Added php lockfile parser #310
Conversation
| @@ -32,6 +32,7 @@ const ( | |||
| EcosystemTerraform = "Terraform" | |||
| EcosystemTerraformModule = "TerraformModule" | |||
| EcosystemTerraformProvider = "TerraformProvider" | |||
| EcosystemPHPComposer = "Composer" | |||
There was a problem hiding this comment.
The Ecosystem for PHP Composer is actually called Packagist
https://osv.dev/list?ecosystem=Packagist
| "github.com/safedep/vet/pkg/models" | ||
| ) | ||
|
|
||
| type ComposerJSON struct { |
There was a problem hiding this comment.
Can you add a comment with reference to Composer JSON specification from official source? We need to see if we need any other information like dependency relationships for building dependency graph.
| @@ -259,6 +263,8 @@ func (pw *parserWrapper) Ecosystem() string { | |||
| return models.EcosystemGitHubActions | |||
| case customParserTerraform: | |||
| return models.EcosystemTerraform | |||
| case customParserComposer: | |||
| return models.EcosystemPHPComposer | |||
There was a problem hiding this comment.
It should be packagist ecosystem
| @@ -51,6 +52,7 @@ var supportedEcosystems map[string]bool = map[string]bool{ | |||
| models.EcosystemSpdxSBOM: true, | |||
| models.EcosystemGitHubActions: true, | |||
| models.EcosystemTerraform: true, | |||
| models.EcosystemPHPComposer: true, | |||
There was a problem hiding this comment.
This is not required. We should just use the Packagist ecosystem
|
@insaaniManav As I read more about Composer, I see there are two files
This is similar to I think we should spend some time reading about Composer and decide on how to handle it. |
|
According to my research
|
Fixes #257