detect(_ context.Context, src *target.Source) (bool, error)
- func (a Analyzer) Inventory(_ context.Context, src *target.Source, subjects []ecosystem.Subject) ([]ecosystem.Component, error)
- func (a Analyzer) MethodDevOnly() string
- func (a Analyzer) MethodLockfile() string
- type Config
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Analyzer ¶
type Analyzer struct{ Config }
Analyzer implements the three phases of ecosystem.InventorySourceAnalyzer for one ecosystem.
func (Analyzer) Analyze ¶
func (a Analyzer) Analyze(_ context.Context, _ *target.Source, items []ecosystem.WorkItem) ([]ecosystem.Finding, error)
Analyze decides each work item.
func (Analyzer) Inventory ¶
func (a Analyzer) Inventory(_ context.Context, src *target.Source, subjects []ecosystem.Subject) ([]ecosystem.Component, error)
Inventory turns the checkout's lock files into components.
func (Analyzer) MethodDevOnly ¶
MethodDevOnly is the method name for the development-dependency partition.
func (Analyzer) MethodLockfile ¶
MethodLockfile is the method name for a conclusion drawn from the lock file contents alone.
type Config ¶
type Config struct {
// Owner is the plugin this analyzer serves, used to tell whether a subject
// was addressed to it.
Owner ecosystem.Plugin
// Ecosystem is the OSV ecosystem string ("PyPI", "npm").
Ecosystem string
// Format selects the lock file readers.
Format lockfile.Format
// Prefix names the methods this analyzer reports: "<prefix>-lockfile" and
// "<prefix>-dev-only".
Prefix string
// PURLType is the package-URL type this ecosystem owns ("pypi", "npm"),
// used to route a --package given as a purl.
PURLType string
// Normalize maps a name to the spelling OSV keys it on. PEP 503 for PyPI;
// identity for npm, which keys on the name verbatim, scope included.
Normalize func(string) string
// PURL renders a package URL for one coordinate.
PURL func(name, version string) string
Logf func(string, ...any)
}
Config is what one ecosystem has to supply.
Source Files