|
| 1 | +# Copyright (c) 2026 - 2026, Oracle and/or its affiliates. All rights reserved. |
| 2 | +# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/. |
| 3 | + |
| 4 | +"""This module contains the Uv class which inherits BaseBuildTool. |
| 5 | +
|
| 6 | +This module is used to work with repositories that use uv for dependency management. |
| 7 | +""" |
| 8 | + |
| 9 | +import os |
| 10 | + |
| 11 | +from cyclonedx_py import __version__ as cyclonedx_version |
| 12 | + |
| 13 | +from macaron.config.defaults import defaults |
| 14 | +from macaron.config.global_config import global_config |
| 15 | +from macaron.database.table_definitions import Component |
| 16 | +from macaron.dependency_analyzer.cyclonedx import DependencyAnalyzer |
| 17 | +from macaron.dependency_analyzer.cyclonedx_python import CycloneDxPython |
| 18 | +from macaron.slsa_analyzer.build_tool import pyproject |
| 19 | +from macaron.slsa_analyzer.build_tool.base_build_tool import ( |
| 20 | + BaseBuildTool, |
| 21 | + BuildToolCommand, |
| 22 | + BuildToolConfig, |
| 23 | + file_exists, |
| 24 | +) |
| 25 | +from macaron.slsa_analyzer.build_tool.language import BuildLanguage |
| 26 | +from macaron.slsa_analyzer.checks.check_result import Confidence |
| 27 | + |
| 28 | + |
| 29 | +class Uv(BaseBuildTool): |
| 30 | + """This class contains the information of the uv build tool.""" |
| 31 | + |
| 32 | + def __init__(self) -> None: |
| 33 | + """Initialize instance.""" |
| 34 | + super().__init__(name="uv", language=BuildLanguage.PYTHON, purl_type="pypi") |
| 35 | + |
| 36 | + def load_defaults(self) -> None: |
| 37 | + """Load the default values from defaults.ini.""" |
| 38 | + super().load_defaults() |
| 39 | + if "builder.uv" in defaults: |
| 40 | + for item in defaults["builder.uv"]: |
| 41 | + if hasattr(self, item): |
| 42 | + setattr(self, item, defaults.get_list("builder.uv", item)) |
| 43 | + |
| 44 | + if "builder.uv.ci.deploy" in defaults: |
| 45 | + for item in defaults["builder.uv.ci.deploy"]: |
| 46 | + if item in self.ci_deploy_kws: |
| 47 | + self.ci_deploy_kws[item] = defaults.get_list("builder.uv.ci.deploy", item) |
| 48 | + |
| 49 | + def is_detected(self, target: Component) -> list[BuildToolConfig]: |
| 50 | + """ |
| 51 | + Return the list of build tools and their information used in the target repo. |
| 52 | +
|
| 53 | + Parameters |
| 54 | + ---------- |
| 55 | + target : Component |
| 56 | + The target software component. |
| 57 | +
|
| 58 | + Returns |
| 59 | + ------- |
| 60 | + list[BuildToolConfig] |
| 61 | + See ``BuildToolConfig`` in ``base_build_tool.py`` for field definitions. |
| 62 | + """ |
| 63 | + repo_path, _, _ = self.resolve_component_detection_target(target) |
| 64 | + if not repo_path: |
| 65 | + return [] |
| 66 | + |
| 67 | + package_lock_exists = "" |
| 68 | + for file in self.package_lock: |
| 69 | + if file_exists(repo_path, file, filters=self.path_filters): |
| 70 | + package_lock_exists = file |
| 71 | + break |
| 72 | + |
| 73 | + results: list[BuildToolConfig] = [] |
| 74 | + confidence_score = 1.0 |
| 75 | + file_paths = (file_exists(repo_path, file, filters=self.path_filters) for file in self.build_configs) |
| 76 | + for config_path in file_paths: |
| 77 | + if config_path and os.path.basename(config_path) == "pyproject.toml": |
| 78 | + if package_lock_exists: |
| 79 | + results.append((str(config_path.relative_to(repo_path)), confidence_score, None, None)) |
| 80 | + elif pyproject.contains_build_tool("uv", config_path): |
| 81 | + results.append((str(config_path.relative_to(repo_path)), confidence_score, None, None)) |
| 82 | + else: |
| 83 | + for tool in self.build_requires + self.build_backend: |
| 84 | + if pyproject.build_system_contains_tool(tool, config_path): |
| 85 | + results.append((str(config_path.relative_to(repo_path)), confidence_score, None, None)) |
| 86 | + break |
| 87 | + |
| 88 | + confidence_score = confidence_score / 2 |
| 89 | + |
| 90 | + return results |
| 91 | + |
| 92 | + def get_dep_analyzer(self) -> DependencyAnalyzer: |
| 93 | + """Create a DependencyAnalyzer for the build tool. |
| 94 | +
|
| 95 | + Returns |
| 96 | + ------- |
| 97 | + DependencyAnalyzer |
| 98 | + The DependencyAnalyzer object. |
| 99 | + """ |
| 100 | + return CycloneDxPython( |
| 101 | + resources_path=global_config.resources_path, |
| 102 | + file_name="python_sbom.json", |
| 103 | + tool_name="cyclonedx_py", |
| 104 | + tool_version=cyclonedx_version, |
| 105 | + ) |
| 106 | + |
| 107 | + def is_deploy_command( |
| 108 | + self, cmd: BuildToolCommand, excluded_configs: list[str] | None = None, provenance_workflow: str | None = None |
| 109 | + ) -> tuple[bool, Confidence]: |
| 110 | + """ |
| 111 | + Determine if the command is a deploy command. |
| 112 | +
|
| 113 | + Parameters |
| 114 | + ---------- |
| 115 | + cmd: BuildToolCommand |
| 116 | + The build tool command object. |
| 117 | + excluded_configs: list[str] | None |
| 118 | + Build tool commands that are called from these configuration files are excluded. |
| 119 | + provenance_workflow: str | None |
| 120 | + The relative path to the root CI file that is captured in a provenance or None if provenance is not found. |
| 121 | +
|
| 122 | + Returns |
| 123 | + ------- |
| 124 | + tuple[bool, Confidence] |
| 125 | + Return True along with the inferred confidence level if the command is a deploy tool command. |
| 126 | + """ |
| 127 | + if cmd["language"] is not self.language: |
| 128 | + return False, Confidence.HIGH |
| 129 | + |
| 130 | + build_cmd = cmd["command"] |
| 131 | + cmd_program_name = os.path.basename(build_cmd[0]) |
| 132 | + |
| 133 | + deploy_tools = self.publisher if self.publisher else self.builder |
| 134 | + deploy_args = self.deploy_arg |
| 135 | + |
| 136 | + if cmd_program_name in self.interpreter and len(build_cmd) > 2 and build_cmd[1] in self.interpreter_flag: |
| 137 | + build_cmd = build_cmd[2:] |
| 138 | + |
| 139 | + if not self.match_cmd_args(cmd=build_cmd, tools=deploy_tools, args=deploy_args): |
| 140 | + return False, Confidence.HIGH |
| 141 | + |
| 142 | + if excluded_configs and os.path.basename(cmd["ci_path"]) in excluded_configs: |
| 143 | + return False, Confidence.HIGH |
| 144 | + |
| 145 | + return True, self.infer_confidence_deploy_command(cmd, provenance_workflow) |
| 146 | + |
| 147 | + def is_package_command( |
| 148 | + self, cmd: BuildToolCommand, excluded_configs: list[str] | None = None |
| 149 | + ) -> tuple[bool, Confidence]: |
| 150 | + """ |
| 151 | + Determine if the command is a packaging command. |
| 152 | +
|
| 153 | + Parameters |
| 154 | + ---------- |
| 155 | + cmd: BuildToolCommand |
| 156 | + The build tool command object. |
| 157 | + excluded_configs: list[str] | None |
| 158 | + Build tool commands that are called from these configuration files are excluded. |
| 159 | +
|
| 160 | + Returns |
| 161 | + ------- |
| 162 | + tuple[bool, Confidence] |
| 163 | + Return True along with the inferred confidence level if the command is a build tool command. |
| 164 | + """ |
| 165 | + if cmd["language"] is not self.language: |
| 166 | + return False, Confidence.HIGH |
| 167 | + |
| 168 | + build_cmd = cmd["command"] |
| 169 | + cmd_program_name = os.path.basename(build_cmd[0]) |
| 170 | + if not cmd_program_name: |
| 171 | + return False, Confidence.HIGH |
| 172 | + |
| 173 | + builder = self.packager if self.packager else self.builder |
| 174 | + build_args = self.build_arg |
| 175 | + |
| 176 | + if cmd_program_name in self.interpreter and len(build_cmd) > 2 and build_cmd[1] in self.interpreter_flag: |
| 177 | + build_cmd = build_cmd[2:] |
| 178 | + |
| 179 | + if not self.match_cmd_args(cmd=build_cmd, tools=builder, args=build_args): |
| 180 | + return False, Confidence.HIGH |
| 181 | + |
| 182 | + if excluded_configs and os.path.basename(cmd["ci_path"]) in excluded_configs: |
| 183 | + return False, Confidence.HIGH |
| 184 | + |
| 185 | + return True, Confidence.HIGH |
0 commit comments