Custom parameters configured for SCAResolver cause SCAResolver to fail.

[nleach999]

Description

Related to issue #1130 and #1133.

When adding strings of additional parameters to pass to build tools via SCAResolver, the configuration of sca.sca-resolver-add-parameters.custom-parameter does not properly group the parameters. The result is that parameters intended for pip, as an example, are instead passed as parameters to SCAResolver. SCAResolver ends in error since it doesn't understand parameters intended for pip.

I didn't test for other build tool custom parameters, but they will likely have the same issue.

Expected Behavior

When I configure multiple custom parameters for build tools, all the custom parameters should be passed to the targeted build tool.

Actual Behavior

The configuration doesn't allow for the custom parameters to be properly grouped so that they can be sent to the targeted build tool.

Reproduction

This form works given there is only one custom parameter targeting pip:

sca-resolver-add-parameters:
  log-level: Verbose
  e: "*.ext1"
  custom-parameter: "--pip-parameters=--no-cache-dir"

However, if I want to send more than one parameter, it is not possible.
This configuration fails because the parameters --extra-index-url (and probably --trusted-host) is passed to SCAResolver, which throws an error and stops:

sca-resolver-add-parameters:
  custom-parameter: "--pip-parameters=--no-cache-dir --extra-index-url http://devpi:3141/root/dev/+simple/ --trusted-host devpi"

This variation doesn't work for the same reason:

sca-resolver-add-parameters:
  custom-parameter: "--pip-parameters=\"--no-cache-dir --extra-index-url http://devpi:3141/root/dev/+simple/ --trusted-host devpi\""

This variation doesn't work because this is how pip is invoked by SCAResolver: python3 -m pip install -r /tmp/c8161841-3e5b-4de4-8fb6-add665150a39/requirements.txt --no-input \"--no-cache-dir$IFS--extra-index-url$IFShttp://devpi:3141/root/dev/+simple/$IFS--trusted-host$IFSdevpi\"

sca-resolver-add-parameters:
  custom-parameter: "--pip-parameters=\"--no-cache-dir$IFS--extra-index-url$IFShttp://devpi:3141/root/dev/+simple/$IFS--trusted-host$IFSdevpi\""

This variation doesn't work because this is how pip is invoked by SCAResolver: python3 -m pip install -r /tmp/b6430272-3495-4dd4-b508-72eeef6f10ea/requirements.txt --no-input --no-cache-dir$IFS--extra-index-url$IFShttp://devpi:3141/root/dev/+simple/$IFS--trusted-host$IFSdevpi

sca-resolver-add-parameters:
  custom-parameter: "--pip-parameters=--no-cache-dir$IFS--extra-index-url$IFShttp://devpi:3141/root/dev/+simple/$IFS--trusted-host$IFSdevpi"

Workaround

A workaround exists for pip and likely other tools is to put the options in the tool's configuration file. In the case of pip, the file ~/.pip/pip.conf can look something like this:

[global]
extra-index-url=http://devpi:3141/root/dev/+simple/
no-cache-dir=True
[install]
trusted-host=devpi

While this works for a webhook deployment (since the container needs to be rebuilt with the development tools), this may not be feasible for CLI-style executions.

Environment Details

CxFlow 1.6.39

[itsKedar]

Fixed in 1.6.40 release