google / google/osv.dev

Support commit enumeration on pathologically large repositories

Open
#2,293 1 comment 0 reactions 0 assignees View on GitHub
backlog infra worker
Dominant language
Go
Stars
2.9k
Forks
369
Avg merge
1d 17h
Merged PRs (30d)
149

Description

**Describe the bug**
There are a few Git repositories in the wild that have a pathologically large number of branches:
- https://github.com/mariadb/server
- https://gitlab.com/gitlab-org/gitlab
- https://github.com/openjdk/jdk

are ones that I have organically encountered while investigating the treatment of converted CVEs relating to them.

**To Reproduce**
Steps to reproduce the behaviour:
1. Run the script below on CVE-2022-21296
2. Observe the length of time it takes to complete
3. I believe this exceeds the maximum time the OSV.dev worker currently permits a task to run for

**Expected behaviour**
When OSV.dev's worker infrastructure performs commit enumeration, it completes, regardless of the repository

**Additional context**
```
#!/bin/bash

CVE=$1

gsutil cp gs://cve-osv-conversion/osv-output/${CVE}.json /tmp
pipenv run python -m osv.analyze_tool --analyze_git=true --format=json /tmp/${CVE}.json
cat /tmp/${CVE}.json
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.