-
Notifications
You must be signed in to change notification settings - Fork 176
split test suite #428
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
split test suite #428
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The core file is missing tests for canonical encoding of all characters in all the different positions. This isn't currently defined by the spec for all characters, but at least there should be tests for the characters that are defined and for some critical cases where failure to encode and decode properly results in unexpected errors or incorrect values
- plus vs space (broken for at least 4 implementations)
- percent signs (broken for 1 implementation)
- ampersands in qualifier values (broken for 2 implementations)
- a control character < 0x10 (broken for 2 implementations)
- a BMP Unicode character (< U+10000, eg
☃
, broken for 2 implementations) - a non-BMP Unicode character (>= U+10000, eg
💩
, broken for 2 implementations).
Some of encoding cases used to be covered and are not anymore. For example, colons are now only tested for implementations that support pkg:docker and pkg:cpan. Slashes in qualifier values are only tested for implementations that support huggingface or mlflow.
[ | ||
{ | ||
"description": "invalid subpath - unencoded subpath cannot contain '..'", | ||
"purl": "pkg:GOLANG/google.golang.org/genproto@abcdedf#/googleapis/%2E%2E/api/annotations/", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This test is doing three things. GOLANG
should probably be written as golang
and the subpath should not begin with /
.
"description": "invalid encoded colon : between scheme and type", | ||
"purl": "pkg%3Amaven/org.apache.commons/io", | ||
"canonical_purl": null, | ||
"type": "maven", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This test doesn't work. I think you got it from elsewhere because there is already a test with this problem. type
cannot be "maven"
because {"type":"maven","namespace": "org.apache.commons","name":"io"}
is a valid PURL and the test will fail because of "is_invalid": true
. "type":"pkg:maven"
or "type":null
would be more accurate.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@matt-phylum Thanks for your comments on this test, which seems to be a variation of the test I added as part of my (merged) scheme
PR #361. I had questions at the time re how to properly construct the input values when the PURL is meant to be invalid, and similar questions re the 3 is-invalid-true tests in my (merged) type
PR #383. Subsequent discussion led to
- @jkowalleck's docs: how to create invalid cases in the test-suite? #403 and
- my related Clarify construction of JSON test objects #419.
Clarifying the core spec's test-construction instructions would be a valuable next step in the test-updating process. (I suspect the test-construction clarification could be done even while additional work on the "Character encoding" section continues.)
"description": "invalid subpath - unencoded subpath cannot contain '..'", | ||
"purl": "pkg:GOLANG/google.golang.org/genproto@abcdedf#/googleapis/%2E%2E/api/annotations/", | ||
"canonical_purl": "pkg:golang/google.golang.org/genproto@abcdedf#googleapis/api/annotations", | ||
"type": "golang", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What is the difference between the pkg:generic
tests (currently an empty file) and the tests in this file? Should all of the tests in this file be type generic? They're cases where the package being type golang or whatever shouldn't make a difference, but some implementations validate that the package type is a supported type, and it's possible that an implementation doesn't support one of these types or doesn't support it correctly and gets an unexpected test result.
{ | ||
"description": "double slash // after scheme is not significant", | ||
"purl": "pkg://maven/org.apache.commons/io", | ||
"canonical_purl": "pkg:maven/org.apache.commons/io", | ||
"type": "maven", | ||
"namespace": "org.apache.commons", | ||
"name": "io", | ||
"version": null, | ||
"qualifiers": null, | ||
"subpath": null, | ||
"is_invalid": false | ||
}, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Some of these tests are duplicates of core tests and aren't related to the package type.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, I would file separate issues for the comments that @matt-phylum left in this PR since the change here is only about better organization of the test data.
@matt-phylum's comment seams to be out of scope. |
@pombredanne @package-url/purl-spec-helpers can we merge this one? I mean, we could wait until all the tens of open PRs that want to modify the test suite are merged eventually, but this means we would not have a reasonably usable test suite in the meantime. Anyway, I am a huge fan of many small, scoped changes - like this one - so downstream users can review and adopt in small iterations, instead of one big blob of rework. Let's merge this one, so that downstream users have an immediate benefit, even though all these other PRs are still in triage for months. PS: merging this PR now would especially enable downstream users to adopt every upcoming change to the test-suite even easier, as they can plug/choose what they need. |
}, | ||
{ | ||
"description": "maven often uses qualifiers", | ||
"purl": "pkg:Maven/org.apache.xmlgraphics/[email protected]?classifier=sources&repositorY_url=repo.spring.io/release", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Isn't this an invalid example, since the solidus /
in repo.spring.io/release
is not percent encoded?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
No. The parser is supposed to split on ?
before /
.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What about #439? I assume that /
must be unencoded, when used as a PURL separator and encoded otherwise?
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
Signed-off-by: Jan Kowalleck <[email protected]>
incorporate package-url#416 Signed-off-by: Jan Kowalleck <[email protected]>
598d148
to
f528a57
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Excellent idea @jkowalleck -- LGTM.
PURL-SPECIFICATION.json
PURL-TYPES.<type>.json
Note
this PR does not add new or alter existing tests. it just refactors their location
fixes #427
TODO / DONE
created via script: