Ericsson / codechecker

CodeChecker is an analyzer tooling, defect database and viewer extension for static and dynamic analyzer tools.
https://codechecker.readthedocs.io
Apache License 2.0
2.28k stars 383 forks source link

move thrift stubs to a separate submodule #2397

Closed gyorb closed 4 years ago

gyorb commented 5 years ago

After some discussion we will move the files generated by the thrift-compiler #2295 into a separate git repository, which will be included as a git-submodule.

With that change no thrift compiler is needed to be installed on the host machine to build the codechecker package.

The new repository should contain short README about the content and how to update in case of an api change (maybe a makefile) and a license file (Apache 2.0)

The new repository: https://github.com/Ericsson/codechecker-thrift-api

scphantm commented 5 years ago

like i said in #2409, please don't just include as a submodule or subtree. Actually generate libraries. so move the thrift source into this new project, the compiler make file, etc. Then go thru the effort of registering everything with pypi, npm, (and java would be great!!) . then when you publish, you compile everything into the appropriate languages, then publish them to the main distribution sites. Then other projects (including your CodeChecker project) simply pulls them in as a dependency library and begins using them. Doing it this way prevents people like me from having to do crap like this

import unittest, sys
from pprint import pprint

from thrift import Thrift
from thrift.transport import TSocket, THttpClient
from thrift.transport import TTransport
from thrift.protocol import TBinaryProtocol, TJSONProtocol

sys.path.append('../../thrift/v6/gen-py/codeCheckerDBAccess_v6') <--- horrible, horrible idea!!!
sys.path.append('../../thrift/v6/gen-py') <--- horrible, horrible idea!!!

import codeCheckerDBAccess

class MyTestCase(unittest.TestCase):
    def test_something(self):
        try:
            print "starting thrift client..."
            transport = THttpClient.THttpClient('https://codecheck.apps.lab.mycompany.com:443/Default/v6.21/CodeCheckerService')
            protocol = TJSONProtocol.TJSONProtocol(transport)
            client = codeCheckerDBAccess.Client(protocol)

            transport.open()

            data = client.getSeverityCounts([1],
                                           None,
                                           None)

            print(type(data))
            pprint(data)

            data = client.getRunData(None, 500, 0)

            print(type(data))
            pprint(data)

            transport.close()

        except Thrift.TException, tx:
            print str(tx)

if __name__ == '__main__':
    unittest.main()

in order to make calls to your API.

scphantm commented 5 years ago

the other thing to consider as well, big danger in putting git pull/clone commands in your make files is your enterprise clients. its common practice in enterprises to not have their servers able to connect to the internet. Its a safety thing in case a trojan horse gets on a server, it has no ability to heartbeat outside the network or push data out. My last shop, we had 2500 windows and 2000 linux boxes running. We had a grand total of about 50 that actually had the ability to connect to the internet. and none of them were our build machines. We rerouted calls to things like NPM, MVN, PyPi, DockerHub, etc thru a large Artifactory cluster. From there we could control the libraries that were coming into the enterprise.

Worked great until some morons in the JS world (and to a much lesser extent python) started putting code into their module installers to go out to website xyz and download this, outside of NPM. There was no way to capture that, or reroute the url that it was attempting to download thru our Artifactory server. So, our solution was simple. The library was black listed and the JS developers simply were not allowed to use those libraries. Or any other library that used that one. To put it simply, if i still worked there, would have been zero chance i could use this product because you already do a git clone for the dojo libraries in your build. The evaluation would have never gotten started.

gyorb commented 4 years ago

After some discussion with the team we did not create a separate repository for the thrift stubs but we modified the the packaging and how the stubs are generated to be able to be pushed to pypi and npm. With #2570 we are now able to publish the thrift generated stubs to pypi and to npm. The pypi packages are codechecker-api and codechecker-api-shared and the npm packages are codechecker-api for node.js and codechecker-api-js for jquery.