Skip to content

Commit

Permalink
NuGetSupport: Stop assigning the resolved revision of packages
Browse files Browse the repository at this point in the history
The resolved revision is not supposed to be assigned by the analyzer at
all, but only by the downloader. That is because what counts is not to
what a `revision` resolved to at the time of analysis, or what package
metadata claims a `revision` resolves to, but what commit of the source
code was really downloaded and scanned. This is especially important
for moving revisions, like branch names, which could have pointed to
something different at the time of analysis than at the time of
downloading / scanning.

Signed-off-by: Frank Viernau <frank.viernau@here.com>
  • Loading branch information
fviernau committed May 6, 2021
1 parent dbd4981 commit 835b197
Showing 1 changed file with 0 additions and 1 deletion.
1 change: 0 additions & 1 deletion analyzer/src/main/kotlin/managers/utils/NuGetSupport.kt
Original file line number Diff line number Diff line change
Expand Up @@ -173,7 +173,6 @@ class NuGetSupport(serviceIndexUrls: List<String> = listOf(DEFAULT_SERVICE_INDEX
type = VcsType(it.type.orEmpty()),
url = it.url.orEmpty(),
revision = (it.branch ?: it.commit).orEmpty(),
resolvedRevision = it.commit,
path = ""
)
} ?: VcsInfo.EMPTY
Expand Down

0 comments on commit 835b197

Please sign in to comment.