General Approach

[amphioxis]

• [x] Read in requirements.txt
• [x] Send data to FASTEN (package name and version) using the /rcg endpoint
• [x] Check if a package is known by FASTEN
• [ ] Create local Call Graphs for packages not known by FASTEN
  • [x] Download the unknown packages
  • [x] Unzip the downloaded packages
  • [x] Create Call Graphs for unzipped packages
  • [ ] Delete packages after Call Graph generation
• [x] Receive for all packages known by the FASTEN database a Call Graph (created by FASTEN)
  • [x] Implementation of .../{pkg}/{pkg_ver}/rcg endpoint
• [x] Receive vulnerability information for each package from FASTEN via the .../{pkg}/{pkg_ver}/vulnerabilities endpoint
  • [x] Implementation of the .../{pkg}/{pkg_ver}/vulnerabilities endpoint
• [x] Create a Call Graph for the locally created package
  • [x] Use pycg in the right way, so that the Call Graph has the right format
• [x] Stitch the Call Graphs together (locally)
• [x] Create Optimized Stitched Call Graph
  • [x] Create adjacency list of Stitched Call Graph
  • [x] Implement depth search algorithm
• [x] Find licenses
• [x] Analyze the project for vulnerability and license information
  • [x] Implement Vulnerability Analyzer
  • [x] Implement License Analyzer
• [x] Enrich the Stitched Call Graph with the metadata information received from FASTEN and the results of the analysis done locally
  • [x] Get metadata for each callable from FASTEN
  • [x] Enrich with metadata information for each callable received from FASTEN
  • [x] Create a list of URIs inside the Optimized Stitched Call Graph
  • [x] Compare this list with the URIs inside the callable json received from FASTEN
  • [x] For each URI match, enrich the Optimized Stitched Call Graph if metadata information is available in the callable json
  • [x] Enrich with license information
• [ ] Analyze Enriched Call Graph
• [x] Write final report about analyzed project
  

[gdrosos]

Hello @amphioxis, with the merge of https://github.com/fasten-project/fasten-docker-deployment/pull/28 all the python endpoints should be functional, enabling you to recieve the rcgs and the information stored in the metadata db.