review the plugin and provide feedback

[adietish]

In a meeting @ruromero asked us @redhat-developer to review the extension and provide feedback.

[adietish]

As discussed, @sbouchet will take care of this. thanks for taking over!

[sbouchet]

Hi,
i'm going to add several comments here, one by one for hopefully better clarity.

[sbouchet]

When inspecting Docker file, i got the following exception in the log :

java.lang.RuntimeException: Failed to execute command 'syft registry.access.redhat.com/ubi8/nodejs-18-minimal:latest@sha256:d015728a742ea9d2113885216f9e9d863fbe51705e2825464ca2c14417fe04a2 -s all-layers -o cyclonedx-json -q' 
	at com.redhat.exhort.tools.Operations.runProcessGetFullOutput(Operations.java:227)
	at com.redhat.exhort.image.ImageUtils.execSyft(ImageUtils.java:155)
	at com.redhat.exhort.image.ImageUtils.generateImageSBOM(ImageUtils.java:105)
	at com.redhat.exhort.impl.ExhortApi.lambda$getBatchImageSboms$11(ExhortApi.java:436)
	at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
	at java.base/java.util.HashMap$KeySpliterator.forEachRemaining(HashMap.java:1715)
	at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
	at java.base/java.util.stream.ReduceOps$ReduceTask.doLeaf(ReduceOps.java:960)
	at java.base/java.util.stream.ReduceOps$ReduceTask.doLeaf(ReduceOps.java:934)
	at java.base/java.util.stream.AbstractTask.compute(AbstractTask.java:327)
	at java.base/java.util.concurrent.CountedCompleter.exec(CountedCompleter.java:759)
	at java.base/java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:507)
	at java.base/java.util.concurrent.ForkJoinTask.invoke(ForkJoinTask.java:676)
	at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateParallel(ReduceOps.java:927)
	at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:233)
	at java.base/java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:682)
	at com.redhat.exhort.impl.ExhortApi.getBatchImageSboms(ExhortApi.java:440)
	at com.redhat.exhort.impl.ExhortApi.lambda$imageAnalysis$8(ExhortApi.java:412)
	at com.redhat.exhort.impl.ExhortApi.performBatchAnalysis(ExhortApi.java:476)
	at com.redhat.exhort.impl.ExhortApi.imageAnalysis(ExhortApi.java:411)
	at org.jboss.tools.intellij.image.ApiService.getImageAnalysis(ApiService.java:71)
	at org.jboss.tools.intellij.image.ImageService.performAnalysis(ImageService.java:209)
	at org.jboss.tools.intellij.image.DockerfileAnnotator.lambda$doAnnotate$15(DockerfileAnnotator.java:262)
	at com.intellij.openapi.application.impl.ApplicationImpl$2.run(ApplicationImpl.java:265)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:572)
	at com.intellij.util.concurrency.ContextCallable.lambda$call$1(ContextCallable.java:86)
	at com.intellij.util.concurrency.ContextCallable.call(ContextCallable.java:95)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317)
	at com.intellij.util.concurrency.ChildContext$runInChildContext$1.invoke(propagation.kt:102)
	at com.intellij.util.concurrency.ChildContext$runInChildContext$1.invoke(propagation.kt:102)
	at com.intellij.util.concurrency.ChildContext.runInChildContext(propagation.kt:108)
	at com.intellij.util.concurrency.ChildContext.runInChildContext(propagation.kt:102)
	at com.intellij.util.concurrency.ContextRunnable.run(ContextRunnable.java:27)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
	at java.base/java.util.concurrent.Executors$PrivilegedThreadFactory$1$1.run(Executors.java:735)
	at java.base/java.util.concurrent.Executors$PrivilegedThreadFactory$1$1.run(Executors.java:732)
	at java.base/java.security.AccessController.doPrivileged(AccessController.java:400)
	at java.base/java.util.concurrent.Executors$PrivilegedThreadFactory$1.run(Executors.java:732)
	at java.base/java.lang.Thread.run(Thread.java:1583)
Caused by: java.io.IOException: Cannot run program "syft": error=2, Aucun fichier ou dossier de ce nom
	at java.base/java.lang.ProcessBuilder.start(ProcessBuilder.java:1170)
	at java.base/java.lang.ProcessBuilder.start(ProcessBuilder.java:1089)
	at java.base/java.lang.Runtime.exec(Runtime.java:681)
	at java.base/java.lang.Runtime.exec(Runtime.java:491)
	at java.base/java.lang.Runtime.exec(Runtime.java:366)
	at com.redhat.exhort.tools.Operations.runProcessGetFullOutput(Operations.java:194)
	... 40 more
Caused by: java.io.IOException: error=2, Aucun fichier ou dossier de ce nom
	at java.base/java.lang.ProcessImpl.forkAndExec(Native Method)
	at java.base/java.lang.ProcessImpl.<init>(ProcessImpl.java:295)
	at java.base/java.lang.ProcessImpl.start(ProcessImpl.java:225)
	at java.base/java.lang.ProcessBuilder.start(ProcessBuilder.java:1126)
	... 45 more

I know i don't have the CLI on the PATH as expected, but for the user it can be wrongly assuming the extension's not working properly ( as it throws exception ).
A solution should be to first try to run the CLI, catch the exception and inform the user that the CLI is not present on the PATH. it can also point to the documentation, or the settings, or even try to download it ?
for example we use a common lib to perform this on our other IDEA extensions : https://github.com/redhat-developer/intellij-common/blob/main/src/main/java/com/redhat/devtools/intellij/common/utils/DownloadHelper.java

[sbouchet]

From the docs, the extension usage is either direclty inside the editor ( with direct indication ) or on the project file.
on my case, the first usage works correctly , but i don't see any action on the project file.
This is a blocker, as user don't see any way to perform analysis

[sbouchet]

on the detailled report, the remediation is hard to find.

as mentionned ,there is a remediation available from redhat repo, but it's not clearly indicated.
you must clik on the Direct vulneraabilities column ( ? ) to unfold the vulnerability detail and then can see the remediation .

why not on the remediation available (yes/No) column too?

even if there is no remediation the is a missing icon/.indicator about the details on the CVE detected.

[ruromero]

@sbouchet thanks for your feedback

A solution should be to first try to run the CLI, catch the exception and inform the user that the CLI is not present on the PATH. it can also point to the documentation, or the settings, or even try to download it ?

You are right. This is the only binary that is not verified before running it. I'll create an issue for that but we will ask the users to install it themselves. We shouldn't download/install anything on behalf of users.

as mentionned ,there is a remediation available from redhat repo, but it's not clearly indicated.
you must clik on the Direct vulneraabilities column ( ? ) to unfold the vulnerability detail and then can see the remediation .

You can have multiple remediations for different vulnerabilities, if there's at least one remediation for this dependency you will se Yes.

even if there is no remediation the is a missing icon/.indicator about the details on the CVE detected.

When you unfold the direct vulnerabilities you see all the details, including remediation, direct vulnerabilities, etc. As you only have 1 it might look like you could see more info but when you have 20-30 dependencies with vulnerabilities it's better to open/close only the ones you're interested in.