Repository navigation
feat: set up some Postgres experiments to be used for API testing - #6150
Hidden character warning
Conversation
| return "" | ||
| } | ||
|
|
||
| func normalizeRepo(repoURL string) string { |
There was a problem hiding this comment.
do we normalize in gitter too? maybe we should make this a util to be shared between packages.
There was a problem hiding this comment.
This normalization is for the API side to do string matching of GIT tags.
Maybe in a follow up
| data JSONB NOT NULL, | ||
| proto BYTEA NOT NULL | ||
| ); | ||
| CREATE TABLE affected_commits ( |
There was a problem hiding this comment.
do we need references for vulnerabilities here as well? just like vuln_commits and affected_versions?
There was a problem hiding this comment.
We don't for a bit of an optimisation reason:
If we were to add REFERENCES vulnerabilities(id) here, we'd either have to do a full table scan or create a new vuln_id index on the table (which we already have vuln_commits for to do the ID -> commits lookup more efficiently, which we can use for deletes as well)
I've added a comment here to explain also
| } | ||
| } | ||
|
|
||
| func (s *VulnerabilityStore) versionIsMatch(version, pkgName, rowEco string, versions []string, eventsJSON []byte) bool { |
There was a problem hiding this comment.
buildVersionedWithEcoMatcher skips range-based matching for Alpine and Ubuntu but versionIsMatch does not. Is this intentional?
There was a problem hiding this comment.
I don't think it was (the same behaviour is in the Datastore implementation) but...
versionIsMatch is only really called when someone queries with no ecosystem specified, which is a strange use-case and might as well return the most lenient matches possible.
2 participants
Setting up an experimental PostgreSQL database so we can test the performance of Postgres for our API queries.
I've put a bunch of things in temporary directories because they're not the final design and I'm planning on deleting this stuff when I start implementing the actual PostgreSQL database.
This PR includes
all.zipexport and theAffectedCommitsbackup.In an eventful follow-up, I'll make a dual-read VulnerabilityStore interface so we can benchmark the performance of this Postgres design vs Datastore.