guac
guac copied to clipboard
[feature] Certifier should use a more specific query and not get all nouns
Is your feature request related to a problem? Please describe.
Currently, the certifier query for all packages (for osv) and sources (for scorecard). After the packages are obtained, a neighbors query is called either search for certVuln or scorecard node respectively.
This is very inefficient and results in queries hitting issues specified in the issue https://github.com/guacsec/guac/issues/1848.
Describe the solution you'd like
Instead, a specific query should be created (that can be used by the certifiers) for just the packages or sources that need to be either checked or updated (based on a timestamp being set). All the filtering will be done by the database query which will be much more efficient. We may still face the parameter issue faced in issue https://github.com/guacsec/guac/issues/1848 so pagination will still be required.
Describe alternatives you've considered Keep it as it is but as the scale of the DB grows, it will become inefficient.