priv-kweihmann / meta-sca

Layer for static code analysis and security hardening
Other
91 stars 36 forks source link

setuptools-lint #511

Closed RobertBerger closed 4 years ago

RobertBerger commented 4 years ago

Is your feature request related to a problem? Please describe. Currently I am trying to fix things which are wrong in setup.py, which are not detected in build-time, but only in run-time.

Describe a tool that might help here https://pypi.org/project/setuptools-lint/

This package expose pylint as a lint command into setup.py

Maybe this might help?

priv-kweihmann commented 4 years ago

If I get that right, you need to catch some issues at runtime in some python code, right? Or did you try to lint setup.py itself?

From what I see in the tools description, is that it injects pylint into setup.py as a task one could execute as part of the build process, which then lint the to be installed code, but not the steup.py itself - Is this what you wanted?

If you tried to lint setup.py there might be better tools around - that's one of the lessons I learned recently around the upcoming switch from setup.py to PEP518 as a install method.

RobertBerger commented 4 years ago

That's not what I wanted ;)

Say we have something like this:

install_requires = [
    "paho-mqtt==1.4.0",
    "sqlalchemy==1.1.17",
    "pymysql==0.9.3",
    "psutil==5.6.3",
    #"asyncio>=0.1",
    "apscheduler==3.6.3",
    "redis==2.10.6"
]

Case 1)

apscheduler is not 3.6.3 in my image (I made a mistake in my recipe, whatever). At the moment I can only detect this problem is run time on my target. Ideally I could detect it in build time.

Case 2)

asyncio is from version 3.4 part of "core" python and does not have specific version info anymore. At the moment I can only detect this problem is run time on my target. Ideally I could detect it in build time.

How do you work now with https://www.python.org/dev/peps/pep-0518/ ?

Do you have an example somewhere lying around? No more setup.py?

Would this help to tackle my problem?

priv-kweihmann commented 4 years ago

Okay now I get it - You're looking for a tool to lint dependencies of packages - I'll do a little research on that in the next days and will come back to you with my findings, as the tool don't seem to fulfill your usecase.

Regarding the PEP518 thing - I just came across that at ansible-lint, where they dropped setup.py completely - currently I don't have a proper solution, but I guess in the next few weeks I'll find some time to implement some method to make it work - I guess over the time more and more projects will abandon the "classic" setup.py. BTW I love those python guys - still they can't decide on a proper and common way of installing something...

priv-kweihmann commented 4 years ago

Okay I revert my judgment about the tool - Tests showed that this is does what you expected - Will integrate it somewhere in the near future

RobertBerger commented 4 years ago

OK cool!

I'll be happy to test out some stuff.

Thanks!