scanoss / sbom-workbench

The SCANOSS SBOM Workbench graphical user interface to scan and audit your source code.
https://scanoss.com/
Other
47 stars 9 forks source link

UX: Matches screen is utterly baffling #446

Closed lucasgonze closed 1 year ago

lucasgonze commented 2 years ago

I'm at a loss to understand what the Matches view is trying to tell me here:

image
  1. What is the source of the file on the right?

If I copy file path to clipboard on the left item I get /ace-aws-blueprint-static-website/examples/static-website-terraform/complete/testing/terragrunt.hcl. That file does exist in the source repo I'm examining. But if I copy file path to clipboard on the right item I get terraform/terragrunt.hcl.

In an effort to understand what this is telling me I clone the repo in the popup:

image

It does not contain any files named terraform/terragrunt.hcl, though it does contain about ten things with similar names like ./{{cookiecutter.github_repo_name}}/terraform/environments/terragrunt.hcl.

  1. Why is the text of the match only displayed on one side and not both? Are the files identical?

  2. If the information about the remote repo is on the left, why is the file from the remote repo on the right?

francostramana commented 2 years ago

Hey @lucasgonze, I will try to answer your doubts.

    • The source file should exists. Did you delete or move the original file? Do you have the same problem in other files?
    • About the terraform/terragrunt.hcl file: Probably the OSSKB Free Open Source Inventory doesn't have the last version of the remote project. Is your project open source? I would like to analyze it.

Anyway, we improve this in the last version. You will able to open the remote file in github. image

  1. It should show you your local file on the left panel. Same case as above.

  2. Actually the information about remote repo that is shown in the top section could show several matches from different repositories. In your case you have only one, this is why it seems be aligned to the left panel. You are right, it's confusing. We will analyze with the team.

francostramana commented 2 years ago

@brunodeangelis FYI

lucasgonze commented 2 years ago

Hi @francostramana. I'll reply in detail. If this feedback stops being helpful, don't feel like you have to satisfy me. The purpose is to help with dev.

    • Q: Did you delete or move the original file? A: No
    • Q: Do you have the same problem in other files? A: the path for a file in a different component is /ace-aws-infra-modules/integration/transfer-family/sftp-server/test/go.sum. This is also wrong. The correct path would be /Users/lucasgonze/src/confidential/confidential-all-repos
    • Q: Is your project open source? I would like to analyze it. A: Unfortunately, it is not. My task is to ensure compliance within a proprietary code base.
francostramana commented 2 years ago

Hey @lucasgonze we are pretty sure that you are using an old version of the SCANOSS Audit Workbench. Could you download de last version to test again? We really can't reproduce this bug. https://github.com/scanoss/audit-workbench/releases/tag/1.1.1

lucasgonze commented 2 years ago

I have downloaded and installed the latest.

In the matches screen for this item, it is much improved:

Screen Shot 2022-07-18 at 4 44 34 PM

In the matches screen for this item, there is a bug:

Screen Shot 2022-07-18 at 8 57 56 AM