Sync with Pro

Makefile

@@ -237,7 +237,18 @@ core-test-e2e:
 # path, then recent versions of opam crash with a 'git ls-files fatal error'
 # about some 'libs/ocaml-tree-sitter-core/../../.git/...' not being a git
 # repo.
-REQUIRED_DEPS = ./ ./libs/ocaml-tree-sitter-core/tree-sitter.opam ./dev/required.opam
+#
+# EXTRA_OPAM_DEPS allows us to add more opam files when building semgrep
+# as part of a larger project (e.g. semgrep-proprietary). Using a single
+# 'opam install' command to install all the dependencies allows us to detect
+# version constraints incompatibilities.
+#
+REQUIRED_DEPS = \
+ ./ \
+ ./libs/ocaml-tree-sitter-core/tree-sitter.opam \
+  ./dev/required.opam \
+  $(EXTRA_OPAM_DEPS)
+
 OPTIONAL_DEPS = $(REQUIRED_DEPS) ./dev/optional.opam
 
 # This target is portable; it only assumes you have 'gcc', 'opam' and

cli/src/semgrep/app/scans.py

@@ -484,15 +484,16 @@ def report_findings(
         # minutes to wait for completion. Eventually, this wait may
         # be configurable as we see larger scans and increased backend
         # load.
-        try_until = datetime.utcnow() + timedelta(minutes=30)
-        slow_down_after = datetime.utcnow() + timedelta(minutes=2)
+        now = datetime.now().replace(tzinfo=None)
+        try_until = now + timedelta(minutes=30)
+        slow_down_after = now + timedelta(minutes=2)
 
         while True:
             # old: was also logging {json.dumps(complete.to_json(), indent=4)}
             # alt: save it in ~/.semgrep/logs/complete.json?
             logger.debug(f"Sending /complete")
 
-            if datetime.utcnow() > try_until:
+            if datetime.now().replace(tzinfo=None) > try_until:
                 # let the backend know we won't be trying again
                 complete.final_attempt = True
 
@@ -522,4 +523,4 @@ def report_findings(
                 )
 
             progress_bar.advance(complete_task)
-            sleep(5 if datetime.utcnow() < slow_down_after else 30)
+            sleep(5 if datetime.now().replace(tzinfo=None) < slow_down_after else 30)

dune-project

@@ -77,6 +77,7 @@ the other programming languages supported by atdgen."
     (lib_parsing (>= 1.5.5))
     (profiling (>= 1.5.5))
     (atdgen (>= 2.8.0))
+    (uuidm (>= 0.9.9))
   )
 )
 
@@ -515,7 +516,7 @@ For more information see https://semgrep.dev
     (conf-libcurl (= 1)) ; force older version of conf-libcurl to make windows work
     ; web stuff
     uri
-    uuidm
+    (uuidm (>= 0.9.9))
     ; cohttp >= 6.0.0 requires opam 2.1.0 which used to not available in Windows
     ; TODO: now that opam 2.2.0 is out and support windows, upgrade to 6.0.0
     (cohttp (= 5.3.0))

libs/git_wrapper/Git_wrapper.ml

@@ -501,7 +501,8 @@ let run_with_worktree (caps : < Cap.chdir ; Cap.tmp >) ~commit ?branch f =
     | None -> raise (Error "")
   in
   let rand_dir () =
-    let uuid = Uuidm.v `V4 in
+    let rand = Stdlib.Random.State.make_self_init () in
+    let uuid = Uuidm.v4_gen rand () in
     let dir_name = "semgrep_git_worktree_" ^ Uuidm.to_string uuid in
     let dir = CapTmp.get_temp_dir_name caps#tmp / dir_name in
     UUnix.mkdir !!dir 0o777;

libs/tracing/unix/Tracing.ml

@@ -201,6 +201,18 @@ let trace_data_only ?(level = Info) ~__FUNCTION__ ~__FILE__ ~__LINE__ name
   with_span ~level ~__FUNCTION__ ~__FILE__ ~__LINE__ name (fun sp ->
       f () |> add_yojson_to_span sp)
 
+let log_trace_message () =
+  match Otel.Scope.get_ambient_scope () with
+  | None ->
+      (* nosemgrep: no-logs-in-library *)
+      Logs.info (fun m ->
+          m "Tracing is enabled for this scan. There was no trace id recorded.")
+  | Some scope ->
+      let id = Otel.Trace_id.to_hex scope.trace_id in
+      (* nosemgrep: no-logs-in-library *)
+      Logs.info (fun m ->
+          m "Tracing is enabled for this scan. The trace id is <%s>." id)
+
 (*****************************************************************************)
 (* Entry points for setting up tracing *)
 (*****************************************************************************)
@@ -241,7 +253,9 @@ let with_tracing fname trace_endpoint data f =
   Opentelemetry_client_ocurl.with_setup ~config () @@ fun () ->
   with_top_level_span ?parent_span_id ?parent_trace_id ~__FILE__ ~__LINE__ ~data
     fname
-  @@ fun sp -> f sp
+  @@ fun sp ->
+  log_trace_message ();
+  f sp
 
 (* Alt: using cohttp_lwt (we probably want to do this when we switch to Eio w/ *)
 (* their compatibility layer)

semgrep.opam

@@ -1,6 +1,6 @@
 # This file is generated by dune, edit dune-project instead
 opam-version: "2.0"
-version: "1.79.0"
+version: "1.90.0"
 synopsis:
   "Like grep but for code: fast and syntax-aware semantic code pattern for many languages"
 description: """
@@ -12,7 +12,7 @@ For more information see https://semgrep.dev
 """
 maintainer: ["Yoann Padioleau <[email protected]>"]
 authors: ["Yoann Padioleau <[email protected]>"]
-license: "LGPL-2.1"
+license: "LGPL-2.1-only"
 homepage: "https://semgrep.dev"
 bug-reports: "https://github.com/semgrep/semgrep/issues"
 depends: [
@@ -65,7 +65,7 @@ depends: [
   "ambient-context-lwt"
   "conf-libcurl" {= "1"}
   "uri"
-  "uuidm"
+  "uuidm" {>= "0.9.9"}
   "cohttp" {= "5.3.0"}
   "cohttp-lwt-unix"
   "cohttp-lwt-jsoo"

src/osemgrep/cli_ci/Ci_subcommand.ml

@@ -201,7 +201,7 @@ let scan_config_and_rules_from_deployment ~dry_run
   let scan_metadata : OutJ.scan_metadata =
     {
       cli_version = Version.version;
-      unique_id = Uuidm.v `V4;
+      unique_id = Uuidm.v4_gen (Stdlib.Random.State.make_self_init ()) ();
       (* TODO: should look at conf.secrets, conf.sca, conf.code, etc. *)
       requested_products = [];
       dry_run = false;

src/osemgrep/configuring/Semgrep_settings.ml

@@ -20,10 +20,11 @@ type t = {
 }
 
 let default =
+  let rand = Stdlib.Random.State.make_self_init () in
   {
     has_shown_metrics_notification = None;
     api_token = None;
-    anonymous_user_id = Uuidm.v `V4;
+    anonymous_user_id = Uuidm.v4_gen rand ();
   }
 
 (*****************************************************************************)

src/osemgrep/core/Metrics_.ml

@@ -144,8 +144,9 @@ type t = {
 let now () : Timedesc.Timestamp.t = Timedesc.Timestamp.now ()
 
 let default_payload =
+  let rand = Stdlib.Random.State.make_self_init () in
   {
-    Semgrep_metrics_t.event_id = Uuidm.v `V4;
+    Semgrep_metrics_t.event_id = Uuidm.v4_gen rand ();
     anonymous_user_id = "";
     started_at = now ();
     sent_at = now ();

src/osemgrep/language_server/Test_LS_e2e.ml

@@ -194,7 +194,9 @@ let send_map (type a) (info : server_info) packet (f : Packet.t -> a) :
 (*****************************************************************************)
 
 let send_request info request =
-  let id = Uuidm.v `V4 |> Uuidm.to_string in
+  let id =
+    Uuidm.v4_gen (Stdlib.Random.State.make_self_init ()) () |> Uuidm.to_string
+  in
   let packet = Packet.Request (CR.to_jsonrpc_request request (`String id)) in
   send_map info packet
 

src/osemgrep/language_server/Unit_LS.ml

@@ -103,7 +103,7 @@ let mock_run_results (files : string list) : Core_runner.result =
 
 let mock_workspace ?(git = false) () : Fpath.t =
   let rand_dir () =
-    let uuid = Uuidm.v `V4 in
+    let uuid = Uuidm.v4_gen (Stdlib.Random.State.make_self_init ()) () in
     let dir_name = "test_workspace_" ^ Uuidm.to_string uuid in
     let dir = Filename.concat (Filename.get_temp_dir_name ()) dir_name in
     Unix.mkdir dir 0o777;

src/osemgrep/language_server/server/Lsp_.ml

@@ -82,7 +82,9 @@ let respond (type r) (id : Id.t) (request : r CR.t) (response : r) =
 
 (** Send a request to the client *)
 let request request =
-  let id = Uuidm.v `V4 |> Uuidm.to_string in
+  let id =
+    Uuidm.v4_gen (Stdlib.Random.State.make_self_init ()) () |> Uuidm.to_string
+  in
   let request = SR.to_jsonrpc_request request (`String id) in
   Logs.debug (fun m ->
       m "Sending request %s"
@@ -117,7 +119,9 @@ let notify_show_message ~kind s =
 
 (** Show a little progress circle while doing thing. Returns a token needed to end progress*)
 let create_progress title message =
-  let id = Uuidm.v `V4 |> Uuidm.to_string in
+  let id =
+    Uuidm.v4_gen (Stdlib.Random.State.make_self_init ()) () |> Uuidm.to_string
+  in
   Logs.debug (fun m ->
       m "Creating progress token %s, (%s: %s)" id title message);
   let token = ProgressToken.t_of_yojson (`String id) in

src/osemgrep/networking/Semgrep_login.ml

@@ -27,7 +27,8 @@ type login_session = shared_secret * Uri.t
 let support_url = "https://semgrep.dev/docs/support/"
 
 let make_login_url () =
-  let session_id = Uuidm.v `V4 in
+  let rand = Stdlib.Random.State.make_self_init () in
+  let session_id = Uuidm.v4_gen rand () in
   ( session_id,
     Uri.(
       add_query_params'

src/osemgrep/reporting/Gitlab_output.ml

@@ -94,7 +94,7 @@ let format_cli_match (cli_match : OutT.cli_match) =
   let id =
     (* TODO the ?index argument needs to be provided (for ci_unique_key duplicates) *)
     Semgrep_hashing_functions.ci_unique_key cli_match
-    |> Uuidm.of_bytes |> Option.get |> Uuidm.to_string
+    |> Uuidm.of_binary_string |> Option.get |> Uuidm.to_string
   in
   let r =
     [