Survey of Python package build environments

psf / sboms-for-python-packages

Software Bill-of-Materials documents for Python packages

12 stars 0 forks source link

Survey of Python package build environments #3

Open sethmlarson opened 4 days ago

sethmlarson commented 4 days ago

Many Python packages are built using hosted build systems like GitHub Actions, Travis, and AppVeyor. Some build systems use containers, like cibuildwheel and multi-build. Survey the following information:

Which operating systems are used?
Which package managers are used?
Do these package ecosystems have a Package URL (PURL)?
Do these package ecosystems publish OSV records?
Do these package ecosystems support querying from a filepath to a package?

Build environments to survey:

[ ] multibuild
[ ] cibuildwheel
[ ] quay.io/pypa images

sethmlarson commented 4 days ago

Multibuild uses Travis for Linux and macOS and AppVeyor for Windows. Linux uses the quay.io/pypa manylinux images. Has a list of "libraries" that get built from source.

sethmlarson commented 4 days ago

The quay.io/pypa manylinux/musllinux images all use CentOS/AlmaLinux/Alpine operating systems, so the package managers are either yum, dnf or apk.

Package URLs:

CentOS: pkg:rpm/centos/<package>@<version>
AlmaLinux: pkg:rpm/almalinux/<package>@<version>
Alpine: pkg:apk/alpine/<package>@<version>

Finding which package provides a file:

yum: yum whatprovides <file>
apk: apk info --who-provides <file>
dnf: dnf provides <file>