feat: verify whether the reported repository can be linked back to the artifact #873
Conversation
oracle-contributor-agreement
bot
added
the
OCA Verified
|
The core part is added as "repo_verifier" under "repo_finder". |
Can you please add this information to the PR description? |
|
@behnazh-w thanks for the comments! I'll apply the changes by EOD. |
| return True | ||
|
|
||
| @staticmethod | ||
| def _bfs_walk(root_dir: Path, filename: str) -> Path | None: |
There was a problem hiding this comment.
You can probably use the get_build_dirs function in build tools. You might just need to improve it to avoid looking into the ["test", "example", "sample", "doc", "demo", "spec", "mock"] directories as implemented in this function.
There was a problem hiding this comment.
Interesting. Yes, I that's the correct funciton to be used here. Thanks!
There was a problem hiding this comment.
I decided to keep this for now (with another name find_file_in_repo under repo_verifier_base) because the amount of refactoring needed to make use of those functions for this purpose seems to be quite high.
There was a problem hiding this comment.
OK, no worries. Can you please add a TODO comment to refactor and use get_build_dirs later?
src/macaron/slsa_analyzer/checks/maven_repo_verification_check.py
Outdated
Show resolved
Hide resolved
|
Is there a plan to add unit testing and integration testing as part of this PR? @behnazh-w |
Yes for sure. The PR needs unit tests and integration tests. |
Yes tests are on the way. |
mabdollahpour-ol
force-pushed
the
repository-verification
branch
from
89645cd
to
a2cba60
Compare
mabdollahpour-ol
changed the title
mabdollahpour-ol
changed the title
… artifact Signed-off-by: Mohammad Abdollahpour <[email protected]>
Signed-off-by: Mohammad Abdollahpour <[email protected]>
Signed-off-by: Mohammad Abdollahpour <[email protected]>
Signed-off-by: Mohammad Abdollahpour <[email protected]>
Signed-off-by: Mohammad Abdollahpour <[email protected]>
Signed-off-by: Mohammad Abdollahpour <[email protected]>
Signed-off-by: Mohammad Abdollahpour <[email protected]>
…ctions Signed-off-by: Mohammad Abdollahpour <[email protected]>
Signed-off-by: Mohammad Abdollahpour <[email protected]>
Signed-off-by: Mohammad Abdollahpour <[email protected]>
mabdollahpour-ol
force-pushed
the
repository-verification
branch
from
a2cba60
to
c0cce14
Compare
This version has initial support for maven and gradle build tools.
The core part is added as "repo_verifier" under "repo_finder". "analyzer" calls the "repo_verifier" and adds the info to "dynamic_data".
Also added a sample check (for maven) that shows how this data can be used.