github / github/codeql

Issues using published codeql pack

Abierto
#15,400 17 comentarios 0 reacciones 0 asignados Ver en GitHub
question
Lenguaje dominante
CodeQL
Estrellas
10.1k
Forks
2.1k
Merge medio
2 d 15 h
PR fusionados (30 d)
141

Descripción

**Description of the issue**
I published a custom CodeQL pack and am trying to test it on a new machine but I am running into some unexpected behavior. I have reproduced the issue with codeql cli version 2.15.4 and 2.16.0

in the qlpack.yml file I have the following dependencies
```
dependencies:
codeql/cpp-queries: 0.9.0
codeql/cpp-all: 0.12.1
```
(I also tried using "*" as the version instead of specifying a version and get the same result)

I run codeql pack install to install these to my machine before publishing.

I then run codeql pack publish.

On the new machine I run `codeql pack download ` and it successfully downloads the pack.

I then try to use the new pack to analyze a database but get an error stating codeql/cpp-queries@0.9.0 cannot be found.
```
A fatal error occurred: The QL pack 'codeql/cpp-queries@0.9.0' which is referenced from cannot be found.
```
After this I try running `codeql pack install` on the install directory of my codeql pack. This generates several warnings about packs being found via "--additional-packs" and nothing gets installed.
```

WARNING: Pack 'codeql/cpp-all' was found via '--additional-packs'. If the generated 'codeql-pack.lock.yml' file is committed to source control, other users will also have to use '--additional-packs' when compiling or running queries. (\.codeql\libraries\codeql\cpp-all\0.12.3\qlpack.yml:1,1-1)
WARNING: Pack 'codeql/dataflow' was found via '--additional-packs'. If the generated 'codeql-pack.lock.yml' file is committed to source control, other users will also have to use '--additional-packs' when compiling or running queries. (\.codeql\libraries\codeql\dataflow\0.1.6\qlpack.yml:1,1-1)
WARNING: Pack 'codeql/rangeanalysis' was found via '--additional-packs'. If the generated 'codeql-pack.lock.yml' file is committed to source control, other users will also have to use '--additional-packs' when compiling or running queries. (\.codeql\libraries\codeql\rangeanalysis\0.0.5\qlpack.yml:1,1-1)
WARNING: Pack 'codeql/ssa' was found via '--additional-packs'. If the generated 'codeql-pack.lock.yml' file is committed to source control, other users will also have to use '--additional-packs' when compiling or running queries. (.codeql\libraries\codeql\ssa\0.2.6\qlpack.yml:1,1-1)
WARNING: Pack 'codeql/tutorial' was found via '--additional-packs'. If the generated 'codeql-pack.lock.yml' file is committed to source control, other users will also have to use '--additional-packs' when compiling or running queries. (.codeql\libraries\codeql\tutorial\0.2.6\qlpack.yml:1,1-1)
WARNING: Pack 'codeql/typetracking' was found via '--additional-packs'. If the generated 'codeql-pack.lock.yml' file is committed to source control, other users will also have to use '--additional-packs' when compiling or running queries. (.codeql\libraries\codeql\typetracking\0.2.6\qlpack.yml:1,1-1)
WARNING: Pack 'codeql/util' was found via '--additional-packs'. If the generated 'codeql-pack.lock.yml' file is committed to source control, other users will also have to use '--additional-packs' when compiling or running queries. (\.codeql\libraries\codeql\util\0.2.6\qlpack.yml:1,1-1)
WARNING: To avoid these warnings in the future, use the '--no-strict-mode' option. (\qlpack.yml:1,1-1)
Dependencies resolved. Installing packages...
Install location: C:\Users\Administrator\.codeql\packages
Nothing to install.
Package install location: C:\Users\Administrator\.codeql\packages
Nothing downloaded.
```

Trying to analyze a database again results in the same error that codeql/cpp-queries@0.9.0 cannot be found.

However, if again run `codeql pack install` on the install directory of my codeql pack, it runs without warnings, the dependencies are downloaded, and I can run analysis.

If I try using the "--no-strict-mode" flag when running the install command, it will again not install anything the first time (this time without warnings) and I get errors trying to analyze, then if I rung the command a second time it will download the dependencies. (same behavior as without --no-strict-mode but this time without showing warnings)

My main questions are:

1. Why I get these warnings when trying to install dependencies
1. Why I need to run the command twice to get the expected behavior
1. If this behavior actually is expected, is something specific I need to do to avoid it

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

Reproduce the report with CodeQL CLI 2.15.4 or 2.16.0 using the dependencies in qlpack.yml and the sequence of pack install, publish, and download commands. Compare the first and second install attempts and the --additional-packs warnings, then determine the expected dependency-install behavior. Done means the published pack can be downloaded and analyzed on a new machine without a second install attempt.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Área
devtools, security
Tipo de issue
Error
Dificultad
4/5
Tiempo estimado
3-5 días
Estado de actividad
Estancado
Claridad
Necesita aclaración
Aptitud para principiantes
28/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.