Nordix / bomres

Software Bill-of-Material Resolver
Apache License 2.0
7 stars 6 forks source link

Parsing problem of APKBUILD when empty line in list of sources #83

Closed hans-lammda closed 1 year ago

hans-lammda commented 1 year ago

ans@hans-VirtualBox:/tmp/apa$ make abuild ...

musl: Checking sha512sums... musl-v1.2.3.tar.gz: OK handle-aux-at_base.patch: OK relr-1.patch: OK relr-2.patch: OK relr-3.patch: OK relr-4.patch: FAILED sha512sum: can't open 'relr-4.patch': No such file or directory

source="musl-$_commit.tar.gz::https://git.musl-libc.org/cgit/musl/snapshot/$_commit.tar.gz handle-aux-at_base.patch

    relr-1.patch
    relr-2.patch
    relr-3.patch
    relr-4.patch

    ldconfig
    __stack_chk_fail_local.c
    getconf.c
    getent.c
    iconv.c
    "

relr-4.patch is missing in parsed data

            {
                "remote": "relr-3.patch",
                "local": "relr-3.patch"
            },
            {
                "remote": "ldconfig",
                "local": "ldconfig"
            },

There is some unit tests in the test directory

bomres/services/sbom_resolver/service/test python3 ../build/bomres/bomres/lib/create_apkcache.py

hans-lammda commented 1 year ago

The issue is related to mismatch with the git state in APKINDEX and aports repository.

"remote": { "type": "git", "commit": { "hash": "1016b47723", "tag": "v3.16.3" }, "url": "git://git.alpinelinux.org/aports", "path": "main/musl/APKBUILD"

git checkout -b 016b47723 -> lists three entries

In the same resolver.conf another git hash is listed "repo": { "main": { "raw": "v3.16.3-99-g1016b47723", "tag": "v3.16.3", "build-number": "99", "hash": "1016b47723" },

hans-lammda commented 1 year ago

With better understanding how APKINDEX and aports tags aligns this should not be an issue any more.