search

aboutcode-org / vulnerablecode

A free and open vulnerabilities database and the packages they impact. And the tools to aggregate and correlate these vulnerabilities. Sponsored by NLnet https://nlnet.nl/project/vulnerabilitydatabase/ for https://www.aboutcode.org/ Chat at https://gitter.im/aboutcode-org/vulnerablecode Docs at https://vulnerablecode.readthedocs.org/
https://public.vulnerablecode.io
Apache License 2.0
523 stars 190 forks source link

Which distro do we support ? #519

Open Hritik14 opened 3 years ago

Hritik14 commented 3 years ago

The installation instructions mention

System requirements

Python 3.8+
PostgreSQL 9+
Compiler toolchain and development files for Python and PostgreSQL

On Debian-based distros, these can be installed with:

sudo apt-get install python3-venv python3-dev postgresql libpq-dev build-essential

But as per https://packages.debian.org/buster/all/allpackages, all the packages listed above are already present in a debian buster installation.

We should explicitly mention which Debian we support ( and have some tests to prove that ). Supporting distros based on Debian is OK and dependencies for those should be mentioned separately.

A point to note: Our CI tests run on ubuntu-latest (we don't have a lot of choices there) and our Dockerfile uses python:3.8 which on buildpack-deps

pombredanne commented 3 years ago

We should list exactly what we support, what we test on and what should be working.

pombredanne commented 3 years ago

we should still list the system packages we need, even if included in Buster (I would doubt postgreSQL is installed by default though)

Hritik14 commented 3 years ago

@pombredanne Yes, postgres is installed. Have a look in the link mentioned above.

we should still list the system packages we need

But that get out of hand pretty soon. Do we need to list Git ? svn ? what about other small packages that are usually taken for granted ?

pombredanne commented 3 years ago

package-wise, everything you would install and need explicitly above an beyond the bare OS should be listed and if we use git and svn in production, this includes them too