Skip to content

Add OPAM to osv.dev - #4582

Merged
another-rex merged 13 commits into
google:masterfrom
hannesm:add-opam
Jan 20, 2026
Merged

Add OPAM to osv.dev#4582
another-rex merged 13 commits into
google:masterfrom
hannesm:add-opam

Conversation

@hannesm

@hannesm hannesm commented Jan 9, 2026

Copy link
Copy Markdown
Contributor

For #4581

Please note that I'm not an experienced Python programmer, happy to get feedback on this.

@google-cla

google-cla Bot commented Jan 9, 2026

Copy link
Copy Markdown

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@AlexandreEXFO

AlexandreEXFO commented Jan 9, 2026

Copy link
Copy Markdown

@hannesm : The list of data sources in the documentation could also be updated to add this new source. https://github.com/google/osv.dev/blob/master/docs/data.md

This updates this page: https://google.github.io/osv.dev/data/

@hannesm

hannesm commented Jan 9, 2026

Copy link
Copy Markdown
Contributor Author

@hannesm : The list of data sources in the documentation could also be updated to add this new source. https://github.com/google/osv.dev/blob/master/docs/data.md

This updates this page: https://google.github.io/osv.dev/data/

Thanks for your comment. FYI, this is not mentioned in the issue template for a new source (see #4581).

@hannesm hannesm mentioned this pull request Jan 9, 2026
Closed
6 tasks done
@hannesm

hannesm commented Jan 12, 2026

Copy link
Copy Markdown
Contributor Author

Anything I can do to move this forward? It looks like CI systems await approval (though I can't see the oss-vdb worker output).

@AlexandreEXFO

AlexandreEXFO commented Jan 12, 2026

Copy link
Copy Markdown

@cuixq @another-rex

@another-rex

another-rex commented Jan 13, 2026

Copy link
Copy Markdown
Contributor

/gcbrun

@another-rex

another-rex commented Jan 13, 2026

Copy link
Copy Markdown
Contributor

/gcbrun

another-rex
another-rex reviewed Jan 13, 2026
View reviewed changes

@another-rex another-rex left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe you can run most of the tests locally as well

make lib-tests
make lint

See Makefile for other tests available, but I think lib-tests is the one you need, though it will require you to have the poetry installed. (See CONTRIBUTING.md for full list of prerequisites. )

Comment thread osv/ecosystems/opam.py Resolved
another-rex
another-rex reviewed Jan 13, 2026
View reviewed changes
Comment thread osv/ecosystems/opam.py Resolved
@another-rex

another-rex commented Jan 13, 2026

Copy link
Copy Markdown
Contributor

/gcbrun

another-rex
another-rex reviewed Jan 13, 2026
View reviewed changes
Comment thread osv/ecosystems/opam.py Resolved
@another-rex

another-rex commented Jan 13, 2026

Copy link
Copy Markdown
Contributor

/gcbrun

@another-rex

another-rex commented Jan 13, 2026

Copy link
Copy Markdown
Contributor

LGTM, though please fix the linting issues.

Use make lint to run the linter locally.

yapf -i <file> to format the file.

@hannesm

hannesm commented Jan 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

@another-rex thanks for your review and insight. I pushed a commit with the formatted file.

A make lint didn't work for me - I'm using a FreeBSD laptop, and was afraid of the amount of dependencies. Hope that autoformat is sufficient.

EDIT: Sorry I messed up the git state and did a rebase onto master and a force-push.

@hannesm hannesm mentioned this pull request Jan 14, 2026
Closed
1 of 2 tasks
michaelkedar
michaelkedar reviewed Jan 15, 2026
View reviewed changes
Comment thread osv/ecosystems/opam.py Resolved
Comment thread osv/ecosystems/opam.py Resolved
Comment thread osv/ecosystems/opam.py Outdated
if archive_response.status_code == 200:
responses.extend(archive_response.json())

versions = [x["name"] for x in responses]

@michaelkedar michaelkedar Jan 15, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looking at the response for opam-repository, the name field is in the form opam-repository.2.0.0, where I presume the version is supposed to be 2.0.0 (judging by the OSV record)

Maybe this should be x['name'].removeprefix(package + '.')?
(Are package names case-sensitive, or are they always lower-case?)

@hannesm hannesm Jan 15, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the removeprefix is done in bacbfa7

(Are package names case-sensitive, or are they always lower-case?)

Neither. They are case-sensitive. There are mixed case package names as well in the package repository (such as unionFind wxOCaml CamelCase). The opam-repository git repository is manually maintained (i.e. pull requests are not automatically merged), and care is taken to not have package names that only differ in casing.

@another-rex

another-rex commented Jan 15, 2026

Copy link
Copy Markdown
Contributor

@another-rex thanks for your review and insight. I pushed a commit with the formatted file.

A make lint didn't work for me - I'm using a FreeBSD laptop, and was afraid of the amount of dependencies. Hope that autoformat is sufficient.

EDIT: Sorry I messed up the git state and did a rebase onto master and a force-push.

No problem, we can do a final format pass on our end to pass the check.

@hannesm

hannesm commented Jan 15, 2026

Copy link
Copy Markdown
Contributor Author

Thanks for your review @michaelkedar and @another-rex. Please let me know if there's anything else that needs to be done to get this merged.

Mehnert @michaelkedar
Update osv/ecosystems/opam.py
20ebd50 
Co-authored-by: Michael Kedar <michaelkedar@google.com>
@another-rex

another-rex commented Jan 16, 2026

Copy link
Copy Markdown
Contributor

/gcbrun

@another-rex

another-rex commented Jan 18, 2026

Copy link
Copy Markdown
Contributor

/gcbrun

@another-rex

another-rex commented Jan 18, 2026

Copy link
Copy Markdown
Contributor

/gcbrun

@another-rex

another-rex commented Jan 19, 2026

Copy link
Copy Markdown
Contributor

/gcbrun

1 similar comment
@another-rex

another-rex commented Jan 19, 2026

Copy link
Copy Markdown
Contributor

/gcbrun

@hannesm

hannesm commented Jan 19, 2026

Copy link
Copy Markdown
Contributor Author

🎉 CI has a green checkmark now. Is there anything I can do to move this forward?

@another-rex
another-rex merged commit 33b91b9 into google:master Jan 20, 2026
20 checks passed
@hannesm
hannesm deleted the add-opam branch January 20, 2026 09:42
@hannesm hannesm mentioned this pull request Jan 20, 2026
Merged
@another-rex another-rex mentioned this pull request Jan 21, 2026
Closed
another-rex pushed a commit that referenced this pull request Jan 23, 2026
@hannesm Mehnert
feat: Add opam source (https://github.com/ocaml/security-advisories) …
9397c84 
…to testing (#4632)

ref #4581

Now that #4582 has been merged...

Co-authored-by: Mehnert <ipad@mehnert.org>
@hannesm hannesm mentioned this pull request Nov 4, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@another-rex another-rex another-rex approved these changes
@michaelkedar michaelkedar Awaiting requested review from michaelkedar

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@hannesm @AlexandreEXFO @another-rex @michaelkedar