abathur / resholve

a shell resolver? :) (find and resolve shell script dependencies)
MIT License
231 stars 5 forks source link

Port to Python 3 #88

Closed dotlambda closed 1 year ago

dotlambda commented 1 year ago

Python 2 has been EOL since January 1, 2020 and it is insecure. That's relevant when parsing other people's code. See https://github.com/NixOS/nixpkgs/pull/201859.

abathur commented 1 year ago
7c6f434c commented 1 year ago

Ohhh OK I was too naively reading the claim that OPy is a small subset of Python2… Sorry.

abathur commented 1 year ago

I won't pretend to have a really deep understanding of it. IIUC it's a subset in that it builds the py27 and then uses some tree-shaking process to try and track what parts of that python are actually exercised by the oil codebase, and then do (magic? crimes?) to get discard parts that it didn't need for whatever load/memory performance it can claw back by doing so.

SamLukeYes commented 1 year ago

Can xonsh be used to replace oil?

figsoda commented 1 year ago

xonsh's syntax is probably too incompatible with bash to be useful here

abathur commented 1 year ago

My understanding aligns with figsoda's. xonsh is Python + some bits of Shell. As they put it on the landing page:

The language is a superset of Python 3.6+ with additional shell primitives that you are used to from Bash and IPython.

Pretty trivial to find valid bash that it can't parse:

$ xonsh <<EOF
{ declare -gA bashup_ev bashup_ev_r
} 
EOF

  File "<stdin>", line 1
    { declare -gA bashup_ev bashup_ev_r
                 ^
SyntaxError: ('code: bashup_ev',)

Oil's OSH parser is almost-entirely-Bash-compatible.

SamLukeYes commented 1 year ago

Well, I see some discussions about xonsh's bash-compatibility in https://github.com/xonsh/xonsh/issues/4015, and the issue author has mentioned bashlex - Python parser for bash. Would it be helpful here?

abathur commented 1 year ago

resholve uses the OSH parser (and, thus, python2) because it forms the foundation of a working shell that can actually execute nearly all of Bash and is tested against a massive corpus of wild scripts, which is generally what we want for a tool that we can trust to be able to parse, rewrite, and emit the vast majority of Bash/POSIX shell found in the wild without breaking it.

bashlex (or any other bash parser) might work, but it isn't battle-tested like OSH is. It exists to power explainshell.com, which generally just needs to handle a single line of shell at a time. It doesn't have to worry about deploying broken scripts if the parser doesn't recognize a structure and subtly changes it on the way back out. If you look through the issues, it's common to see syntax that doesn't work and the maintainer acknowledges that it doesn't work because he didn't need it for his case.