[PPSC-877] fix(supply-chain): address PR #209 review comments#210
Merged
Conversation
Resolve four correctness edge cases raised by Copilot on PR #209 (merged before they were addressed), all in the Python release-age enforcement path: - pip.go: raise the bufio.Scanner token buffer to maxLockfileSize so requirements.txt lines bloated with --hash entries no longer fail with "token too long" - shell.go: DetectPipVariants now requires an execute bit, so a non-runnable pip-named file on PATH no longer produces a dead wrapper - check.go: isRequirementsFile matches a "requirements*" basename or a "requirements/" directory segment instead of a loose substring, so files like myrequirements.txt are not misclassified as pip (which would parse empty and report a false "all clear") - pypi.go: NewPyPIClientWithHTTP nil-guards the injected client to avoid a nil-pointer panic at httpClient.Do() Also replace a hand-rolled equalStrings test helper with slices.Equal to clear a gosec G602 false positive surfaced by the new test. Adds regression tests for each fix.
|
There was a problem hiding this comment.
Pull request overview
This PR tightens the Python supply-chain enforcement edge cases introduced in #209 by making pip requirements parsing more robust, improving pip binary detection on PATH, refining requirements file classification, and hardening the PyPI client constructor against nil injection.
Changes:
- Increase
bufio.Scannerbuffer inParsePipRequirementsto handle longrequirements.txtlines (e.g., many--hashentries) without “token too long” failures. - Make
DetectPipVariantsignore pip-named non-executable files and add a regression test for that behavior. - Refine requirements file detection to avoid misclassifying unrelated
*requirements*.txtfilenames; add targeted tests. - Add nil-guarding to
NewPyPIClientWithHTTPand cover it with a unit test; replace custom slice comparison helper withslices.Equal.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| internal/supplychain/shell.go | Adds an execute-bit check when detecting pip variants on PATH. |
| internal/supplychain/shell_test.go | Uses slices.Equal, adds a regression test for non-executable pip-named files. |
| internal/supplychain/registry/pypi.go | Defaults a nil injected HTTP client to avoid nil-pointer panics. |
| internal/supplychain/registry/pypi_test.go | Adds a regression test ensuring nil injected client defaults correctly. |
| internal/supplychain/check/pip.go | Raises scanner token limit up to maxLockfileSize to parse long lines. |
| internal/supplychain/check/pip_test.go | Adds a regression test for parsing long requirements lines. |
| internal/supplychain/check/check.go | Tightens isRequirementsFile matching to avoid substring false positives. |
| internal/supplychain/check/check_test.go | Adds tests ensuring substring-only matches don’t classify as pip ecosystem. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+332
to
+333
| info, err := entry.Info() | ||
| if err != nil || info.Mode().Perm()&0o111 == 0 { |
Comment on lines
+372
to
+373
| t.Run("ignores non-executable pip-named files", func(t *testing.T) { | ||
| dir := t.TempDir() |
The execute-bit filter added to DetectPipVariants (Perm()&0o111) assumes Unix permission semantics. On Windows os.FileMode.Perm never sets the execute bits (executability is governed by file extension via PATHEXT), so the filter rejected every real pip and collapsed detection to the ["pip"] fallback, failing TestDetectPipVariants on windows-latest CI. Gate the execute-bit check behind runtime.GOOS != goosWindows so Windows keeps its prior name-match behavior while Unix retains the improvement, and skip the Unix-only "ignores non-executable" subtest on Windows. Introduce a shared goosWindows constant for the package's platform guards.
Test Coverage Reporttotal: (statements) 68.6% Coverage by function |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related Issue
Type of Change
Problem
PR #209 (Python package release-age enforcement) was merged before four Copilot review comments could be addressed, leaving correctness edge cases in the Python enforcement path.
Solution
This PR resolves all four:
ParsePipRequirementsraises itsbufio.Scannerbuffer tomaxLockfileSizeso--hash-bloatedrequirements.txtlines no longer fail with "token too long";DetectPipVariantsnow requires an execute bit so non-runnable pip-named files onPATHdon't produce dead wrappers;isRequirementsFilematches arequirements*basename orrequirements/directory segment instead of a loose substring, so files likemyrequirements.txtaren't misclassified as pip (which would parse empty and report a false "all clear"); andNewPyPIClientWithHTTPnil-guards its injected client to avoid a nil-pointer panic. A hand-rolledequalStringstest helper was also swapped forslices.Equalto clear a gosec G602 false positive surfaced by the new tests.Testing
Automated Tests
Manual Testing
go test ./...passes across all packages;golangci-lint run ./...reports 54 issues, identical tomain(zero introduced by this branch);make buildproduces the binary. Each of the four fixes has a dedicated regression test (long-line parsing, non-executable pip filtering,myrequirements.txtmisclassification, nil-client defaulting).Reviewer Notes
These are edge-case corrections to the unreleased Python feature from #209, so no CHANGELOG entry was added (the
[Unreleased]section does not yet list the feature itself). The pre-existing CWE-426 false positive atsupply_chain_wrap.go:194is untouched and remains documented with its inlinearmis:ignoredirective from #209.Checklist