sonatype-nexus-community / jake

Check your Python environments for vulnerable Open Source packages with OSS Index or Sonatype Nexus Lifecycle.
https://jake.readthedocs.io/
Apache License 2.0
114 stars 24 forks source link

[FEATURE] Don't install testing dependencies when installing via pip #27

Closed harpaj closed 3 years ago

harpaj commented 4 years ago

cc @bhamail / @DarthHater

DarthHater commented 4 years ago

Great suggestion! Do think you can send us a PR with that, no pressure if you can't but it sounds like you got a good idea of what to do and we love community contributions!

ButterB0wl commented 4 years ago

@harpaj yeah i agree we have to figure our a good way to not ship our dev dependencies

In the meantime as a workaround, you can install jake to the system and evaluate site packages external to the shell with jake installed using the target flag and passing in a site-packages array.

This section of the readme describes how to do that by storing them into an env variable:

To get the site packages available to a virtual environment:

  $ source .venv/bin/activate
  (.venv) $ python -m site
  sys.path = [
      '/home/ButterB0wl/git_repos/jake',
      '/usr/lib/python37.zip',
      '/usr/lib/python3.7',
      '/usr/lib/python3.7/lib-dynload',
      '/home/ButterB0wl/git_repos/jake/.venv/lib/python3.7/site-packages',
  ]
  USER_BASE: '/home/ButterB0wl/.local' (exists)
  USER_SITE: '/home/ButterB0wl/.local/lib/python3.7/site-packages' (exists)
  ENABLE_USER_SITE: False
The -t argument accepts a list as a string literal. This is the best way I've found to do this, if you find a better way please create an issue :)

Run the python command using the shell you want to target and export to an env var:

  # using target python shell for system or virtual environment
  $ export JAKE_TARGET=`python -c "import site; print(site.getsitepackages())"`
  # using whatever shell has access to the jake module, can be a global install or stand-alone virtual environment
  $ jake ddt -t "$JAKE_TARGET"
In other words: activate the virtual environment, run the site.getsitepackages() command, and make the output accesible to your jake install 
ButterB0wl commented 4 years ago

Is that something that you manage through setup.py or do you use some sort of package management on top of pip? (I've seen pipenv and poetry for example and they can separate those out)

If you have an example where another project is doing what you would consider optimal that would be awesome

jwa5426 commented 3 years ago

Is anyone working on this? It looks like there are still a lot of unnecessary dependencies for install_requires. I’d be happy to give this a shot if no one else is!

bhamail commented 3 years ago

@jwa5426 Go for it!

In case it helps, we started a "dev only" list of requirements here: requirements-dev.txt

Not sure if some items in requirements.txt should be moved to dev or not.

bhamail commented 3 years ago

A heads-up, in case it matters, I also tried to improve version dependency things a bit via this PR #57

jwa5426 commented 3 years ago

@bhamail Cool, I’ll wait for that to merge before I try moving the dev dependencies.