External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

refactor: implement package-manager-specific extractors & replace osv-scanner with scalibr

Browse Source
This commit is contained in:
Sahilb315
2025-06-11 19:01:44 +05:30
parent 8b8a98b13d
commit 6c446a7ad7
9 changed files with 258 additions and 204 deletions
Download Patch File Download Diff File Expand all files Collapse all files
extractor/ecosystems.go
+26 -77
View File
@@ -1,101 +1,50 @@
package extractor
import (
"fmt"
packagev1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/package/v1"
"github.com/google/osv-scanner/pkg/lockfile"
)
// EcosystemExtractor defines the interface for ecosystem-specific extractors
type EcosystemExtractor interface {
// PackageManagerExtractor defines the interface for package-manager-specific extractors
type PackageManagerExtractor interface {
// Returns the list of supported lockfiles by the package manager
GetSupportedFiles() []string
// Returns the package manager ecosysetm
GetEcosystem() packagev1.Ecosystem
Extract(depFile lockfile.DepFile, filename string) ([]lockfile.PackageDetails, error)
// Returns the package manager name
GetPackageManager() PackageManagerName
// Extracts the packages from the lockfile
Extract(lockfilePath, scanDir string) ([]*packagev1.PackageVersion, error)
}
// NpmExtractor handles NPM ecosystem lockfiles
type NpmExtractor struct{}
type PackageManagerName string
var NpmExtractors []string = []string{"package-lock.json", "pnpm-lock.yaml"}
const (
Npm PackageManagerName = "npm"
Pnpm PackageManagerName = "pnpm"
Pip PackageManagerName = "pip"
)
func (n *NpmExtractor) GetSupportedFiles() []string {
return NpmExtractors
}
func (n *NpmExtractor) GetEcosystem() packagev1.Ecosystem {
return packagev1.Ecosystem_ECOSYSTEM_NPM
}
func (n *NpmExtractor) Extract(depFile lockfile.DepFile, filename string) ([]lockfile.PackageDetails, error) {
switch filename {
case "package-lock.json":
extractor := lockfile.NpmLockExtractor{}
return extractor.Extract(depFile)
case "pnpm-lock.yaml":
extractor := lockfile.PnpmLockExtractor{}
return extractor.Extract(depFile)
default:
return nil, fmt.Errorf("unsupported NPM lockfile: %s", filename)
}
}
// PyPiExtractor handles PyPI ecosystem lockfiles
type PyPiExtractor struct{}
var PyPiExtractors []string = []string{"requirements.txt", "Pipfile.lock"}
func (p *PyPiExtractor) GetSupportedFiles() []string {
return PyPiExtractors
}
func (p *PyPiExtractor) GetEcosystem() packagev1.Ecosystem {
return packagev1.Ecosystem_ECOSYSTEM_PYPI
}
func (p *PyPiExtractor) Extract(depFile lockfile.DepFile, filename string) ([]lockfile.PackageDetails, error) {
switch filename {
case "requirements.txt":
extractor := lockfile.RequirementsTxtExtractor{}
return extractor.Extract(depFile)
case "Pipfile.lock":
extractor := lockfile.PipenvLockExtractor{}
return extractor.Extract(depFile)
default:
return nil, fmt.Errorf("unsupported PyPI lockfile: %s", filename)
}
}
// ExtractorManager manages all ecosystem extractors
type ExtractorManager struct {
extractors map[packagev1.Ecosystem]EcosystemExtractor
extractors map[PackageManagerName]PackageManagerExtractor
}
func NewExtractorManager() *ExtractorManager {
return &ExtractorManager{
extractors: map[packagev1.Ecosystem]EcosystemExtractor{
packagev1.Ecosystem_ECOSYSTEM_NPM: &NpmExtractor{},
packagev1.Ecosystem_ECOSYSTEM_PYPI: &PyPiExtractor{},
extractors: map[PackageManagerName]PackageManagerExtractor{
Npm: &NpmExtractor{},
Pnpm: &PnpmExtractor{},
Pip: &PipExtractor{},
},
}
}
func (em *ExtractorManager) GetExtractorForEcosystem(ecosystem packagev1.Ecosystem) (EcosystemExtractor, bool) {
extractor, exists := em.extractors[ecosystem]
return extractor, exists
func (e *ExtractorManager) GetExtractorForPackageManager(pmn PackageManagerName) PackageManagerExtractor {
return e.extractors[pmn]
}
func (em *ExtractorManager) GetSupportedFilesForEcosystem(ecosystem packagev1.Ecosystem) []string {
if extractor, exists := em.extractors[ecosystem]; exists {
return extractor.GetSupportedFiles()
}
return nil
}
func (em *ExtractorManager) GetAllSupportedFiles() []string {
var allFiles []string
for _, extractor := range em.extractors {
allFiles = append(allFiles, extractor.GetSupportedFiles()...)
}
return allFiles
func (e *ExtractorManager) GetSupportedFilesForPackageManager(pmn PackageManagerName) []string {
return e.extractors[pmn].GetSupportedFiles()
}