Capture additional data from conda-lock files - #1861
Capture additional data from conda-lock files#1861Ryan Brandenburg (ryanbrandenburg) merged 3 commits into
Conversation
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
CondaDependencyResolver.IsPythonPackage can still throw on null package.Manager, which should be handled safely for external YAML input.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review tier: Lite
Findings: 1
New issues introduced by this change (1)
| Severity | Finding |
|---|---|
 |
src/Microsoft.ComponentDetection.Detectors/conda/CondaDependencyResolver.cs — IsPythonPackage can throw a NullReferenceException if package.Manager is missing/null in the… |
What changed in this PR
This PR enhances Conda lockfile processing so more Conda package metadata (build/channel/subdir/URL + hashes) is captured and reported, enabling generation of conda-valid PURLs and improving cross-platform identity handling.
Changes:
- Populate
CondaComponentwith build/channel/subdir/URL plus MD5 and SHA256, and update identity logic to exclude mirror/provenance URLs while still distinguishing platform artifacts. - Extend Conda lock parsing to read
build, infer missing build/channel/subdir from package URLs, and record SHA256 alongside MD5. - Expand unit tests to validate metadata extraction, cross-platform/noarch deduplication behavior, and typed-component serialization.
| File | Description |
|---|---|
| test/Microsoft.ComponentDetection.Detectors.Tests/CondaLockComponentDetectorTests.cs | Adds assertions and new tests for build/channel/subdir/URL/hashes plus platform/noarch identity behavior. |
| test/Microsoft.ComponentDetection.Detectors.Tests/ArtifactComponentFactoryTests.cs | Verifies CondaComponentFactory carries SHA256 into CondaComponent. |
| test/Microsoft.ComponentDetection.Contracts.Tests/TypedComponentSerializationTests.cs | Adds serialization/identity tests ensuring Conda identity excludes URL and hashes. |
| src/Microsoft.ComponentDetection.Detectors/linux/Factories/CondaComponentFactory.cs | Plumbs Syft-provided SHA256 into CondaComponent. |
| src/Microsoft.ComponentDetection.Detectors/conda/Contracts/CondaPackage.cs | Adds YAML-mapped build field for Conda lock packages. |
| src/Microsoft.ComponentDetection.Detectors/conda/CondaDependencyResolver.cs | Extracts channel/subdir/build from URL/fields and records MD5/SHA256; adds null-safe dependency check in python detection (partial). |
| src/Microsoft.ComponentDetection.Contracts/TypedComponent/CondaComponent.cs | Adds SHA256 + download URL parsing and updates base/extended identity semantics for Conda coordinates. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
👋 Hi! It looks like you modified some files in the
If none of the above scenarios apply, feel free to ignore this comment 🙂 |
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
There are correctness gaps relative to the stated goal (conda-valid PURL emission is still missing) and a small build-selection bug that can record an empty build instead of falling back to filename parsing.
Review tier: Lite
Findings: None
Issues resolved since last review (1)
| Severity | Finding |
|---|---|
|
src/Microsoft.ComponentDetection.Detectors/conda/CondaDependencyResolver.cs — IsPythonPackage can throw a NullReferenceException if package.Manager is missing/null in the… View resolved comment |
Suppressed comments (2)
Previously missed (2) — in code that hasn't changed since the last review.
src/Microsoft.ComponentDetection.Contracts/TypedComponent/CondaComponent.cs:63
- The PR description calls out producing a conda-valid PURL, but
CondaComponentstill doesn’t overridePackageUrl, sopackageUrlwill remain null in output. Since this PR now capturesbuild,channel, andsubdir, consider emitting apkg:condaPURL with these values as qualifiers (namespace is prohibited for conda PURLs).
src/Microsoft.ComponentDetection.Detectors/conda/CondaDependencyResolver.cs:152 package.Buildis used verbatim when present, which means a lock entry withbuild:set to an empty/whitespace value will suppress the filename-derived build and end up recording an empty build string. Treat blankbuildas missing so the fallback extraction still runs.
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
It introduces a binary-breaking public API change by modifying the existing CondaComponent constructor signature rather than preserving the previous overload.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review tier: Lite
Findings: 1
New issues introduced by this change (1)
| Severity | Finding |
|---|---|
 |
src/Microsoft.ComponentDetection.Contracts/TypedComponent/CondaComponent.cs — Changing the public CondaComponent constructor signature by adding the new sha256 parameter (even… |
On reflection there was more data that we could have been consuming or inferring within the conda-lock files. Some of that data is needed to make a conda-valid PURL, so let's make sure it gets reported.