Skip to content

Commit

Permalink
Stop coercing Pipfile source url's to have trailing slashes (#7783)
Browse files Browse the repository at this point in the history
I had to stare at this code golf for a little bit to realize that it's enforcing that every source URL in a `Pipfile` has one-and-only-one trailing slash.

I started to tweak it a little to make it more readable, but I decided instead that this is business we really shouldn't be in... Dependabot is the tool that runs the package manager, not the package manager itself.

So if a package manager doesn't like a URL that lacks a trailing slash, it should be the one handling the coercing or raising the error, and then we transparently forward that to the user.

In fact the opposite would be worse! If the native package manager (in this case `pipenv`) is failing for a URL, but :dependabot: works because we silently munge it then that'd lead to confusing/difficult to debug scenario.

There are some use cases where we need to handle URL normalization for deduping purposes within Dependabot internals, but I poked around a bit and as far as I can tell they don't apply here.

So let's trust the user / package managers to do the right thing (which may mean giving us a clear error).
  • Loading branch information
jeffwidman authored Aug 10, 2023
1 parent 8b10618 commit 82388fd
Showing 1 changed file with 1 addition and 3 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -109,9 +109,7 @@ def normalise(name)
end

def pipfile_sources
@pipfile_sources ||=
TomlRB.parse(pipfile_content).fetch("source", []).
map { |h| h.dup.merge("url" => h["url"].gsub(%r{/*$}, "") + "/") }
@pipfile_sources ||= TomlRB.parse(pipfile_content).fetch("source", [])
end

def sub_auth_url(source, credentials)
Expand Down

0 comments on commit 82388fd

Please sign in to comment.