DataDog
Guarddog hangs when using compatible version dependency
requirements.txt
Django~=3.2
requests~=2.28
docker-compose.yml
services:
guarddog:
image: ghcr.io/datadog/guarddog:v0.1.2
volumes:
- ./:/code
Running the command docker-compose run --rm guarddog verify /code/requirements.txt
results in a hang and an output like below
Version 1 for package Django doesn't exist.
Version c for package Django doesn't exist.
Version 3 for package Django doesn't exist.
Version r for package Django doesn't exist.
Version . for package Django doesn't exist.
Version 2 for package Django doesn't exist.
Version 9 for package requests doesn't exist.
Version . for package requests doesn't exist.
Version 2 for package requests doesn't exist.
Right now guarddog returns exit code 255 with a message:
Received Version r for package Django doesn't exist.make: [guarddog] Error 255 (ignored)
This is a bit misleading because ~=3.2 is perfectly fine pinning and I guess in the worst case (because of time) scenario guarddog should check all the versions that match the selection and in the fastest should take only the latest into consideration.
yes the hanging part is fixed but as I already pointed out by solving the hanging problem the way that it's solved guarddog stopped scanning the whole file and just gives up on the first occurance of this problem (a regression of #88 maybe?).
requirements.txt:
Django~=3.2
requests~=2.28
pytest
pytest-django
pytest-randomly
pytest-cov
iPython
this should still check all the remaining items in the list and just report that Django and requests versions are not supported. Currently it's exiting with 255 at the first item. Do you want a new issue, reopen #88 or should the discussion be kept here?
I know we have an inconsistency on this codepath. Thought I would catch it at typing but mypy seems to not be catching it. I want to move forward on the npm support today but once I am good with metadata heuristics there, I'll take a deeper look
