GithubHelp home page GithubHelp logo

edoardottt / depsdev Goto Github PK

View Code? Open in Web Editor NEW
39.0 3.0 7.0 161 KB

CLI client (and Golang module) for deps.dev API. Free access to dependencies, licenses, advisories, and other critical health and security signals for open source package versions.

Home Page: https://deps.dev

License: Apache License 2.0

Go 99.18% Makefile 0.82%
cargo dependency dependency-management dependency-scanning dependency-security go maven npm nuget package-security

depsdev's Introduction

depsdev

CLI client (and Golang module) for deps.dev API.
Free access to dependencies, licenses, advisories, and other critical health and security signals for open source package versions.

Coded with ๐Ÿ’™ by edoardottt

go action go report card
Share on Twitter!

Install โ€ข Get Started โ€ข Examples โ€ข Changelog โ€ข Contributing โ€ข License

Install ๐Ÿ“ก

Using Snap

sudo snap install depsdev

Using Go

go install github.com/edoardottt/depsdev@latest

Get Started ๐ŸŽ‰

Usage:
  depsdev [command]

Available Commands:
  advisory    Get info about an (OSV) advisory
  completion  Generate the autocompletion script for the specified shell
  deps        Get info about a package's dependencies
  graph       Generate a Graphviz compatible dependencies graph
  help        Help about any command
  info        Get info about a package or a specific version of that
  packages    Get info about a project's package versions (GitHub, GitLab, or BitBucket)
  project     Get info about a project (GitHub, GitLab, or BitBucket)
  query       Get info about multiple package versions using a query
  reqs        Get info about a package's requirements

Flags:
  -h, --help   help for depsdev

Use "depsdev [command] --help" for more information about a command.

Examples ๐Ÿ’ก

Note The supported package managers are go, npm, cargo, maven, pypi and nuget. For more information read the API documentation.


Get information about a package, including a list of its available versions, with the default version marked if known.

depsdev info npm @colors/colors

Get information about a specific package version including its licenses and any security advisories known to affect it.

depsdev info npm @colors/colors 1.5.0

Get information about a resolved dependency graph for the given package version.

depsdev deps npm @colors/colors 1.5.0

Get information about projects hosted by GitHub, GitLab, or BitBucket (if available).

depsdev project github.com/facebook/react

Get information about security advisories hosted by OSV.

depsdev advisory GHSA-2qrg-x229-3v8q

Get information about multiple package versions, which can be specified by name, content hash, or both.

depsdev query "versionKey.system=NPM&versionKey.name=react&versionKey.version=18.2.0"

Generate a Graphviz compatible dependencies graph for a specific version of a package.

depsdev graph npm slice-ansi 6.0.0

Get information about the package requirements for a given version in a system-specific format.

depsdev reqs npm slice-ansi 6.0.0

Returns known mappings between the requested project and package versions.

depsdev packages github.com/eslint/espree

Use depsdev as a Go module

import (
    "fmt"
    "github.com/edoardottt/depsdev/pkg/depsdev"
)

func main() {
    client := depsdev.NewAPI()
    i, err := client.GetInfo("npm", "defangjs")
    if err != nil {
      fmt.Println(err)
    }
    
    fmt.Println(i)
}

Read the full package documentation here

Changelog ๐Ÿ“Œ

Detailed changes for each release are documented in the release notes.

Contributing ๐Ÿ› 

Just open an issue / pull request.

Before opening a pull request, download golangci-lint and run

golangci-lint run

If there aren't errors, go ahead :)

The HTTP client implementation is partially taken from @liamg/hackerone.

License ๐Ÿ“

This repository is under Apache2.0 License.
edoardoottavianelli.it to contact me.

depsdev's People

Contributors

dependabot[bot] avatar edoardottt avatar noqcks avatar ritish134 avatar runz0rd avatar zaibon avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar

depsdev's Issues

move top level functions as method on the Client struct

Is your feature request related to a problem? Please describe.
The way the main-level functions are organized prevents the reuse of an HTTP client and thus forces the creation of a new TCP connection for every function call.

Here is the list of the functions I talking about:

func GetInfo
func GetVersion
func GetDependencies
func GetProject
func GetAdvisory
func GetQuery

Mainly all the exported functions in this file https://github.com/edoardottt/depsdev/blob/main/pkg/depsdev/api.go

Describe the solution you'd like
These functions should be converted to methods on a struct that encapsulates the Client struct
This way, the HTTP client would be kept between requests, which in turn would allow to re-use the TCP connection.

Additional context
I've run a very simple benchmark to highlight the potential gain of this change.
I've benchmarked the GetInfo and GetVersion API calls.
Here are the results:

goos: darwin
goarch: arm64
pkg: github.com/edoardottt/depsdev/pkg/depsdev
             โ”‚ functions.perf โ”‚             methods.perf             โ”‚
             โ”‚     sec/op     โ”‚    sec/op     vs base                โ”‚
GetInfo-8       143.66m ยฑ  6%   78.47m ยฑ 15%  -45.38% (p=0.000 n=10)
GetVersion-8    119.86m ยฑ 16%   53.91m ยฑ  6%  -55.02% (p=0.000 n=10)
geomean          131.2m         65.04m        -50.43%

The code of the benchmark can be found at https://github.com/zaibon/depsdev/blob/reuse-http-client/pkg/depsdev/api_test.go

GetProject method sometime fails due to wrong type return by the depsdev API

Describe the bug
Some project detail in the depsdev database have the wrong type in the ossFuzz object.
Example: https://api.deps.dev/v3alpha/projects/github.com%2Fklauspost%2Fcompress

lineCount and lineCoverCount are strings while they should be integer. This prevents the unmarshaling of this project by this library.

To Reproduce
Steps to reproduce the behavior:

  1. use the GetProject with argument "github.com/klauspost/compress"

Expected behavior
Get project details from the API

Project structure contains field with wrong type

Describe the bug

Some field of the Project struct have changed type on deps.dev service and are not updated in this library.
Fields are:

  • OpenIssuesCount
  • StarsCount
  • ForksCount

They all should be integer instead of string.

To Reproduce
Steps to reproduce the behavior:

  1. Check response from API call of getProject endpoint:

Expected behavior
This library should update the type of the field to string so it can properly decode the json sent by deps.dev API.

Add Goreleaser

In resource-constrained environments we sometimes cannot afford to install full-blown Go + build packages with it: good practice is to have pre-packaged binary releases for each platform.

You can include this in a GitHub action workflow, by leveraging something like the https://github.com/marketplace/actions/go-release-binaries action which automates the process.

For reference:

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.