mitre / hipcheck

Automatically assess and score software repositories for supply chain risk.
https://mitre.github.io/hipcheck/
Apache License 2.0
81 stars 6 forks source link

Hipcheck errors without proper explanation when given an NPM or PyPI package version not tagged in the repository #256

Open mchernicoff opened 3 months ago

mchernicoff commented 3 months ago

When Hipcheck is given an NPM or PyPI package to check with a version, it uses that version number as a tag refspec for the corresponding Git repository. If that repository does not have a tag corresponding to that version (e.g. the tag for an older release has been deleted) or the tag is not formatted exactly as a plain semver string (e.g. v.1.2.3 instead of 1.2.3), Hipcheck will quit with the following error message:

revspec '1.2.3' not found; class=Reference (4); code=NotFound (-3)

As a short term fix, we should change the error message to explain what has happened and suggest corrective action for the user (e.g. try again with no version number and an optional --ref flag that matches an existing tag). Longer term, we may wish to handle a missing version tag more gracefully.

alilleybrinker commented 3 months ago

Probably try some common patterns for matching tags, and otherwise error out and tell the user to use the --ref flag.

To match version X.Y.Z we should check: