Comments (4)
I'd argue this is expected behavior. You're telling the lockfile generator to parse a file and saying that no lockfile generation should be performed. So if the file is a valid lockfile but the contents aren't a valid lockfile, shouldn't we error out?
Like what do you suggest should happen if the manifest's content is actually invalid and it's a lockfile? How are we to detect that it failed because it is a manifest, when we have no way to determine it is one?
from cli.
I'd argue this is expected behavior. You're telling the lockfile generator to parse a file and saying that no lockfile generation should be performed. So if the file is a valid lockfile but the contents aren't a valid lockfile, shouldn't we error out?
Having --no-generation
specified does not automatically mean the dependency file is a known lockfile. It could still be a manifest. Erroring out is still expected...but with a specific error code (20) and a message that explains what happened instead of a parsing stack trace.
Like what do you suggest should happen if the manifest's content is actually invalid and it's a lockfile? How are we to detect that it failed because it is a manifest, when we have no way to determine it is one?
The current lockfile generation documentation for lockifests states:
Phylum handles these files by first attempting to analyze them as a lockfile. If anything in the file is not fully specified, this will fail, and Phylum will silence the error and proceed to lockfile generation.
The suggestion here for what should happen is a modification to say:
Phylum handles these files by first attempting to analyze them as a lockfile. If anything in the file is not fully specified, this will fail, and Phylum will silence the error and proceed to lockfile generation unless lockfile generation is suppressed (e.g., via
--no-generation
option). In that case, error code 20 will be returned along with a message explaining how the lockifest could not be parsed as a lockfile and requires lockfile generation to parse as a manifest, but lockfile generation was disabled through the CLI.
That is likely too wordy to use in the final documentation update, but the intent is hopefully more clear.
from cli.
Just to clarify, your complaint here is simply about the error code, correct?
Yes...the error code and the inscrutable output.
from cli.
That is likely too wordy to use in the final documentation update, but the intent is hopefully more clear.
Yeah at that point reading the documentation just becomes a chore.
I also do not believe we should return error code 20 in this case. It doesn't make any sense when we cannot determine the cause of the failure.
from cli.
Related Issues (20)
- Enable sandboxed lockfile generation in extensions HOT 1
- Yarn v1 renamed dependencies not handled correctly HOT 1
- Allow `project status` command to work without `.phylum_project` file
- Include `alias` information in the output of `phylum parse`
- `phylum package` should return CVE data.
- Lockfile information missing `phylum parse`
- Avoid unrelated output in `parse-sandboxed`
- Logging from `parse-sandboxed` should be forwarded
- Extension API: Submit by PURL
- Allow more valid `pip` sources HOT 2
- Provide more information on system minimum requirements
- `phylum package` command output errors HOT 1
- SPDX panics while parsing
- cli v6.1.1 (nearly) silent on runtime failure HOT 2
- CLI should kill parsing subprocess on shutdown HOT 1
- SPDX package list may contain current project as a package
- Failure to parse SPDX text files with optional package fields
- Use `SPDX` download location to determine ecosystem
- Issue parsing `effective-pom.xml` files with `ch1252` encoding
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from cli.