jake icon indicating copy to clipboard operation
jake copied to clipboard

[BUG] No reported vulnerability for conda packages

Open riccardoporreca opened this issue 9 months ago โ€ข 0 comments

Describe the bug I am reporting here the effect of an issue I believe is rather related to the OSS index itself (see https://github.com/sonatype-nexus-community/ossindex-python/issues/19 for details), to make this visible to jake users and to check whether there is any mitigating actions that can be possibly done in jake itself

To Reproduce

  1. Run
    echo "https://repo.anaconda.cloud/repo/main/linux-64/pandas-1.2.5-py39h295c915_0.conda#65bb716eebef11437dd18f0a5902a43b" \
      | jake ddt -t CONDA
    
  2. No vulnerabilities reported
    ๐Ÿ Collected 1 packages from provided specs                          โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” 100% 0:00:00
    ๐Ÿ Successfully queried OSS Index for package and vulnerability info โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” 100% 0:00:00
    ๐Ÿ Sane number of results from OSS Index                             โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” 100% 0:00:00
    ๐Ÿ Munching & crunching data...                                      โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ” 100% 0:00:00
    
    
                        Summary                     
    โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”ณโ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”“
    โ”ƒ Audited Dependencies โ”ƒ Vulnerabilities Found โ”ƒ
    โ”กโ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ•‡โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”โ”ฉ
    โ”‚ 1                    โ”‚ 0                     โ”‚
    โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ดโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜
    
    despite what reported at https://ossindex.sonatype.org/component/pkg:conda/[email protected] (or using the REST API with pkg:conda/[email protected])

Expected behavior Vulnerabilities that exist in the OSS Index should be reported

Desktop (please complete the following information):

  • OS: Red Hat Enterprise Linux 8 (Ootpa)
  • Python Version: 3.11.5
  • Jake Version: 3.0.1

Additional context Add any other context about the problem here.

riccardoporreca avatar Nov 06 '23 13:11 riccardoporreca