sonatype-nexus-community / oysteR

Create purls from the filtered sands of your dependencies, powered by OSS Index
https://sonatype-nexus-community.github.io/oysteR/
Apache License 2.0
40 stars 9 forks source link

Extending to other pkg purls #23

Closed csgillespie closed 4 years ago

csgillespie commented 4 years ago

Creating an issue to expand on a comment in https://github.com/sonatype-nexus-community/oysteR/pull/21

Comment from @csgillespie

I'm not really keen on this implementation. It's doesn't extend that nicely. What about when you call audit_deps()

Comment from @JosiahParry

I think my hesitance is in passing a whole data frame and inferring arguments from that data frame (assumedly based on column names). I'd rather an implementation that accepts vectors for each argument—e.g. pkg, version, scheme. This way you can run audit deps inside of call like mutate(df, pkg_audit = audit_pkg_deps(pkg_col, version_col, scheme_col)). This would also give you more flexibility in being able to use list objects etc.

So I think it's reasonable to have a vector interface and a data frame interface. The dataframe interface is required for efficiency reasons on the API.

Part of the rationale here is I think it makes sense to be able to audit packages before they're installed.

Good point

Alternatively this could be a single function which checks if pkg is a data.frame, if so use the installed.packages() approach. Then, use a a vector based approach.

I like two separate functions. It's cleaner

@DarthHater do you have an opinion?

csgillespie commented 4 years ago

Fixed: https://github.com/sonatype-nexus-community/oysteR/commit/aad0c02b74fb14b72d7e3c8c28b920a2c26eccd6#diff-49609c2324e417bef12923cbc3d93d20