SpdxDocumentFile: Report issues from subprojects that cannot be mapped to a package ID. #8851
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #8851 +/- ##
============================================
+ Coverage 67.54% 67.63% +0.08%
- Complexity 1166 1167 +1
============================================
Files 244 244
Lines 7775 7780 +5
Branches 865 866 +1
============================================
+ Hits 5252 5262 +10
+ Misses 2167 2161 -6
- Partials 356 357 +1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
MarcelBochtler
force-pushed
the
spdx-doc-dropped-issues
branch
from
d5f09b6 to
7babf76
Compare
MarcelBochtler
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
plugins/package-managers/spdx/src/funTest/kotlin/SpdxDocumentFileFunTest.kt
Fixed
Show fixed
Hide fixed
plugins/package-managers/spdx/src/funTest/kotlin/SpdxDocumentFileFunTest.kt
Fixed
Show fixed
Hide fixed
plugins/package-managers/spdx/src/funTest/kotlin/SpdxDocumentFileFunTest.kt
Fixed
Show fixed
Hide fixed
MarcelBochtler
force-pushed
the
spdx-doc-dropped-issues
branch
4 times, most recently
from
2a46c29 to
882eea0
Compare
MarcelBochtler
force-pushed
the
spdx-doc-dropped-issues
branch
2 times, most recently
from
db036d3 to
6999b77
Compare
sschuberth
requested changes
Jul 15, 2024
plugins/package-managers/spdx/src/funTest/kotlin/SpdxDocumentFileFunTest.kt
Outdated
Show resolved
Hide resolved
plugins/package-managers/spdx/src/funTest/kotlin/SpdxDocumentFileFunTest.kt
Outdated
Show resolved
Hide resolved
plugins/package-managers/spdx/src/main/kotlin/utils/SpdxResolvedDocument.kt
Outdated
Show resolved
Hide resolved
plugins/package-managers/spdx/src/main/kotlin/utils/SpdxResolvedDocument.kt
Outdated
Show resolved
Hide resolved
plugins/package-managers/spdx/src/main/kotlin/utils/SpdxResolvedDocument.kt
Outdated
Show resolved
Hide resolved
MarcelBochtler
force-pushed
the
spdx-doc-dropped-issues
branch
2 times, most recently
from
762e91a to
f6e27e9
Compare
sschuberth
reviewed
Jul 15, 2024
plugins/package-managers/spdx/src/main/kotlin/utils/SpdxResolvedDocument.kt
Outdated
Show resolved
Hide resolved
MarcelBochtler
force-pushed
the
spdx-doc-dropped-issues
branch
from
f6e27e9 to
7b47460
Compare
| * Retrieve the issues from [issuesByReferenceId] that are not associated with [any package][packagesById]. These | ||
| * issues can be related to general issues within the SPDX document. | ||
| */ | ||
| fun getIssuesWithoutSpdxPackage() = issuesByReferenceId.mapNotNull { (id, issue) -> |
Check warning
Code scanning / detekt
Format signature to be single when possible, multiple lines otherwise. Warning
MarcelBochtler
force-pushed
the
spdx-doc-dropped-issues
branch
from
7b47460 to
4ffac63
Compare
sschuberth
previously approved these changes
Jul 15, 2024
MarcelBochtler
force-pushed
the
spdx-doc-dropped-issues
branch
from
4ffac63 to
6ec315d
Compare
sschuberth
requested changes
Jul 16, 2024
| @@ -16,7 +16,7 @@ externalDocumentRefs: | |||
| spdxDocument: "./subproject/subproject-with-conan-reference.spdx.yml" | |||
| checksum: | |||
| algorithm: "SHA1" | |||
| checksumValue: "53840294281f7d1bf401b746162da11dcf9306eb" | |||
| checksumValue: "032a087b0da8f353c03671a72179b807b4ec7eb3" | |||
There was a problem hiding this comment.
I believe we have tests for SpdxResolvedDocument in place that verify the checksum, so please explain in the commit message how this could have been wrong.
There was a problem hiding this comment.
I tried to explain it.
There was a problem hiding this comment.
Ok, thanks. Let me try to rephrase that for my understanding: The checksum was always wrong, but that fact did not result in an issue or test failure until the previous commit. Now that issues are properly propagated, it would result in a test failure of SpdxDocumentFileFunTest whose expected result files contain no issues. Correct?
Add synthetic project and an associated test to verify that issues from an external document ref are added to the result. Signed-off-by: Marcel Bochtler <[email protected]>
Ensure that issues added in `getSpdxPackageForId()` are not dropped, but rather added to the resulting `PackageReference`. Signed-off-by: Marcel Bochtler <[email protected]>
Before, issues from external document refs, which could not be mapped to a `packageId`, failed to be added as issue in the ORT result. Add these missing transitive issues, by explicitly check for any issues that are not related to known packages. Signed-off-by: Marcel Bochtler <[email protected]>
As the issue is caused by an external document reference, it wasn't reported as an issue. The previous commit fixes this issue. Therefore, fix the checksum to keep the correct expected result for the `SpdxDocumentFileFunTest`. Signed-off-by: Marcel Bochtler <[email protected]>
MarcelBochtler
force-pushed
the
spdx-doc-dropped-issues
branch
from
6ec315d to
43c2fa4
Compare
sschuberth
approved these changes
Jul 17, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Please ensure that your pull request adheres to our contribution guidelines. Thank you!