For a list of dependency mappings with their respective resolved packages, update in place the dependencies for those resolved packages as resolved (update `is_pinned` as True), if the requirement is also present as a resolved package.
(dependencies)
| 240 | |
| 241 | |
| 242 | def update_dependencies_as_resolved(dependencies): |
| 243 | """ |
| 244 | For a list of dependency mappings with their respective |
| 245 | resolved packages, update in place the dependencies for those |
| 246 | resolved packages as resolved (update `is_pinned` as True), |
| 247 | if the requirement is also present as a resolved package. |
| 248 | """ |
| 249 | #TODO: Use vers to mark update `is_pinned` even in the case |
| 250 | # of incomplete resolution/partially pinned dependencies |
| 251 | |
| 252 | # These are only type, namespace and name (without version and qualifiers) |
| 253 | base_resolved_purls = [] |
| 254 | resolved_packages = [ |
| 255 | dep.get("resolved_package") |
| 256 | for dep in dependencies |
| 257 | if dep.get("resolved_package") |
| 258 | ] |
| 259 | |
| 260 | # No resolved packages are present for dependencies |
| 261 | if not resolved_packages: |
| 262 | return |
| 263 | |
| 264 | for pkg in resolved_packages: |
| 265 | purl=pkg.get("purl") |
| 266 | if purl: |
| 267 | base_resolved_purls.append( |
| 268 | get_base_purl(purl=purl) |
| 269 | ) |
| 270 | |
| 271 | for dependency in dependencies: |
| 272 | resolved_package = dependency.get("resolved_package") |
| 273 | dependencies_from_resolved = [] |
| 274 | if resolved_package: |
| 275 | dependencies_from_resolved = resolved_package.get("dependencies") |
| 276 | |
| 277 | if not dependencies_from_resolved: |
| 278 | continue |
| 279 | |
| 280 | for dep in dependencies_from_resolved: |
| 281 | dep_purl = dep.get("purl") |
| 282 | if dep_purl in base_resolved_purls: |
| 283 | dep["is_pinned"] = True |
| 284 | |
| 285 | |
| 286 | def get_base_purl(purl): |