aboutcode-org / aboutcode-org/scancode-toolkit

Ensure we can detect simple "computed" Python package versions in setup.py

Đang mở
#2,263 4 bình luận 0 reaction 0 người được giao Xem trên GitHub
bug package scan package-formats
Ngôn ngữ chính
Python
Star
2.6k
Fork
791
Merge trung bình
1 ngày 12 giờ
Pull request đã merge (30 ngày)
5

Mô tả

### Description
It is a common pattern to have a computed version for a setup.py.
This means that we cannot detect the version in this case. This is even the case in the current scancode-toolkit.
See for instance:
https://github.com/nexB/scancode-toolkit/blob/c3c92ff121632ea5db835f1c460c7d483a91a5d6/setup.py#L101

In simpler cases we should be able to detect the convention of using a "dunder" `__version__` field such as in six:

- in setup.py https://github.com/benjaminp/six/blob/c0be8815d13df45b6ae471c4c436cce8c192245d/setup.py#L47 where a `version=six.__version__` is used
- in the six.py module where the `__version__` is defined https://github.com/benjaminp/six/blob/c0be8815d13df45b6ae471c4c436cce8c192245d/six.py#L32

We also need to clean up the mess we are about to create with the new break out in repos for #2233 and the use of setuptools_scm that would completely remove any version references from setup.py/.cfg https://github.com/nexB/typecode/blob/a337e7484ec563f47c2e6d3ce650448d69b13549/setup.cfg
See https://github.com/nexB/typecode/issues/3

One approach to a solution may be in the many possible tools listed in #253
See also https://packaging.python.org/guides/single-sourcing-package-version/

A good test is with this list of download URLs:
- https://files.pythonhosted.org/packages/05/54/3324b0c46340c31b909fcec598696aaec7ddc8c18a63f2db352562d3354c/cffi-1.14.0.tar.gz
- https://files.pythonhosted.org/packages/05/8c/40cd6949373e23081b3ea20d5594ae523e681b6f472e600fbc95ed046a36/urllib3-1.25.9.tar.gz
- https://files.pythonhosted.org/packages/0f/86/e19659527668d70be91d0369aeaa055b4eb396b0f387a4f92293a20035bd/pycparser-2.20.tar.gz
- https://files.pythonhosted.org/packages/20/96/b7d1e668b90270d0d68a8360ce3d01ed5f34aada55aaeb0c9bf3e9f03ae2/flit-2.3.0.tar.gz
- https://files.pythonhosted.org/packages/21/9f/b251f7f8a76dec1d6651be194dfba8fb8d7781d10ab3987190de8391d08e/six-1.14.0.tar.gz
- https://files.pythonhosted.org/packages/2f/e0/3d435b34abd2d62e8206171892f174b180cd37b09d57b924ca5c2ef2219d/docutils-0.16.tar.gz
- https://files.pythonhosted.org/packages/40/a7/ded59fa294b85ca206082306bba75469a38ea1c7d44ea7e1d64f5443d67a/certifi-2020.6.20.tar.gz
- https://files.pythonhosted.org/packages/59/11/1dd5c70f0f27a88a3a05772cd95f6087ac479fac66d9c7752ee5e16ddbbc/paho-mqtt-1.5.0.tar.gz
- https://files.pythonhosted.org/packages/75/28/521c6dc7fef23a68368efefdcd682f5b3d1d58c2b90b06dc1d0b805b51ae/wheel-0.34.2.tar.gz
- https://files.pythonhosted.org/packages/89/43/07d07654ee3e25235d8cea4164cdee0ec39d1fda8e9203156ebe403ffda4/pexpect-4.6.0.tar.gz
- https://files.pythonhosted.org/packages/bb/92/e51c58d463ebbabb7b226662655cef6d17d3b4b83f570b08f6be0fe2b1b8/flit_core-2.3.0.tar.gz
- https://files.pythonhosted.org/packages/cb/19/57503b5de719ee45e83472f339f617b0c01ad75cba44aba1e4c97c2b0abd/idna-2.9.tar.gz
- https://files.pythonhosted.org/packages/da/67/672b422d9daf07365259958912ba533a0ecab839d4084c487a5fe9a5405f/requests-2.24.0.tar.gz
- https://files.pythonhosted.org/packages/f4/ba/98ee2054a2d7b8bebd367d442e089489250b6dc2aee558b000e961467212/pytoml-0.1.21.tar.gz
- https://files.pythonhosted.org/packages/fc/bb/a5768c230f9ddb03acc9ef3f0d4a3cf93462473795d18e9535498c8f929d/chardet-3.0.4.tar.gz
- https://github.com/python/asyncio/archive/master.zip

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.