Wrong deploy commands reported by the build as code check for pkg:maven/dev.sigstore/sigstore-maven-plugin@1.0.0
Open
Nobody has claimed this yet.
bug
- Dominant language
- Python
- Stars
- 210
- Forks
- 36
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 2
Description
Reproducing the issue
macaron analyze -purl pkg:maven/dev.sigstore/sigstore-maven-plugin@1.0.0
The Build As Code check passed with the following two deploy commands:
["mvn", "clean", "deploy", "--no-transfer-progress", "$@"]["mvn", "clean", "deploy", "--no-transfer-progress", "$@"]
Initial investigation
Looking through its source code - https://github.com/sigstore/sigstore-java/tree/v1.0.0 shows that it's a Gradle project.
The 2 deploys commands are extracted from https://github.com/sigstore/sigstore-java/blob/d2603344a9357cb73142cb65caf5f39ddb428395/.github/workflows/examples.yaml (as shown in the database).
At this line it ran a shell script, which contains that mvn command - here.
Macaron reports 2 build tools for this PURL: gradle and maven.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.