Skip to content

Add cargo purl_type to package_metadata sync

Igor Frenkel requested to merge 456283-enable-pm-sync-for-cargo into master

What does this MR do and why?

This change allows a GitLab instance to pull in cargo package metadata for use in identifying licenses for projects with cargo dependencies.

This MR first of 2:

  1. Add cargo as valid type to sbom functionality and package_metadata sync 👈 this MR.
  2. Add cargo to enabled instance purl_types so that package_metadata for this can be ingested: Add cargo purl_type to application setting (!156072 - merged) • Igor Frenkel • 17.2

How to set up and validate locally

In rails console:

  1. puts PackageMetadata::Package.where(purl_type: :cargo).count # 0

  2. Enable the type via application settings.

    ap = ApplicationSetting.last
    ap.package_metadata_purl_types = [14]
    ap.save
  3. Run sync.

    lease = Gitlab::ExclusiveLease.new("sync-licenses", timeout: 5.minute); lease.try_obtain
    PackageMetadata::SyncService.execute(data_type: 'licenses', lease: lease)
  4. puts PackageMetadata::Package.where(purl_type: :cargo).count # ~15k

Related to Update package metadata ingestion to add sync f... (#456283 - closed) • Igor Frenkel • 17.2 • Needs attention

Edited by Igor Frenkel

Merge request reports