Repository navigation
test(license): cover the allow list, manifest extractors, module-cache resolver and CDX writer - #332
Conversation
Vulnetix config planManager
0 to create, 1 to update, 0 to delete, 0 unchanged |
0x73746F66
changed the title
Vulnetix config planManager
0 to create, 1 to update, 0 to delete, 0 unchanged |
0x73746F66
left a comment
0x73746F66
left a comment
There was a problem hiding this comment.
Reuse review: test-only (internal/license). Uses the real allow list, manifest extractors, module-cache resolver and CDX writer with t.Setenv/t.TempDir(); nothing re-implemented. No changes needed.
0x73746F66
left a comment
0x73746F66
left a comment
There was a problem hiding this comment.
Reuse review: no reinvented Vulnetix patterns found. The change stays inside the package it covers, uses stdlib/testify helpers already used by the repo's tests, and adds no new client, auth, config-schema or shared-package duplicate (checked internal/testutils and sibling repos). Rebased onto current main locally: go vet and go test pass for every touched package. The earlier red checks (CodeQL Analyze, Install a release with verified provenance, Lockfile) were GitHub API rate-limit failures, not code failures; this will be re-run on a rebased head before merge.
…description patterns Allow list loading (normalised ids, read and YAML errors), CSV parsing, Contains/IsActive with nil, empty and populated lists; the package.json, composer.json, Cargo.toml and pyproject.toml extractors including their section gating and malformed input; manifestBasename; and the Docker Hub description pattern table. Coverage 35.6% -> 39.0%. Refs #297
goModCaseEncode, goModCachePath's GOMODCACHE > GOPATH > home order and its no-home answer, FindLicenseInModuleCache (case-encoded path, added v prefix, plain-path fallback, unclassifiable and missing), FindLicenseInDir priority, and FindingsToCDXVulnerabilities (first bom-ref per package, rating, every provenance and evidence property, no Affects for a package outside the BOM). Coverage 39.0% -> 41.6%. Closes #297
8c5e75b to
f33aefd
Compare
Vulnetix config planManager
0 to create, 1 to update, 0 to delete, 0 unchanged |
Closes #297
What
Stdlib tests with
t.TempDir(), in two files:internal/license/allowlist_manifest_test.goLoadAllowListFromFilenormalises known ids (mit -> MIT) and keeps unknown ones, errors on a missing file and invalid YAML;ParseAllowListCSVtrims, drops empties, normalises;Contains/IsActivefor nil, empty and populated lists, case-insensitive match and non-match.extractManifestLicensesdispatch per basename; package.json string and{type}forms, missing licence, garbage; composer.json string and array (first wins), missing licence; Cargo.toml[package]gating, alicensekey outside the section ignored,license-filenot taken as a licence; pyproject.toml string and{text = ...}forms and section gating; other files and unreadable paths give nil.manifestBasename.extractLicenseFromDescriptionover the pattern table and no match.internal/license/modcache_cdx_test.go3.
goModCaseEncode;goModCachePathorder GOMODCACHE > GOPATH/pkg/mod > ~/go/pkg/mod, and "" with no home;FindLicenseInModuleCachevia the case-encoded path, with thevprefix added, falling back to the plain path, unclassifiable and missing modules, and no cache at all;FindLicenseInDirtakes the first classifiable file in priority order.4.
FindingsToCDXVulnerabilities: first bom-ref pername@versionwins, id/bom-ref/source, rating score/method/severity, every provenance property (spdx id, source file, is-direct true/false, path count only when > 0, introduced paths, evidence rule/result), no Affects for a package outside the BOM, empty input gives an empty slice.Test-only.
Verified
go test -cover ./internal/license/: pass, 35.6% -> 41.6%.gofmtclean.