feat: introduce new flag to avoid using pip freeze and pip show

Signed-off-by: Jude Niroshan <jude.niroshan11@gmail.com>
RHEcosystemAppEng · May 7, 2024 · 33750c1 · 33750c1
1 parent 05b9cb6
commit 33750c1
Show file tree

Hide file tree

Showing 7 changed files with 763 additions and 165 deletions.
diff --git a/README.md b/README.md
@@ -467,6 +467,11 @@ A New setting is introduced - `EXHORT_PYTHON_INSTALL_BEST_EFFORTS` (as both env
 1. `EXHORT_PYTHON_INSTALL_BEST_EFFORTS`="false" - install requirements.txt while respecting declared versions for all packages.
 2. `EXHORT_PYTHON_INSTALL_BEST_EFFORTS`="true" - install all packages from requirements.txt, not respecting the declared version, but trying to install a version tailored for the used python version, when using this setting,you must set setting `MATCH_MANIFEST_VERSIONS`="false"
 
+##### Using `pipdeptree`
+By Default, The API algorithm will use native commands of PIP installer as data source to build the dependency tree.
+It's also possible, to use lightweight Python PIP utility [pipdeptree](https://pypi.org/project/pipdeptree/) as data source instead, in order to activate this,
+Need to set environment variable/option - `EXHORT_PIP_USE_DEP_TREE` to true.
+
 ### Image Support 
 
 Generate vulnerability analysis report for container images.

diff --git a/src/main/java/com/redhat/exhort/providers/PythonPipProvider.java b/src/main/java/com/redhat/exhort/providers/PythonPipProvider.java
@@ -57,9 +57,9 @@ public static void main(String[] args) {
       //      byte[] bytes = Files.readAllBytes(Path.of("/tmp/exhort_env/requirements.txt"));
       //      Content content = pythonPipProvider.provideComponent(bytes);
       Content content =
-          pythonPipProvider.provideStack(
-              Path.of(
-                  "/home/zgrinber/git/exhort-java-api/src/test/resources/tst_manifests/pip/pip_requirements_txt_ignore/requirements.txt"));
+        pythonPipProvider.provideStack(
+          Path.of(
+            "/home/zgrinber/git/exhort-java-api/src/test/resources/tst_manifests/pip/pip_requirements_txt_ignore/requirements.txt"));
       String s = new String(content.buffer);
       System.out.print(s);
     } catch (IOException e) {
@@ -79,11 +79,9 @@ public Content provideStack(Path manifestPath) throws IOException {
     printDependenciesTree(dependencies);
     Sbom sbom = SbomFactory.newInstance(Sbom.BelongingCondition.PURL, "sensitive");
     sbom.addRoot(toPurl(DEFAULT_PIP_ROOT_COMPONENT_NAME, DEFAULT_PIP_ROOT_COMPONENT_VERSION));
-    dependencies.stream()
-        .forEach(
-            (component) -> {
-              addAllDependencies(sbom.getRoot(), component, sbom);
-            });
+    for (Map<String, Object> component : dependencies) {
+      addAllDependencies(sbom.getRoot(), component, sbom);
+    }
     byte[] requirementsFile = Files.readAllBytes(manifestPath);
     handleIgnoredDependencies(new String(requirementsFile), sbom);
     return new Content(
@@ -92,25 +90,17 @@ public Content provideStack(Path manifestPath) throws IOException {
 
   private void addAllDependencies(PackageURL source, Map<String, Object> component, Sbom sbom) {
 
-    sbom.addDependency(
-        source, toPurl((String) component.get("name"), (String) component.get("version")));
-    List<Map> directDeps = (List<Map>) component.get("dependencies");
-    if (directDeps != null)
-      //    {
-      directDeps.stream()
-          .forEach(
-              dep -> {
-                String name = (String) dep.get("name");
-                String version = (String) dep.get("version");
-
-                addAllDependencies(
-                    toPurl((String) component.get("name"), (String) component.get("version")),
-                    dep,
-                    sbom);
-              });
-    //
-    //    }
+    PackageURL packageURL =
+        toPurl((String) component.get("name"), (String) component.get("version"));
+    sbom.addDependency(source, packageURL);
 
+    List<Map<String, Object>> directDeps =
+        (List<Map<String, Object>>) component.get("dependencies");
+    if (directDeps != null) {
+      for (Map<String, Object> dep : directDeps) {
+        addAllDependencies(packageURL, dep, sbom);
+      }
+    }
   }
 
   @Override