Improving the conda-forge software supply chain with jake and OSSIndex

[bollwyvl]

We will (soon :crossed_fingers:) have jake available from conda-forge, which, despite its serpentine branding, appears to also know how to cross-correlate packages in repo.anaconda.com (only) to non-python "ecosystems" in their parlance, e.g. postgresql by using their free (as in rate-limited beer) REST API.

It would be lovely if we could make this a semi-automated part of the conda-forge process for those of us that are stuck in the i-dotting and t-crossing business.

For example, this could initially become part of the CI-checkable "homework" in the staged-recipes pipeline, where we might catch some out-of-date upstreams which might encourage the future feedstock owner to get involved with their (future) supply chain.

Some challenges:

• (as above) only knows about anaconda (not even r and msys2)
  • it's somewhat unclear which repo/ticketing system would even be the correct avenue for requesting that namespaces be added (these are supported by e.g. npm but not conda)
• probably would get rate-limited almost immediately unless we figure out some agreement
  • I don't have any relationship with the corporate entity that hosts the service
  • the REST API works over POST, but can be locally cached by jake... so perhaps staged-recipes, at least, do some sort of caching, so we're not pounding them with libstdc, etc. requests

Alternatives:

• tidelift
  • I do know some people there, but haven't dug into it much, where they also appear to have unresolved issues with multiple namespaces

[ForgottenProgramme]

I first thought jake was some guy.

[xhochy]

The mapping from conda package is done as part of the REST API of Sonatype or is there any logic for that in jake itself. From the README it looks like this is only mapping things back to PyPI (and that would be contrary to your postgres example above.

For me it is unclear whether we (as conda-forge) can do anything here or whether we need Sonatype to index conda-forge by themselves.

[bollwyvl]

I've started this issue on one of the repos.

[bollwyvl]

I first thought jake was some guy.

it is indeed named after the eminent herpetologists...