search

trailofbits / it-depends

A tool to automatically build a dependency graph and Software Bill of Materials (SBOM) for packages and arbitrary source code repositories.
https://blog.trailofbits.com/2021/12/16/it-depends/
GNU Lesser General Public License v3.0
330 stars 20 forks source link

Exception triggers when generating HTML output (for Go projects) #72

Open Hamid-K opened 2 years ago

Hamid-K commented 2 years ago

Using the --output-format html (with or without -o out.html) results in the following exception and creation of an empty report file. I have encountered this only while auditing a Go project.

it-depends ../project-code/ --depth-limit 3 --output-format html:

Traceback (most recent call last):
  File "/Users/user/.pyenv/versions/3.8.12/bin/it-depends", line 8, in <module>
    sys.exit(main())
  File "/Users/user/.pyenv/versions/3.8.12/lib/python3.8/site-packages/it_depends/cli.py", line 201, in main
    output_file.write(graph_to_html(package_list, collapse_versions=not args.all_versions))
  File "/Users/user/.pyenv/versions/3.8.12/lib/python3.8/site-packages/it_depends/html.py", line 94, in graph_to_html
    graph = graph.collapse_versions()
  File "/Users/user/.pyenv/versions/3.8.12/lib/python3.8/site-packages/it_depends/dependencies.py", line 325, in collapse_versions
    version = max(p.version for p in instances)
TypeError: '>' not supported between instances of 'GoVersion' and 'GoVersion'

JSON and Dot output formats work as expected. Tested with it-depends version 0.1.1 installed via pip on Python 3.8.12.