Add a transitive dependencies endpoint to the REST API #1867
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jeffmendoza
approved these changes
Apr 26, 2024
mihaimaruseac
approved these changes
Apr 26, 2024
Signed-off-by: Marco Deicas <mdeicas@google.com>
Signed-off-by: Marco Deicas <mdeicas@google.com>
Signed-off-by: Marco Deicas <mdeicas@google.com>
Signed-off-by: Marco Deicas <mdeicas@google.com>
Signed-off-by: Marco Deicas <mdeicas@google.com>
jeffmendoza
force-pushed
the
retrieve-deps
branch
from
e31535d
to
aa2dcb2
Compare
lumjjb
reviewed
Apr 29, 2024
|
|
||
| /********* Implementations of the interface *********/ | ||
|
|
||
| func (eg byDigest) getDirectDependencies(ctx context.Context, v node) ([]node, error) { |
| t.Logf("Graphql server shut down") | ||
| } | ||
| } | ||
| t.Cleanup(closeFunc) |
arorasoham9
pushed a commit
to arorasoham9/guac
that referenced
this pull request
May 17, 2024
* client testing support Signed-off-by: Marco Deicas <mdeicas@google.com> * Add HashEquals and IsOccurrences queries to gql client Signed-off-by: Marco Deicas <mdeicas@google.com> * Change Paginate to take pointer to PaginationSpec Signed-off-by: Marco Deicas <mdeicas@google.com> * Add better logging Signed-off-by: Marco Deicas <mdeicas@google.com> * Implement transitive dependency search Signed-off-by: Marco Deicas <mdeicas@google.com> --------- Signed-off-by: Marco Deicas <mdeicas@google.com> Signed-off-by: Soham Arora <arorasoham9@gmail.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of the PR
Adds an endpoint to the REST API to get the transitive dependencies of an artifact or package.
This PR is dependent on and duplicates the changes from #1864 (everything in
internal/testing). Once that is merged, I'll rebase this one.Some design decisions taken were:
Other things done on this PR are:
Explanation of the
linkConditionparameterThis parameter intends to configure the accuracy of the results. If
digestis specified, predicates attached to packages are not used for the graph traversal, because this can lead inconsistencies. For example, suppose there is an artifact A1 that is an occurrence of package P, and there is an SBOM attached to P. It may be misleading to use that SBOM in finding the dependencies of A1, because that SBOM may have been generated for some other artifact A2 -- we don't know.Asking for accuracy by setting
linkCondition = digestrequires good data (e.g. SBOMs need to provide the digest of the subject, which I believe Syft does not). In the absence of this, predicates attached to packages can be used for the grpah traversal by settinglinkCondition = name.PR Checklist
-sflag togit commit.make generatehas been runmake generatehas been runcollectsubprotobuf has been changed,make protohas been run