Fimeg/RedFlag
Watch
1
0
Fork
You've already forked RedFlag
 0
Code Releases Activity

fix(BUG-001): canonicalize pip package type in gate decisions

Browse source 
Server gate functions only recognized 'pypi', while the agent reports
'pip'. This made NeedsCapabilityGate('pip') return false, silently
routing pip installs through the legacy un-gated path.

All four gate functions now accept 'pip' with 'pypi' retained as an
alias for existing DB records.
This commit is contained in:
Fimeg 2026-08-12 20:36:08 -04:00
commit 9f47d782af
1 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
server/internal/services/supply_chain.go
View file

@ -810,7 +810,7 @@ func CheckOSVVulnerabilities(pkgName, ecosystem, version string) *SupplyChainChe
// verification for install safety.
func NeedsSupplyChainCheck(pkgType string) bool {
switch pkgType {
case "npm", "pypi", "apt", "dnf":
case "npm", "pip", "pypi", "apt", "dnf":
return true
}
return false
@ -824,7 +824,7 @@ func NeedsSupplyChainCheck(pkgType string) bool {
// these ecosystems later.
func CanServerFetchArtifact(pkgType string) bool {
switch pkgType {
case "npm", "pypi":
case "npm", "pip", "pypi":
return true
}
return false
@ -837,7 +837,7 @@ func CanServerFetchArtifact(pkgType string) bool {
// isolation and artifact hashing even though OSV does not cover Arch.
func NeedsCapabilityGate(pkgType string) bool {
switch pkgType {
case "dnf", "apt", "npm", "pypi", "pacman":
case "dnf", "apt", "npm", "pip", "pypi", "pacman":
return true
}
return false
@ -853,7 +853,7 @@ func EcosystemFromPackageType(pkgType string) string {
switch pkgType {
case "npm":
return "npm"
case "pypi":
case "pip", "pypi":
return "PyPI"
case "apt":
return "Debian"