62 with open(deps_file,
'r')
as file:
63 deps_content = file.read()
66 exec(deps_content, global_scope, local_scope)
68 if not os.path.exists(DEP_CLONE_DIR):
69 os.mkdir(DEP_CLONE_DIR)
72 deps = local_scope.get(
'deps', {})
73 deps_list = local_scope.get(
'vars')
74 filtered_osv_deps = []
75 for _, dep
in deps.items():
78 if not isinstance(dep, str):
81 dep_split = dep.rsplit(
'@', 1)
84 filtered_osv_deps.append({
85 'package': {
'name': ancestor_result[1],
'commit': ancestor_result[0]}
90 shutil.rmtree(DEP_CLONE_DIR)
91 except OSError
as clone_dir_error:
92 print(
'Error cleaning up clone directory: %s : %s' % (DEP_CLONE_DIR, clone_dir_error.strerror))
95 'packageSource': {
'path': deps_file,
'type':
'lockfile'},
'packages': filtered_osv_deps
123 Given an input of a mirrored dep,
124 compare to the mapping of deps to their upstream
125 in DEPS and find a common ancestor
128 This is done by first cloning the mirrored dep,
129 then a branch which tracks the upstream.
130 From there, git merge-base operates using the HEAD
131 commit SHA of the upstream branch and the pinned
132 SHA value of the mirrored branch
137 dep_name = dep[0].split(
'/')[-1].split(
'.')[0]
138 if UPSTREAM_PREFIX + dep_name
not in deps_list:
139 print(
'did not find dep: ' + dep_name)
143 upstream = deps_list.get(UPSTREAM_PREFIX + dep_name)
144 temp_dep_dir = DEP_CLONE_DIR +
'/' + dep_name
146 subprocess.check_output([
'git',
'clone',
'--quiet',
'--', dep[0], dep_name], cwd=DEP_CLONE_DIR)
149 print(
'attempting to add upstream remote from: {upstream}'.
format(upstream=upstream))
150 subprocess.check_output([
'git',
'remote',
'add',
'upstream', upstream], cwd=temp_dep_dir)
151 subprocess.check_output([
'git',
'fetch',
'--quiet',
'upstream'], cwd=temp_dep_dir)
153 default_branch = subprocess.check_output(
154 'git remote show upstream ' +
"| sed -n \'/HEAD branch/s/.*: //p\'",
158 default_branch = byte_str_decode(default_branch)
159 default_branch = default_branch.strip()
162 subprocess.check_output([
163 'git',
'checkout',
'--force',
'-b',
'upstream',
'--track',
'upstream/' + default_branch
167 commit = subprocess.check_output(
168 'git for-each-ref ' +
"--format=\'%(objectname:short)\' refs/heads/upstream",
172 commit = byte_str_decode(commit)
173 commit = commit.strip()
176 ancestor_commit = subprocess.check_output(
177 'git merge-base {commit} {depUrl}'.
format(commit=commit, depUrl=dep[1]),
181 ancestor_commit = byte_str_decode(ancestor_commit)
182 ancestor_commit = ancestor_commit.strip()
183 print(
'Ancestor commit: ' + ancestor_commit)
184 return ancestor_commit, upstream
185 except subprocess.CalledProcessError
as error:
187 "Subprocess command '{0}' failed with exit code: {1}.".
format(
188 error.cmd, str(error.returncode)
192 print(
"Subprocess error output: '{0}'".
format(error.output))
uint32_t uint32_t * format