yarn: SBOM components #739
Open
+1,862
−21
Commits on Nov 22, 2024
-
Add str magic method to ChecksumInfo class
The class is very often interpreted as `algorithm:hash`. Let's make use of builtin __str__ magic method and return the same format. Signed-off-by: Michal Šoltis <[email protected]>
-
Add purl properties to all yarn classic packages
Each "yarn classic" package type has a property that returns the package URL based on its attributes and community PURL specification [1]. All package types share the same base -> name, version, and type which is set to "npm" ("yarn" does not exist). - `FilePackage`, `WorkspacePackage`, `LinkPackage` have in addition subpath component (extra subpath within a package, relative to the package root) - `UrlPackage` has one extra qualifier -> its URL as it is definied - `GitPackage` has one extra qualifier -> package version control system URL with a specific syntax [2] - `RegistryPackage` has two extra qualifiers -> repository_url (default repository/registry for "npm" is https://registry.npmjs.org so alternative registries such as https://registry.yarnpkg.com should be qualified via the qualifier) [3], [4] + the checksum of the package converted from Subresource Integrity representation --- [1]: https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst [2]: https://github.com/spdx/spdx-spec/blob/cfa1b9d08903/chapters/3-package-information.md#37-package-download-location- [3]: https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#npm [4]: https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst#known-qualifiers-keyvalue-pairs Signed-off-by: Michal Šoltis <[email protected]> -
Create SBOM components for yarn-classic packages
After a successful pre-fetching of all packages, report all downloaded packages as components in the final SBOM. Create the `Component` object from each package based on package attributes. Dev packages should have `cdx:npm:package:development` property, that is added to the component if package is marked for development -> `dev` attribute is set to True. Move the rest of the unit test logic to `test_fetch_yarn_source` from its predecessor in yarn-berry implementation. closes containerbuildsystem#636 Signed-off-by: Michal Šoltis <[email protected]>
-
Update bom.json for yarn-classic e2e tests
The commit follows the previous one, that implements generating SBOM components. Now e2e tests that generate SBOMs should be updated to reflect this change by running integration tests and setting our custom env variable: `CACHI2_GENERATE_TEST_DATA=true` Signed-off-by: Michal Šoltis <[email protected]>
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.