Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade dependencies #277

Merged
merged 1 commit into from
Sep 10, 2024
Merged

Upgrade dependencies #277

merged 1 commit into from
Sep 10, 2024

Conversation

Danielius1922
Copy link
Member

@Danielius1922 Danielius1922 commented Sep 8, 2024

Submodule:
github.com/googleapis/googleapis cb39bdd75da491466f6c92bc73cd46b0fbd6ba9a

Direct:
github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0
github.com/jellydator/ttlcache/v3 v3.3.0
github.com/plgd-dev/device/v2 v2.5.3-0.20240904102627-4c2719d9d856 github.com/plgd-dev/go-coap/v3 v3.3.5-0.20240904100911-1afdeb72cb92 github.com/plgd-dev/hub/v2 v2.24.1-0.20240904204400-509117054bfa go.opentelemetry.io/otel/trace v1.29.0
google.golang.org/grpc v1.66.0

Indirect:
github.com/bufbuild/protocompile v0.14.1
github.com/go-json-experiment/json v0.0.0-20240815174924-0599f16bf0e2 github.com/jhump/protoreflect v1.17.0
github.com/nats-io/nats.go v1.37.0
go.mongodb.org/mongo-driver v1.16.1
go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/mongo/otelmongo v0.54.0 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0 go.opentelemetry.io/otel v1.29.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.29.0 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.29.0 go.opentelemetry.io/otel/metric v1.29.0
go.opentelemetry.io/otel/sdk v1.29.0
golang.org/x/crypto v0.27.0
golang.org/x/exp v0.0.0-20240904232852-e7e105dedf7e golang.org/x/mod v0.20.0
golang.org/x/net v0.29.0
golang.org/x/oauth2 v0.23.0
golang.org/x/sys v0.25.0
golang.org/x/term v0.24.0
golang.org/x/text v0.18.0
golang.org/x/tools v0.24.0
google.golang.org/genproto/googleapis/api v0.0.0-20240903143218-8af14fe29dc1 google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1

Summary by CodeRabbit

  • New Features

    • Enhanced HTTP service with improved URI handling and JWT-based authorization mechanisms.
    • Updated ParseWithClaims method to accept context for better request management.
  • Bug Fixes

    • Updated dependencies to their latest versions, improving security and compatibility.
  • Refactor

    • Replaced httpTest.Unmarshal with pkgHttpPb.Unmarshal in multiple test files for better organization and functionality.
  • Chores

    • Enabled stricter linting checks for loop variable usage to improve code quality.
    • Updated various dependencies in go.mod to maintain alignment with the latest stable versions.
    • Added configuration for machine-to-machine OAuth server private key in .vscode/settings.json and Makefile.

Copy link

coderabbitai bot commented Sep 8, 2024

Walkthrough

The pull request introduces several modifications across multiple files, focusing on updates to linter configurations, dependency versions, and method signatures. Key changes include enabling the copyloopvar linter, updating the dependency/googleapis commit, and enhancing method signatures to include context parameters. Additionally, import statements for unmarshalling functions in various test files have been updated to utilize a new package, reflecting a reorganization of HTTP-related functionalities. These changes aim to improve code quality, maintainability, and alignment with modern practices.

Changes

File(s) Change Summary
.golangci.yml Enabled copyloopvar linter; removed exportloopref linter.
dependency/googleapis Updated subproject commit from d4acb64370d3... to 32bc03653260....
go.mod Updated multiple dependencies to newer versions, including grpc-gateway, ttlcache, and go.opentelemetry.io/otel.
pkg/tar/tar.go Added //nolint:gosec comment to suppress linter warnings for copyFile function.
service/grpc/jsonWebKeyCache.go Modified ParseWithClaims method to include context.Context parameter.
service/grpc/updateJSONWebKeys.go Updated getOwnerForUpdateJSONWebKeys method to call ParseWithClaims with a new ctx parameter.
service/http/*.go Replaced httpTest.Unmarshal with pkgHttpPb.Unmarshal in multiple test files, reflecting a shift in the source of the unmarshalling function.
service/http/service.go Updated splitURIPath to use pkgHttpUri.CanonicalHref; modified createAuthFunc to utilize pkgHttpJwt.RequestMatcher and pkgHttpJwt.NewInterceptorWithValidator.
.vscode/settings.json Added configuration for M2M_OAUTH_SERVER_PRIVATE_KEY.
Makefile Introduced M2M_OAUTH_SERVER_ACCESS_TOKEN_PRIVATE_KEY variable and updated privateKeys target to generate a new private key.
service/http/remoteInitialize_test.go Enhanced setupRemoteProvisioning to include hubTestService.SetUpServicesMachine2MachineOAuth for improved service setup.

Sequence Diagram(s)

sequenceDiagram
    participant Client
    participant Server
    participant Authenticator
    participant Unmarshaller

    Client->>Server: Request with token
    Server->>Authenticator: Validate token
    Authenticator-->>Server: Token valid
    Server->>Unmarshaller: Unmarshal response
    Unmarshaller-->>Server: Response data
    Server-->>Client: Send response
Loading

🐇 In the code, I hop and play,
With linter changes brightening the way.
Dependencies updated, oh what a sight,
Context added, making things right!
Unmarshalling flows, now smooth and neat,
A rabbit's joy in each code heartbeat! 🐇

Possibly related PRs

  • Upgrade dependencies  #252: The changes in .golangci.yml in this PR involve modifications to the linter configuration, which is directly related to the changes made in the main PR that also modifies the .golangci.yml file by enabling the copyloopvar linter and removing the exportloopref linter.
  • Upgrade dependencies #262: Similar to Upgrade dependencies  #252, this PR also includes changes to the .golangci.yml file, specifically removing several linters, which aligns with the changes made in the main PR regarding linter configurations.
  • Upgrade dependencies #270: This PR updates the go.mod file and includes changes to the dependency/googleapis submodule, which is relevant as the main PR also involves updates to dependencies and configurations that may affect linting behavior.

Tip

Announcements
  • The review status is no longer posted as a separate comment when there are no actionable or nitpick comments. In such cases, the review status is included in the walkthrough comment.
  • We have updated our review workflow to use the Anthropic's Claude family of models. Please share any feedback in the discussion post on our Discord.
  • Possibly related PRs: Walkthrough comment now includes a list of potentially related PRs to help you recall past context. Please share any feedback in the discussion post on our Discord.
  • Suggested labels: CodeRabbit can now suggest labels by learning from your past PRs in the walkthrough comment. You can also provide custom labeling instructions in the UI or configuration file.
  • Possibly related PRs, automatic label suggestions based on past PRs, learnings, and possibly related issues require data opt-in (enabled by default).

Recent review details

Configuration used: CodeRabbit UI
Review profile: CHILL

Commits

Files that changed from the base of the PR and between 1354a47 and 15eefaf.

Files ignored due to path filters (1)
  • go.sum is excluded by !**/*.sum
Files selected for processing (17)
  • .golangci.yml (2 hunks)
  • .vscode/settings.json (2 hunks)
  • Makefile (3 hunks)
  • dependency/googleapis (1 hunks)
  • go.mod (11 hunks)
  • pkg/tar/tar.go (1 hunks)
  • service/grpc/jsonWebKeyCache.go (2 hunks)
  • service/grpc/updateJSONWebKeys.go (1 hunks)
  • service/http/clearCache_test.go (2 hunks)
  • service/http/getDeviceResourceLinks_test.go (2 hunks)
  • service/http/getDevice_test.go (2 hunks)
  • service/http/getDevices_test.go (3 hunks)
  • service/http/getResource_test.go (2 hunks)
  • service/http/onboardDevice_test.go (3 hunks)
  • service/http/remoteInitialize_test.go (2 hunks)
  • service/http/service.go (4 hunks)
  • service/http/updateResource_test.go (2 hunks)
Files skipped from review due to trivial changes (1)
  • .vscode/settings.json
Files skipped from review as they are similar to previous changes (12)
  • .golangci.yml
  • dependency/googleapis
  • go.mod
  • service/grpc/jsonWebKeyCache.go
  • service/grpc/updateJSONWebKeys.go
  • service/http/clearCache_test.go
  • service/http/getDeviceResourceLinks_test.go
  • service/http/getDevice_test.go
  • service/http/getResource_test.go
  • service/http/onboardDevice_test.go
  • service/http/remoteInitialize_test.go
  • service/http/updateResource_test.go
Additional context used
golangci-lint
pkg/tar/tar.go

167-167: directive //nolint:gosec is unused for linter "gosec"

(nolintlint)

Additional comments not posted (10)
service/http/getDevices_test.go (2)

33-33: LGTM!

The import statement change is approved.


47-47: LGTM, but verify the Unmarshal function behavior.

The function call changes are approved.

However, ensure that the new pkgHttpPb.Unmarshal function is thoroughly tested to confirm that it behaves as expected and handles the device data correctly.

Run the following script to verify the Unmarshal function behavior:

Also applies to: 119-119

Verification successful

Function call changes verified.

The transition from httpTest.Unmarshal to pkgHttpPb.Unmarshal is complete and consistent across the codebase. The tests are appropriately checking for errors, ensuring the new function behaves as expected.

  • The pkgHttpPb.Unmarshal function is used in multiple test files, confirming its central role in unmarshalling HTTP responses.
  • There are no occurrences of the old httpTest.Unmarshal function, indicating a successful transition.
Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Verify the behavior of the `pkgHttpPb.Unmarshal` function.

# Test: Search for the function usage. Expect: Only occurrences of the new function.
rg --type go -A 5 $'pkgHttpPb\.Unmarshal'

# Test: Search for the old function usage. Expect: No occurrences.
rg --type go -A 5 $'httpTest\.Unmarshal'

Length of output: 3171

service/http/service.go (5)

43-44: LGTM!

The import statement changes are approved.


83-83: LGTM!

The variable declaration change is approved.


99-102: LGTM!

The variable declaration change is approved.


104-104: LGTM, but verify the NewInterceptorWithValidator function behavior.

The function call change is approved.

However, ensure that the new pkgHttpJwt.NewInterceptorWithValidator function is thoroughly tested to confirm that it behaves as expected and handles the authorization correctly.

Run the following script to verify the NewInterceptorWithValidator function behavior:


60-60: LGTM, but verify the CanonicalHref function behavior.

The function change is approved.

However, ensure that the new pkgHttpUri.CanonicalHref function is thoroughly tested to confirm that it behaves as expected and handles the URIs correctly.

Run the following script to verify the CanonicalHref function behavior:

Makefile (3)

72-73: LGTM!

The new command to generate the private key for M2M_OAUTH_SERVER_ACCESS_TOKEN_PRIVATE_KEY is defined correctly.


125-125: LGTM!

The M2M_OAUTH_SERVER_PRIVATE_KEY variable is correctly exported in the test target.


28-28: LGTM, but verify the variable usage.

The new variable M2M_OAUTH_SERVER_ACCESS_TOKEN_PRIVATE_KEY is defined correctly.

However, ensure that this variable is used appropriately in the relevant parts of the codebase for machine-to-machine (M2M) authentication scenarios.

Run the following script to verify the variable usage:

Verification successful

Variable usage verified.

The variable M2M_OAUTH_SERVER_ACCESS_TOKEN_PRIVATE_KEY is correctly used in the Makefile for generating a key file and is exported as an environment variable. This confirms its integration into the build process.

  • Location: Makefile
    • Used in the privateKeys target.
    • Exported as M2M_OAUTH_SERVER_PRIVATE_KEY.
Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Verify the usage of `M2M_OAUTH_SERVER_ACCESS_TOKEN_PRIVATE_KEY` variable.

# Test: Search for the variable usage. Expect: Relevant occurrences in the codebase.
rg --type Makefile --type go --type proto -C 5 $'M2M_OAUTH_SERVER_ACCESS_TOKEN_PRIVATE_KEY'

Length of output: 123


Script:

#!/bin/bash
# Description: Verify the usage of `M2M_OAUTH_SERVER_ACCESS_TOKEN_PRIVATE_KEY` variable.

# Test: Search for the variable usage in all files.
rg -C 5 $'M2M_OAUTH_SERVER_ACCESS_TOKEN_PRIVATE_KEY'

Length of output: 1983


Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

Share
Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>.
    • Generate unit testing code for this file.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai generate unit testing code for this file.
    • @coderabbitai modularize this function.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai generate interesting stats about this repository and render them as a table.
    • @coderabbitai show all the console.log statements in this repository.
    • @coderabbitai read src/utils.ts and generate unit testing code.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
    • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • Please see the configuration documentation for more information.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

Outside diff range, codebase verification and nitpick comments (2)
service/grpc/jsonWebKeyCache.go (1)

55-55: Update method calls to include context parameter

The ParseWithClaims method has been updated to include a context.Context parameter. However, not all calls to this method have been updated to pass the context. Please update the following call to include the context parameter:

  • service/grpc/jsonWebKeyCache.go: Ensure this call includes a context.Context parameter.
Analysis chain

Context parameter added to method signature.

The addition of a context.Context parameter to ParseWithClaims is a good practice for handling request-scoped values. Ensure that all calls to this method across the project have been updated to pass the context appropriately.

Run the following script to verify that all calls to ParseWithClaims have been updated:

Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Verify that all calls to `ParseWithClaims` include the new context parameter.

# Test: Search for the method usage without the context parameter. Expect: No occurrences.
rg --type go -A 3 $'ParseWithClaims\\(' | grep -v 'context.Context'

Length of output: 810

service/grpc/updateJSONWebKeys.go (1)

58-58: Context Parameter Not Utilized in ParseWithClaims Method

The context.Context parameter added to the ParseWithClaims method in service/grpc/jsonWebKeyCache.go is not utilized within the method's implementation. This could indicate an oversight in integrating the context into the method's logic. Consider reviewing whether the context should be used or if the parameter can be removed if it's unnecessary.

  • Location: service/grpc/jsonWebKeyCache.go, lines 55-93
Analysis chain

Updated method call to include context.

The update to include a context.Context parameter in the ParseWithClaims method call within getOwnerForUpdateJSONWebKeys is consistent with best practices for handling request-scoped values in Go. Verify that the context is being used appropriately within the method and that there are no side effects from this change.

Run the following script to verify the correct implementation of the context usage:

Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Verify the correct implementation of the context usage in `ParseWithClaims`.

# Test: Search for the method usage and ensure context is passed correctly. Expect: Correct context usage.
rg --type go -A 5 $'ParseWithClaims\\(' | grep 'context.Context'

Length of output: 204


Script:

#!/bin/bash
# Extract the implementation of the ParseWithClaims method to verify context usage.
ast-grep --lang go --pattern $'func (s *ClientApplicationServer) ParseWithClaims(_ context.Context, $_, $_) error {\n$$$\n}'

Length of output: 2808

Review details

Configuration used: CodeRabbit UI
Review profile: CHILL

Commits

Files that changed from the base of the PR and between e72e9f8 and fb3ee75.

Files ignored due to path filters (1)
  • go.sum is excluded by !**/*.sum
Files selected for processing (14)
  • .golangci.yml (2 hunks)
  • dependency/googleapis (1 hunks)
  • go.mod (6 hunks)
  • pkg/tar/tar.go (1 hunks)
  • service/grpc/jsonWebKeyCache.go (2 hunks)
  • service/grpc/updateJSONWebKeys.go (1 hunks)
  • service/http/clearCache_test.go (2 hunks)
  • service/http/getDeviceResourceLinks_test.go (2 hunks)
  • service/http/getDevice_test.go (2 hunks)
  • service/http/getDevices_test.go (3 hunks)
  • service/http/getResource_test.go (2 hunks)
  • service/http/onboardDevice_test.go (2 hunks)
  • service/http/service.go (4 hunks)
  • service/http/updateResource_test.go (2 hunks)
Files skipped from review due to trivial changes (1)
  • go.mod
Additional context used
golangci-lint
pkg/tar/tar.go

167-167: directive //nolint:gosec is unused for linter "gosec"

(nolintlint)

Additional comments not posted (21)
dependency/googleapis (1)

1-1: Submodule commit updated.

The submodule github.com/googleapis/googleapis has been updated to a new commit. Please ensure that this update is compatible with the project's requirements and does not introduce breaking changes.

Run the following script to verify the submodule's impact:

service/http/getDeviceResourceLinks_test.go (2)

29-29: Approved import addition.

The addition of pkgHttpPb supports the updated unmarshalling function, aligning with the refactoring goals.


91-91: Verify the new unmarshalling function.

The change to pkgHttpPb.Unmarshal needs verification to ensure it correctly handles the data structures used in the test.

Run the following script to verify the function usage:

Verification successful

The new unmarshalling function is verified.

The pkgHttpPb.Unmarshal function is used consistently across multiple test files, and there are no indications of issues or incompatibility with the data structures. The change appears to be correctly integrated into the test suite.

  • Instances found in:
    • service/http/updateResource_test.go
    • service/http/onboardDevice_test.go
    • service/http/getDevices_test.go
    • service/http/getDevice_test.go
    • service/http/getDeviceResourceLinks_test.go
    • service/http/clearCache_test.go
    • service/http/getResource_test.go
Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Verify the new unmarshalling function's compatibility and correctness.

# Test: Search for the function usage. Expect: Only occurrences of the new signature.
rg --type go -A 5 $'pkgHttpPb.Unmarshal'

Length of output: 3126

service/http/getResource_test.go (2)

31-31: Approved import addition.

The addition of pkgHttpPb supports the updated unmarshalling function, aligning with the refactoring goals.


114-114: Verify the new unmarshalling function.

The change to pkgHttpPb.Unmarshal needs verification to ensure it correctly handles the data structures used in the test.

Run the following script to verify the function usage:

service/http/getDevices_test.go (3)

33-33: Approved import addition.

The addition of pkgHttpPb supports the updated unmarshalling function, aligning with the refactoring goals.


119-119: Verify the new unmarshalling function.

The change to pkgHttpPb.Unmarshal in the TestClientApplicationServerGetDevices test function needs verification to ensure it correctly handles the data structures used in the test.

Run the following script to verify the function usage:

Verification successful

Verification successful for the new unmarshalling function.

The pkgHttpPb.Unmarshal function is consistently used across multiple test files with appropriate error handling, indicating it is correctly implemented and compatible with the expected data structures. No issues were found with its usage in the TestClientApplicationServerGetDevices test function.

  • Files verified: getDevice_test.go, getDevices_test.go, getDeviceResourceLinks_test.go, updateResource_test.go, onboardDevice_test.go, clearCache_test.go, getResource_test.go
Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Verify the new unmarshalling function's compatibility and correctness.

# Test: Search for the function usage. Expect: Only occurrences of the new signature.
rg --type go -A 5 $'pkgHttpPb.Unmarshal'

Length of output: 3126


47-47: Verify the new unmarshalling function.

The change to pkgHttpPb.Unmarshal in the getDevices function needs verification to ensure it correctly handles the data structures used in the function.

Run the following script to verify the function usage:

Verification successful

Verification successful for the new unmarshalling function.

The pkgHttpPb.Unmarshal function is consistently used across multiple test files with appropriate error handling, indicating its correct integration and functionality within the codebase. No issues were found with its usage.

  • Files using pkgHttpPb.Unmarshal:
    • service/http/updateResource_test.go
    • service/http/getResource_test.go
    • service/http/getDevices_test.go
    • service/http/onboardDevice_test.go
    • service/http/getDevice_test.go
    • service/http/getDeviceResourceLinks_test.go
    • service/http/clearCache_test.go
Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Verify the new unmarshalling function's compatibility and correctness.

# Test: Search for the function usage. Expect: Only occurrences of the new signature.
rg --type go -A 5 $'pkgHttpPb.Unmarshal'

Length of output: 3126

service/http/getDevice_test.go (2)

71-71: Approve new function usage.

The usage of pkgHttpPb.Unmarshal has been updated in the test. Confirm that it handles all scenarios and errors appropriately.


31-31: Verify new import functionality.

The import of pkgHttpPb replaces httpTest for unmarshalling. Ensure that pkgHttpPb.Unmarshal is compatible and functionally equivalent to the previous implementation.

service/http/clearCache_test.go (2)

73-73: Approve new function usage.

The usage of pkgHttpPb.Unmarshal has been updated in the test. Confirm that it handles all scenarios and errors appropriately.


31-31: Verify new import functionality.

The import of pkgHttpPb replaces httpTest for unmarshalling. Ensure that pkgHttpPb.Unmarshal is compatible and functionally equivalent to the previous implementation.

pkg/tar/tar.go (1)

167-167: Question the use of linter directive.

The //nolint:gosec directive is used to suppress warnings for the copyFile function. Please provide justification for this suppression or consider refactoring the code to address potential security issues.

Verification successful

Question the use of linter directive.

The copyFile function uses os.OpenFile with os.O_CREATE|os.O_RDWR and a specified file mode, which can raise security concerns. The //nolint:gosec directive suppresses these warnings. Please provide justification for this suppression or consider refactoring the code to ensure secure file operations and correct file permissions.

  • Location: pkg/tar/tar.go, line 167
Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Verify the security implications of using `//nolint:gosec` on `copyFile`.

# Test: Search for security issues related to `copyFile`.
rg --type go -A 5 $'copyFile' --file 'pkg/tar/*.go'

Length of output: 103


Script:

#!/bin/bash
# Locate the `tar.go` file or any file containing the `copyFile` function.
fd 'tar.go'

# Locate any file containing the `copyFile` function definition.
rg --type go 'func copyFile' --files-with-matches

Length of output: 93


Script:

#!/bin/bash
# Extract the implementation of the `copyFile` function from `pkg/tar/tar.go`.
rg --type go -A 20 'func copyFile' pkg/tar/tar.go

Length of output: 576

Tools
golangci-lint

167-167: directive //nolint:gosec is unused for linter "gosec"

(nolintlint)

service/http/updateResource_test.go (2)

34-34: Approved import change: Verify related tests.

The change to use pkgHttpPb for unmarshalling is approved. Please ensure that all related tests are updated to reflect this change and verify that they pass with the new unmarshalling logic.

Verification successful

Import change successfully integrated into tests

The import change to use pkgHttpPb for unmarshalling has been successfully integrated into multiple test files. Please ensure that all tests pass in the CI/CD pipeline to confirm the correctness of the new unmarshalling logic.

  • Test files using pkgHttpPb.Unmarshal:
    • service/http/updateResource_test.go
    • service/http/onboardDevice_test.go
    • service/http/getDevice_test.go
    • service/http/getResource_test.go
    • service/http/getDevices_test.go
    • service/http/clearCache_test.go
    • service/http/getDeviceResourceLinks_test.go
Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Verify all related tests are updated and pass with the new unmarshalling logic.

# Test: Search for the function usage in test files. Expect: Only occurrences of the new unmarshalling logic.
rg --type go -A 5 $'pkgHttpPb.Unmarshal'

Length of output: 3126


143-143: Approved function change: Verify functionality.

The change to use pkgHttpPb.Unmarshal in the test function is approved. Please verify that the functionality remains consistent with the expected outcomes of the tests.

Verification successful

Function is part of the test suite: Run tests to verify changes.

The function TestClientApplicationServerUpdateResource is part of the test suite in both service/http/updateResource_test.go and service/grpc/updateResource_test.go. The change to use pkgHttpPb.Unmarshal is being tested through various scenarios. Please run the test suite to ensure all tests pass and the functionality remains consistent.

Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Verify the functionality of the updated unmarshalling logic in the test function.

# Test: Run the specific test function to ensure it behaves as expected.
# Note: Actual test command would depend on the project's test suite setup.
echo "Run the test suite to ensure 'TestClientApplicationServerUpdateResource' behaves as expected."

Length of output: 202


Script:

#!/bin/bash
# Search for the definition of the test function `TestClientApplicationServerUpdateResource`.
ast-grep --lang go --pattern 'func TestClientApplicationServerUpdateResource($_) { $$$ }'

# Check if there are any test files that include this function name to ensure it is part of the test suite.
rg 'TestClientApplicationServerUpdateResource' --glob '*_test.go' -A 5

Length of output: 16912

.golangci.yml (2)

26-26: Enable copyloopvar linter.

Enabling the copyloopvar linter is a good practice as it helps detect issues where loop variables are incorrectly used, potentially leading to subtle bugs. Ensure that the team is aware of this change and understands the implications.


26-26: Removal of exportloopref linter.

The removal of the exportloopref linter should be carefully considered. Confirm that this change aligns with the project's coding standards and that it won't lead to missed issues related to exported loop references. It might be beneficial to document the rationale behind this decision for future reference.

service/http/onboardDevice_test.go (2)

33-33: Import change approved; verify new package functionality.

The change in the import from httpTest to pkgHttpPb for unmarshalling functionalities is approved. However, ensure that the new package provides equivalent or improved functionality.

Run the following script to verify the new package's functionality:

Verification successful

Verification successful: New package functionality is well-integrated and tested.

The pkgHttpPb.Unmarshal function is used across multiple test files, indicating that the new package is effectively integrated and its functionality is being tested in various scenarios. This confirms that the package provides the necessary unmarshalling capabilities.

  • Files where pkgHttpPb.Unmarshal is used:
    • service/http/updateResource_test.go
    • service/http/onboardDevice_test.go
    • service/http/getDevice_test.go
    • service/http/getDevices_test.go
    • service/http/getDeviceResourceLinks_test.go
    • service/http/getResource_test.go
    • service/http/clearCache_test.go
Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Verify the functionality of the new unmarshalling package.

# Test: Search for the package usage. Expect: Only occurrences of the new package.
rg --type go -A 5 $'pkgHttpPb.Unmarshal'

Length of output: 3126


133-133: Function call change approved; verify new function behavior.

The update to use pkgHttpPb.Unmarshal for unmarshalling the HTTP response is approved. However, ensure that the new function behaves as expected and correctly unmarshals the response.

Run the following script to verify the new function's behavior:

Verification successful

Function behavior verified through extensive test coverage.

The pkgHttpPb.Unmarshal function is used across multiple test files with appropriate error handling, indicating that its behavior is being thoroughly tested. The function's integration into the test suite provides confidence in its correctness. No further action is required.

Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Verify the behavior of the new unmarshalling function.

# Test: Search for the function usage. Expect: Only occurrences of the new function.
rg --type go -A 5 $'pkgHttpPb.Unmarshal'

Length of output: 3126

service/http/service.go (2)

60-60: Function change approved; verify new URI processing capabilities.

The update to use pkgHttpUri.CanonicalHref in the splitURIPath function is approved. However, ensure that the new function provides equivalent or improved URI processing capabilities.

Run the following script to verify the new URI processing capabilities:


83-83: Function changes approved; verify new request matcher and interceptor functionality.

The updates to use pkgHttpJwt.RequestMatcher and pkgHttpJwt.NewInterceptorWithValidator in the createAuthFunc function are approved. However, ensure that the new request matcher and interceptor provide enhanced security and functionality.

Run the following script to verify the new request matcher and interceptor's functionality:

Also applies to: 99-99, 104-104

Verification successful

Verification successful: New request matcher and interceptor are correctly implemented.

The pkgHttpJwt.RequestMatcher and pkgHttpJwt.NewInterceptorWithValidator are used appropriately in the service/http/service.go file to handle JWT-based authorization. The RequestMatcher defines a whitelist of allowed requests, and the NewInterceptorWithValidator enforces authorization rules, ensuring secure access control.

  • service/http/service.go: Lines where RequestMatcher and NewInterceptorWithValidator are used.
Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Verify the functionality of the new request matcher and interceptor.

# Test: Search for the function usage. Expect: Only occurrences of the new functions.
rg --type go -A 5 $'pkgHttpJwt.RequestMatcher'
rg --type go -A 5 $'pkgHttpJwt.NewInterceptorWithValidator'

Length of output: 1324

Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

Review details

Configuration used: CodeRabbit UI
Review profile: CHILL

Commits

Files that changed from the base of the PR and between fb3ee75 and 5ca4a1c.

Files selected for processing (3)
  • .vscode/settings.json (2 hunks)
  • Makefile (3 hunks)
  • service/http/remoteInitialize_test.go (1 hunks)
Additional comments not posted (6)
.vscode/settings.json (2)

17-17: Approved: Addition of M2M OAuth server private key configuration.

The addition of the "M2M_OAUTH_SERVER_PRIVATE_KEY" key enhances the project's configuration by specifying the path to the private key necessary for secure M2M OAuth server authentication. This is a crucial step for ensuring secure communication between services.


35-35: Approved: Formatting adjustment in gopls settings.

The adjustment of the indentation for the "formatting.gofumpt" setting improves the consistency and readability of the settings file.

Makefile (3)

28-28: Approved: Addition of variable for M2M OAuth server access token private key.

The definition of M2M_OAUTH_SERVER_ACCESS_TOKEN_PRIVATE_KEY enhances the Makefile by centralizing the management of the new private key, which is crucial for secure OAuth server authentication.


125-125: Approved: Export of M2M OAuth server private key environment variable.

The export of M2M_OAUTH_SERVER_PRIVATE_KEY ensures that the necessary private key is available to all subprocesses, facilitating secure OAuth server authentication across different parts of the build and test processes.


72-72: Approved: Update to privateKeys target for generating M2M OAuth server private key.

The addition of a command to generate an elliptic curve private key for the M2M OAuth server in the privateKeys target ensures that the key is securely created as part of the build process.

service/http/remoteInitialize_test.go (1)

153-153: Approved: Enhanced service setup in setupRemoteProvisioning for M2M OAuth.

The modification to include hubTestService.SetUpServicesMachine2MachineOAuth in the default service setup enhances the testing capabilities by accurately reflecting the new OAuth functionalities, particularly for M2M scenarios.

@Danielius1922 Danielius1922 force-pushed the adam/feature/update-deps branch from 5ca4a1c to 1354a47 Compare September 10, 2024 09:42
Submodule:
github.com/googleapis/googleapis 32bc03653260356351854429bd7e2dfbf670d352

Direct:
github.com/goreleaser/goreleaser/v2 v2.2.0
github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0
github.com/jellydator/ttlcache/v3 v3.3.0
github.com/plgd-dev/device/v2 v2.5.3-0.20240904102627-4c2719d9d856
github.com/plgd-dev/go-coap/v3 v3.3.5-0.20240904100911-1afdeb72cb92
github.com/plgd-dev/hub/v2 v2.24.1
go.opentelemetry.io/otel/trace v1.29.0
google.golang.org/grpc v1.66.1

Indirect:
cloud.google.com/go v0.112.2
cloud.google.com/go/auth v0.3.0
cloud.google.com/go/auth/oauth2adapt v0.2.2
cloud.google.com/go/iam v1.1.7
cloud.google.com/go/storage v1.40.0
code.gitea.io/sdk/gitea v0.19.0
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.12.0
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.7.0
github.com/Azure/azure-sdk-for-go/sdk/internal v1.9.0
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.3.2
github.com/Microsoft/go-winio v0.6.2
github.com/anchore/quill v0.4.2
github.com/atc0005/go-teams-notify/v2 v2.11.0
github.com/aws/aws-sdk-go v1.55.3
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.2
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.15
github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.5
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.7
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.5
github.com/aws/aws-sdk-go-v2/service/kms v1.31.0
github.com/aws/aws-sdk-go-v2/service/s3 v1.53.1
github.com/blacktop/go-dwarf v1.0.10
github.com/blacktop/go-macho v1.1.225
github.com/bufbuild/protocompile v0.14.1
github.com/caarlos0/env/v11 v11.2.2
github.com/caarlos0/log v0.4.6
github.com/charmbracelet/bubbletea v0.26.6
github.com/charmbracelet/lipgloss v0.12.1
github.com/charmbracelet/x/ansi v0.1.4
github.com/charmbracelet/x/exp/ordered v0.1.0
github.com/charmbracelet/x/input v0.1.0
github.com/charmbracelet/x/term v0.1.1
github.com/charmbracelet/x/windows v0.1.0
github.com/cpuguy83/go-md2man/v2 v2.0.4
github.com/distribution/reference v0.6.0
github.com/docker/cli v27.1.1+incompatible
github.com/docker/docker v27.1.1+incompatible
github.com/docker/go-connections v0.5.0
github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f
github.com/gabriel-vasile/mimetype v1.4.4
github.com/go-json-experiment/json v0.0.0-20240815174924-0599f16bf0e2
github.com/google/go-containerregistry v0.20.2
github.com/google/go-github/v63 v63.0.0
github.com/google/ko v0.16.0
github.com/goreleaser/nfpm/v2 v2.39.0
github.com/hashicorp/go-retryablehttp v0.7.7
github.com/jhump/protoreflect v1.17.0
github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6
github.com/nats-io/nats.go v1.37.0
github.com/pelletier/go-toml/v2 v2.2.2
github.com/slack-go/slack v0.13.1
github.com/spf13/cobra v1.8.1
github.com/spf13/viper v1.19.0
github.com/xanzy/go-gitlab v0.107.0
github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e
go.mongodb.org/mongo-driver v1.16.1
go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/mongo/otelmongo v0.54.0
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0
go.opentelemetry.io/otel v1.29.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.29.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.29.0
go.opentelemetry.io/otel/metric v1.29.0
go.opentelemetry.io/otel/sdk v1.29.0
gocloud.dev v0.38.0
golang.org/x/crypto v0.27.0
golang.org/x/exp v0.0.0-20240909161429-701f63a606c0
golang.org/x/mod v0.21.0
golang.org/x/net v0.29.0
golang.org/x/oauth2 v0.23.0
golang.org/x/sys v0.25.0
golang.org/x/term v0.24.0
golang.org/x/text v0.18.0
golang.org/x/tools v0.25.0
google.golang.org/api v0.176.1
google.golang.org/genproto v0.0.0-20240415180920-8c6c420018be
google.golang.org/genproto/googleapis/api v0.0.0-20240903143218-8af14fe29dc1
google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1
@Danielius1922 Danielius1922 force-pushed the adam/feature/update-deps branch from 1354a47 to 15eefaf Compare September 10, 2024 10:26
Copy link

Quality Gate Failed Quality Gate failed

Failed conditions
66.7% Coverage on New Code (required ≥ 75%)

See analysis details on SonarCloud

@Danielius1922 Danielius1922 merged commit 4d220b3 into main Sep 10, 2024
12 of 15 checks passed
@Danielius1922 Danielius1922 deleted the adam/feature/update-deps branch September 10, 2024 11:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant