oracle / oracle/macaron

Wrong deploy commands reported by the build as code check for pkg:maven/dev.sigstore/sigstore-maven-plugin@1.0.0

Open
#937 0 comments 0 reactions 1 assignee View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Python
Stars
210
Forks
36
Avg merge
1d 10h
Merged PRs (30d)
2

Description

Reproducing the issue

macaron analyze -purl pkg:maven/dev.sigstore/sigstore-maven-plugin@1.0.0

The Build As Code check passed with the following two deploy commands:

  • ["mvn", "clean", "deploy", "--no-transfer-progress", "$@"]
  • ["mvn", "clean", "deploy", "--no-transfer-progress", "$@"]

Initial investigation

Looking through its source code - https://github.com/sigstore/sigstore-java/tree/v1.0.0 shows that it's a Gradle project.

The 2 deploys commands are extracted from https://github.com/sigstore/sigstore-java/blob/d2603344a9357cb73142cb65caf5f39ddb428395/.github/workflows/examples.yaml (as shown in the database).

At this line it ran a shell script, which contains that mvn command - here.

Macaron reports 2 build tools for this PURL: gradle and maven.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.