vex: account for package module when parsing VEX #1416

crozzy · 2024-09-18T18:52:26Z

Previously, we'd made the decision to ignore the package module and rely on the repo and package for matching but now that the VEX data has the package module data and it helps filter the results on the DB side, it seems best to add the package module information and keep the matcher constraints as it is. Without this we'd need change the RHEL matcher to remove the PackageModule constraint.

codecov · 2024-09-18T19:15:08Z

Codecov Report

Attention: Patch coverage is 70.31250% with 19 lines in your changes missing coverage. Please review.

Project coverage is 55.43%. Comparing base (7088f7b) to head (a3c2044).

Files with missing lines	Patch %	Lines
rhel/vex/parser.go	70.31%	15 Missing and 4 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1416      +/-   ##
==========================================
+ Coverage   55.41%   55.43%   +0.01%     
==========================================
  Files         282      282              
  Lines       17890    17934      +44     
==========================================
+ Hits         9914     9941      +27     
- Misses       6934     6948      +14     
- Partials     1042     1045       +3

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

rhel/vex/parser.go

rhel/vex/parser_test.go

rhel/vex/parser.go

crozzy · 2024-09-20T22:30:11Z

rhel/vex/parser.go

+	}
+	if version, _, found := strings.Cut(purl.Version, ":"); found {
+		modName = purl.Name + ":" + version
+	} else {


@RTann adding this clause as some of the PURLs don't conform to a standard format and will be potentially updated:
Conventional: pkg:rpmmod/redhat/postgresql@13:8080020231114105206:63b34585
Unconventional: pkg:rpmmod/redhat/postgresql:15/postgresql
Possible update for unconventional format: pkg:rpmmod/redhat/postgresql@15

This is being looked at by RH prodsec.

Based on https://go.dev/play/p/PamAwGzH8r0 I think you can just do

version, _, _ := strings.Cut(purl.Version, ":") return purl.Name + ":" + version, nil

This is being looked at by RH prodsec.

Is this blocked, then?

I'm not sure there is a point in editing it until we get a reply about whether this is:

A bug and will be fixed

A bug and won't be immediately fixed

Not a but and won't be changed

If we don't get that answer soon I think we just account for the conventional way and possibly modify in the future.

It's been a couple of days with no reply, going to change to just account for conventional rpmmod PURLs

RTann · 2024-09-23T22:06:06Z

rhel/vex/parser.go

+	}
+	if version, _, found := strings.Cut(purl.Version, ":"); found {
+		modName = purl.Name + ":" + version
+	} else {


Based on https://go.dev/play/p/PamAwGzH8r0 I think you can just do

version, _, _ := strings.Cut(purl.Version, ":") return purl.Name + ":" + version, nil

rhel/vex/parser.go

RTann · 2024-09-23T22:09:06Z

rhel/vex/parser.go

+	}
+	if version, _, found := strings.Cut(purl.Version, ":"); found {
+		modName = purl.Name + ":" + version
+	} else {


This is being looked at by RH prodsec.

Is this blocked, then?

rhel/vex/parser.go

RTann

one minor nit otherwise LGTM

rhel/vex/parser.go

Previously, we'd made the decision to ignore the package module and rely on the repo and package for matching but now that the VEX data has the package module data and it helps filter the results on the DB side, it seems best to add the package module information and keep the matcher constraints as it is. Signed-off-by: crozzy <[email protected]>

crozzy · 2024-10-04T16:32:21Z

/fast-forward

crozzy requested a review from a team as a code owner September 18, 2024 18:52

crozzy requested review from hdonnay and removed request for a team September 18, 2024 18:52

crozzy marked this pull request as draft September 18, 2024 18:53

crozzy force-pushed the account-for-module-vex branch 3 times, most recently from 6aac3ad to e4b64e8 Compare September 18, 2024 19:07

crozzy force-pushed the account-for-module-vex branch 2 times, most recently from 5e7886d to 033b09c Compare September 19, 2024 15:34

crozzy marked this pull request as ready for review September 19, 2024 19:50

crozzy force-pushed the account-for-module-vex branch from 033b09c to d25a2af Compare September 19, 2024 19:55

RTann reviewed Sep 19, 2024

View reviewed changes

rhel/vex/parser.go Outdated Show resolved Hide resolved

rhel/vex/parser.go Show resolved Hide resolved

crozzy force-pushed the account-for-module-vex branch from d25a2af to dba3d1b Compare September 19, 2024 23:10

RTann reviewed Sep 19, 2024

View reviewed changes

crozzy force-pushed the account-for-module-vex branch from dba3d1b to 4a9ec4c Compare September 20, 2024 15:48

RTann mentioned this pull request Sep 20, 2024

ROX-25981: use VEX for RPMs stackrox/stackrox#12452

Merged

6 tasks

crozzy force-pushed the account-for-module-vex branch 2 times, most recently from 3e77536 to b34a500 Compare September 20, 2024 22:26

crozzy commented Sep 20, 2024

View reviewed changes

crozzy requested a review from RTann September 20, 2024 22:30

crozzy force-pushed the account-for-module-vex branch 3 times, most recently from 59434dd to a3c2044 Compare September 23, 2024 19:12

RTann reviewed Sep 23, 2024

View reviewed changes

crozzy force-pushed the account-for-module-vex branch from a3c2044 to c5325eb Compare September 26, 2024 16:45

crozzy commented Sep 26, 2024

View reviewed changes

rhel/vex/parser.go Show resolved Hide resolved

crozzy requested a review from RTann September 26, 2024 21:49

crozzy mentioned this pull request Sep 30, 2024

enricher: add RHCC enricher #1057

Open

RTann reviewed Sep 30, 2024

View reviewed changes

rhel/vex/parser.go Outdated Show resolved Hide resolved

rhel/vex/parser.go Outdated Show resolved Hide resolved

rhel/vex/parser.go Show resolved Hide resolved

crozzy force-pushed the account-for-module-vex branch 2 times, most recently from dc451f0 to 1114dae Compare October 1, 2024 17:05

crozzy requested a review from RTann October 1, 2024 17:31

RTann previously approved these changes Oct 4, 2024

View reviewed changes

rhel/vex/parser.go Outdated Show resolved Hide resolved

crozzy dismissed RTann’s stale review via a97deb9 October 4, 2024 15:22

crozzy force-pushed the account-for-module-vex branch from 1114dae to a97deb9 Compare October 4, 2024 15:22

crozzy requested review from RTann and removed request for hdonnay October 4, 2024 15:23

crozzy force-pushed the account-for-module-vex branch from a97deb9 to 5df9794 Compare October 4, 2024 15:24

RTann previously approved these changes Oct 4, 2024

View reviewed changes

rhel/vex/parser.go Outdated Show resolved Hide resolved

crozzy dismissed RTann’s stale review via 54959d6 October 4, 2024 16:20

crozzy force-pushed the account-for-module-vex branch from 5df9794 to 54959d6 Compare October 4, 2024 16:20

RTann approved these changes Oct 4, 2024

View reviewed changes

github-actions bot merged commit 54959d6 into quay:main Oct 4, 2024
6 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

vex: account for package module when parsing VEX #1416

vex: account for package module when parsing VEX #1416

crozzy commented Sep 18, 2024

codecov bot commented Sep 18, 2024 •

edited

Loading

crozzy Sep 20, 2024

RTann Sep 23, 2024

RTann Sep 23, 2024

crozzy Sep 23, 2024

crozzy Sep 25, 2024

RTann Sep 23, 2024

RTann Sep 23, 2024

RTann left a comment

crozzy commented Oct 4, 2024

vex: account for package module when parsing VEX #1416

vex: account for package module when parsing VEX #1416

Conversation

crozzy commented Sep 18, 2024

codecov bot commented Sep 18, 2024 • edited Loading

Codecov Report

crozzy Sep 20, 2024

Choose a reason for hiding this comment

RTann Sep 23, 2024

Choose a reason for hiding this comment

RTann Sep 23, 2024

Choose a reason for hiding this comment

crozzy Sep 23, 2024

Choose a reason for hiding this comment

crozzy Sep 25, 2024

Choose a reason for hiding this comment

RTann Sep 23, 2024

Choose a reason for hiding this comment

RTann Sep 23, 2024

Choose a reason for hiding this comment

RTann left a comment

Choose a reason for hiding this comment

crozzy commented Oct 4, 2024

codecov bot commented Sep 18, 2024 •

edited

Loading