feat(sbom): declare rust dependencies via packages directive#168
Open
reyreavman wants to merge 5 commits into
Open
feat(sbom): declare rust dependencies via packages directive#168reyreavman wants to merge 5 commits into
reyreavman wants to merge 5 commits into
Conversation
reyreavman
changed the title
Add three new package directive types for Python ecosystems (uv, pip, poetry) alongside the existing go-mod, mirroring the go-mod pattern across all five layers: - pkg/config/packages_directive.go: PythonSpec type + 3 enum constants + per-manager spec/lock defaults + validation - pkg/config/raw_packages_directive.go: YAML parser with canonical types (python-uv/pip/poetry) and short aliases (uv/pip/poetry) - pkg/config/packages_commands.go: install commands (pip install -r, poetry install --no-root, uv sync --frozen) executed in Packages stage - pkg/sbom/managedinput/managedinput.go: wire python-package-cataloger (declared model) with exact-match source paths - docs/_data/werf_yaml.yml: schema documentation for all 4 types (en+ru) Unit tests: 12 parser entries (7 happy + 4 failure via DescribeTable), 4 command generation entries, 6 managedinput entries. E2E tests: one Ginkgo spec per manager (uv/pip/poetry) with per-fixture Dockerfile.builder-base + werf-giterminism.yaml. Each test builds a real image and verifies requests@2.32.3 appears in the SBOM output. Refs Kaiten 65682576. Signed-off-by: Radmir Khurum <radmir.khurum@flant.com>
…registry
Consolidate the ad-hoc GoModSpec/PythonSpec split into a single data-
driven registry. Adding a new package manager (e.g. python-pdm, rust-
cargo, js-npm) now requires ONE entry in the ecosystems map — parser,
install commands, and SBOM wiring auto-derive from that entry.
Structural changes:
- New unified FileBasedSpec{Workdir, Spec, Lock} replaces GoModSpec and
PythonSpec (both deleted). PackagesDirective.GoMod and .Python fields
replaced by .FileBased.
- New PackageEcosystem{Type, Aliases, DefaultSpec, DefaultLock,
InstallCmd, CatalogerName} registry in pkg/config/packages_directive.go
as the single source of truth for all file-based ecosystems.
- aliasToType precomputed reverse index for O(1) short-alias lookup.
- Ecosystems() getter exposed for pkg/sbom/managedinput.
Callers migrated:
- raw_packages_directive.go: single fillFileBasedSpec replaces
fillGoModSpec + fillPythonSpec. Strict behavior: non-string spec
always errors (previously go-mod silently ignored).
- packages_commands.go: registry lookup replaces switch.
- managedinput.go: buildResolvers() iterates the registry.
Test consolidation:
- New pkg/config/helpers_test.go: shared directivesFromYaml helper
(previously duplicated across go-mod and python test files).
- All test files migrated from GoMod:/Python: field references to
FileBased:.
- It() blocks in normalizePackages and FilterBOMBySourcePaths converted
to DescribeTable per project style.
No user-facing changes: YAML schema and CLI behavior unchanged.
Signed-off-by: Radmir Khurum <radmir.khurum@flant.com>
Apply fixes for 7 risks surfaced by the multi-role review: - #1 (HIGH) buildResolvers() sorts by inputType before returning — deterministic resolver order across process restarts. Prevents flaky tests and non-reproducible SBOM output ordering. + regression tests: 'deterministic order across invocations' and 'orders by inputType alphabetically'. - #2 (HIGH) Ecosystems() returns maps.Clone(ecosystems) instead of the package-level map — defensive copy prevents accidental global mutation by callers. - #3 (MEDIUM) pip install --no-cache-dir -r <spec> — standard Docker practice, prevents pip cache layer bloat in build images. - #4 (MEDIUM) e2e pip fixture now uses short alias 'type: pip' (matches the exact user path from Kaiten 65682576). Previously covered only by unit tests; now e2e validates alias → canonical → install → SBOM. - #5 (MEDIUM) fillFileBasedSpec rejects 'lock:' for ecosystems without lock semantics (pip) with 'lock is not supported for type %q'. Silent accept would confuse users about reproducibility guarantees. + failure test entry. - #8 (MEDIUM) InstallCmd uses %q instead of %s for workdir/spec — shell- quotes values against injection. Defensive coding: values currently come from controlled werf.yaml, but template rendering ({{ env }}) widens the attack surface. - #11 (LOW) Drop redundant 'eco := eco' loop capture (Go 1.24 uses per- iteration binding natively). Signed-off-by: Radmir Khurum <radmir.khurum@flant.com>
ecosystems Document the new Python package ecosystems feature for the packages directive, including types, alias resolution, command generation, and SBOM integration. Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>
Signed-off-by: Radmir Khurum <radmir.khurum@flant.com>
reyreavman
force-pushed
the
feat/sbom/get-rust-sbom
branch
from
471b587 to
d9d08f6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.