Skip to content

Dependency proxy #1450

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 6 commits into
base: main
Choose a base branch
from
Open

Dependency proxy #1450

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
dda800e
adds main.go with basic proxy implementation
timbastin Nov 30, 2025
38384ea
adds malicious-package-firewall
timbastin Nov 30, 2025
b78022d
fixes linting
timbastin Nov 30, 2025
155fddf
removes scannning of malicious packages submodule
timbastin Nov 30, 2025
70567ad
adds ignore to git submodule
timbastin Nov 30, 2025
cbd5e81
removes malicious packages from being excluded in files in vscode
timbastin Dec 1, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,4 +27,5 @@ csaf-openpgp-public-key.asc
!**/testfiles/**
vulndb-tmp-*
cert.pem
key.pem
key.pem
cache
4 changes: 4 additions & 0 deletions .gitmodules
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,7 @@
[submodule "internal/core/compliance/attestation-compliance-policies"]
path = compliance/attestation-compliance-policies
url = [email protected]:l3montree-dev/attestation-compliance-policies.git
[submodule "malicious-packages"]
path = malicious-packages
url = https://github.com/ossf/malicious-packages.git
ignore = all
10 changes: 10 additions & 0 deletions .vscode/settings.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,17 @@
"ghinstallation",
"gorm",
"montree",
"pypi",
"sarif",
"Vulns"
],
"files.watcherExclude": {
"**/malicious-packages/**": true
},
"search.exclude": {
"**/malicious-packages/**": true
},
"git.ignoredRepositories": [
"malicious-packages"
]
}
8 changes: 4 additions & 4 deletions controllers/component_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,23 +128,23 @@ func (ComponentController ComponentController) ListPaged(ctx shared.Context) err
return ctx.JSON(200, shared.NewPaged(pageInfo, components.Total, componentsDTO))
}

func (controller ComponentController) SearchComponentOccurrences(ctx shared.Context) error {
func (ComponentController ComponentController) SearchComponentOccurrences(ctx shared.Context) error {
project := shared.GetProject(ctx)

// get all child projects as well
projects, err := controller.projectRepository.RecursivelyGetChildProjects(project.ID)
projects, err := ComponentController.projectRepository.RecursivelyGetChildProjects(project.ID)
if err != nil {
return echo.NewHTTPError(500, "could not fetch child projects").WithInternal(err)
}

var projectIDs []uuid.UUID = []uuid.UUID{
var projectIDs = []uuid.UUID{
project.ID,
}
for _, p := range projects {
projectIDs = append(projectIDs, p.ID)
}

pagedResp, err := controller.componentRepository.SearchComponentOccurrencesByProject(
pagedResp, err := ComponentController.componentRepository.SearchComponentOccurrencesByProject(
nil,
projectIDs,
shared.GetPageInfo(ctx),
Expand Down
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@ require (
github.com/pkg/errors v0.9.1
github.com/prometheus/client_golang v1.23.2
github.com/schollz/progressbar/v3 v3.18.0
github.com/secure-systems-lab/go-securesystemslib v0.9.1
github.com/sigstore/sigstore v1.9.5
github.com/spf13/cobra v1.10.1
github.com/spf13/pflag v1.0.10
Expand Down Expand Up @@ -275,7 +276,6 @@ require (
github.com/rqlite/gorqlite v0.0.0-20230708021416-2acd02b70b79 // indirect
github.com/sagikazarmark/locafero v0.12.0 // indirect
github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
github.com/secure-systems-lab/go-securesystemslib v0.9.1 // indirect
github.com/segmentio/asm v1.2.1 // indirect
github.com/sergi/go-diff v1.4.0 // indirect
github.com/shibumi/go-pathspec v1.3.0 // indirect
Expand Down
Loading