search

aboutcode-org / scancode-toolkit

:mag: ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase, the Google Summer of Code, Azure credits, nexB and others generous sponsors!
https://github.com/aboutcode-org/scancode-toolkit/releases/
2.07k stars 537 forks source link

Create Debian Distro package for scancode-toolkit #1580

Open aj4ayushjain opened 5 years ago

aj4ayushjain commented 5 years ago

So I have got the task to create the Debian package for existing scancode-toolkit which briefly include tasks

1.Understand the basic structure,building and installation 2.Package the unpresent dependencies. 3.Remove unnecessary files and folder and drop precompiled code.

and finally go on to make a package.

Debian repo:https://salsa.debian.org/python-team/modules/scancode-toolkit Fix #469
Fix for #487

pombredanne commented 2 years ago

For reference, repasting from https://github.com/nexB/scancode-toolkit/issues/1950#issuecomment-1024987215

@P-EB

BTW, totally unreleated, but, may I ask if there's a way to build scancode-toolkit for Debian without bundling all these third party modules? Just the Python work you wrote, and use what's needed from the system packages?

I was thinking scancode-toolkit relies only on what's in requirements.txt, but it seems it relies on far more, I'd like to use as much as possible Debian packages instead of bundled software. :)

The day we can have all the versions of these Python packages in Debian it will be able to run from system dependencies. Not until then. All the packages in the requirements.txt file are used: direct dependencies are declared in the setup.cfg and the whole deps tree of exact dependent versions is in requirements.txt

@maxyz has started quite a bit of packaging work a while back and there has been some more work done by @aj4ayushjain but this still needs quite some love to be completed.

This is tracked in https://github.com/nexB/scancode-toolkit/issues/1580 FWIW... There are three types of dependencies:

  1. pure python packages
  2. python package with native code
  3. python package with native code bundled from system deps https://github.com/nexB/scancode-plugins/tree/main/builtins

All these can be ported one by one alright and there are no superfluous ones in earnest. The type 3. have been carefully designed so that they can be also made to use system packages optionally and this was made specifically to support an easier port in Debian.

P-EB commented 2 years ago

@pombredanne Did anyone made a track of what is and what is not in Debian ?

pombredanne commented 2 years ago

@pombredanne Did anyone made a track of what is and what is not in Debian ?

@P-EB It was likely done back then and is likely obsolete now and would need to be redone IMHO

@maxyz @aj4ayushjain ... unless you have something?

pombredanne commented 2 years ago

Closing https://github.com/nexB/scancode-toolkit/issues/1614 in favor of this