edoardottt / depsdev Goto Github PK

CLI client (and Golang module) for deps.dev API. Free access to dependencies, licenses, advisories, and other critical health and security signals for open source package versions.

Home Page: https://deps.dev

License: Apache License 2.0

Go 99.18% Makefile 0.82%

cargo dependency dependency-management dependency-scanning dependency-security go maven npm nuget package-security

depsdev's Introduction

depsdev

CLI client (and Golang module) for deps.dev API.
Free access to dependencies, licenses, advisories, and other critical health and security signals for open source package versions.

Coded with 💙 by edoardottt

Share on Twitter!

Install • Get Started • Examples • Changelog • Contributing • License

Install 📡

Using Snap

sudo snap install depsdev

Using Go

go install github.com/edoardottt/depsdev@latest

Get Started 🎉

Usage:
  depsdev [command]

Available Commands:
  advisory    Get info about an (OSV) advisory
  completion  Generate the autocompletion script for the specified shell
  deps        Get info about a package's dependencies
  graph       Generate a Graphviz compatible dependencies graph
  help        Help about any command
  info        Get info about a package or a specific version of that
  packages    Get info about a project's package versions (GitHub, GitLab, or BitBucket)
  project     Get info about a project (GitHub, GitLab, or BitBucket)
  query       Get info about multiple package versions using a query
  reqs        Get info about a package's requirements

Flags:
  -h, --help   help for depsdev

Use "depsdev [command] --help" for more information about a command.

Examples 💡

Note The supported package managers are go, npm, cargo, maven, pypi and nuget. For more information read the API documentation.

Get information about a package, including a list of its available versions, with the default version marked if known.

depsdev info npm @colors/colors

Get information about a specific package version including its licenses and any security advisories known to affect it.

depsdev info npm @colors/colors 1.5.0

Get information about a resolved dependency graph for the given package version.

depsdev deps npm @colors/colors 1.5.0

Get information about projects hosted by GitHub, GitLab, or BitBucket (if available).

depsdev project github.com/facebook/react

Get information about security advisories hosted by OSV.

depsdev advisory GHSA-2qrg-x229-3v8q

Get information about multiple package versions, which can be specified by name, content hash, or both.

depsdev query "versionKey.system=NPM&versionKey.name=react&versionKey.version=18.2.0"

Generate a Graphviz compatible dependencies graph for a specific version of a package.

depsdev graph npm slice-ansi 6.0.0

Get information about the package requirements for a given version in a system-specific format.

depsdev reqs npm slice-ansi 6.0.0

Returns known mappings between the requested project and package versions.

depsdev packages github.com/eslint/espree

Use depsdev as a Go module

import (
    "fmt"
    "github.com/edoardottt/depsdev/pkg/depsdev"
)

func main() {
    client := depsdev.NewAPI()
    i, err := client.GetInfo("npm", "defangjs")
    if err != nil {
      fmt.Println(err)
    }
    
    fmt.Println(i)
}

Read the full package documentation here

Changelog 📌

Detailed changes for each release are documented in the release notes.

Contributing 🛠

Just open an issue / pull request.

Before opening a pull request, download golangci-lint and run

golangci-lint run

If there aren't errors, go ahead :)

The HTTP client implementation is partially taken from @liamg/hackerone.

License 📝

This repository is under Apache2.0 License.
edoardoottavianelli.it to contact me.

depsdev's People

Contributors

Stargazers

Watchers

Forkers

zaibon runz0rd carlospatinos ritish134 alexrogalskiy noqcks fproulx-boostsecurity

depsdev's Issues

Add a link to the package documentation in the README

Add this

Read the full [`package documentation here`](https://pkg.go.dev/github.com/edoardottt/depsdev/pkg/depsdev)

under the example in subsection Use depsdev as a Go module in the README

Update README for v3-v3alpha

move top level functions as method on the Client struct

Is your feature request related to a problem? Please describe.
The way the main-level functions are organized prevents the reuse of an HTTP client and thus forces the creation of a new TCP connection for every function call.

Here is the list of the functions I talking about:

func GetInfo
func GetVersion
func GetDependencies
func GetProject
func GetAdvisory
func GetQuery

Mainly all the exported functions in this file https://github.com/edoardottt/depsdev/blob/main/pkg/depsdev/api.go

Describe the solution you'd like
These functions should be converted to methods on a struct that encapsulates the Client struct
This way, the HTTP client would be kept between requests, which in turn would allow to re-use the TCP connection.

Additional context
I've run a very simple benchmark to highlight the potential gain of this change.
I've benchmarked the GetInfo and GetVersion API calls.
Here are the results:

goos: darwin
goarch: arm64
pkg: github.com/edoardottt/depsdev/pkg/depsdev
             │ functions.perf │             methods.perf             │
             │     sec/op     │    sec/op     vs base                │
GetInfo-8       143.66m ±  6%   78.47m ± 15%  -45.38% (p=0.000 n=10)
GetVersion-8    119.86m ± 16%   53.91m ±  6%  -55.02% (p=0.000 n=10)
geomean          131.2m         65.04m        -50.43%

The code of the benchmark can be found at https://github.com/zaibon/depsdev/blob/reuse-http-client/pkg/depsdev/api_test.go

Add support for v3

At the moment v3alpha is supported.

Add the choice of using v3 or v3alpha (go package).

GetProject method sometime fails due to wrong type return by the depsdev API

Describe the bug
Some project detail in the depsdev database have the wrong type in the ossFuzz object.
Example: https://api.deps.dev/v3alpha/projects/github.com%2Fklauspost%2Fcompress

lineCount and lineCoverCount are strings while they should be integer. This prevents the unmarshaling of this project by this library.

To Reproduce
Steps to reproduce the behavior:

use the GetProject with argument "github.com/klauspost/compress"

Expected behavior
Get project details from the API

upstreamIdentifiers v3alpha

Now v3alpha supports upstreamIdentifiers.

Add ProjectPackageVersions as subcommand

See https://docs.deps.dev/api/v3alpha/#getprojectpackageversions.

The PR should add the subcommand (in the cmd folder), the API structs and the methods necessary to interact with the API.

Ping me here if you need additional help :)

Project structure contains field with wrong type

Describe the bug

Some field of the Project struct have changed type on deps.dev service and are not updated in this library.
Fields are:

OpenIssuesCount
StarsCount
ForksCount

They all should be integer instead of string.

To Reproduce
Steps to reproduce the behavior:

Check response from API call of getProject endpoint:

Expected behavior
This library should update the type of the field to string so it can properly decode the json sent by deps.dev API.

Add graph subcommand

Add graph subcommand like in the google repo.

Add test for standard queries per doc

e.g. https://docs.deps.dev/api/v3/#getpackage

Add Support for SimilarlyNamedPackages

https://docs.deps.dev/api/v3alpha/index.html#getsimilarlynamedpackages

Ping me here if you need additional help :)

CLI support for new v3alpha APIs

Add Goreleaser

In resource-constrained environments we sometimes cannot afford to install full-blown Go + build packages with it: good practice is to have pre-packaged binary releases for each platform.

You can include this in a GitHub action workflow, by leveraging something like the https://github.com/marketplace/actions/go-release-binaries action which automates the process.

For reference: