nexB / purldb

Tools to create and expose a database of purls (Package URLs). This project is sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase/ and nexB for https://www.aboutcode.org/ Chat is at https://gitter.im/aboutcode-org/discuss
https://purldb.readthedocs.io/
29 stars 20 forks source link

Some packages under consideration have no versioned archives and no git tag #349

Open pombredanne opened 4 months ago

pombredanne commented 4 months ago

Some packages under consideration have no versioned archives and no git tag. What do we do when we only have a stream of commits? Should we take some arbitrary date-based snapshots?

armijnhemel commented 4 months ago

Do you have an example? Are these packages that are for example packaged by a distribution? If that is the case, then I would simply take the same snapshots as distributions use.

pombredanne commented 4 months ago

@keshav-space do you have examples?

armijnhemel commented 4 months ago

I do have an example of a package that hasn't had an actual release in 6.5 years, but which is actively developed:

https://github.com/facebook/redex

Another one (10 years without releases but seeing active development): https://github.com/OpenXcom/OpenXcom

but these aren't very mainstream packages AFAIK.

pombredanne commented 4 months ago

For instance http://www.aleph1.co.uk/gitweb/?p=yaffs2.git;a=tags only has a few old outdated tags, and does not version things

keshav-space commented 4 months ago

some more here https://git.openwrt.org/project/libubox.git https://git.openwrt.org/project/procd.git

armijnhemel commented 4 months ago

some more here https://git.openwrt.org/project/libubox.git https://git.openwrt.org/project/procd.git

For these I would just take what OpenWrt packages in a recent release or what OpenWrt has historically packaged.

A (not so accurate) estimate for libubox:

$ git log --follow ./package/libs/libubox/Makefile | grep -i 'git head'  | wc -l
34

but if you look at what was used in the actual releases it is probably fewer.

armijnhemel commented 4 months ago

For instance http://www.aleph1.co.uk/gitweb/?p=yaffs2.git;a=tags only has a few old outdated tags, and does not version things

Here I would go with the versions that Android used to ship (they no longer seem to).