aboutcode-org / aboutcode-org/scancode-toolkit

Ensure we can detect simple "computed" Python package versions in setup.py

未關閉
#2,263 4 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
bug package scan package-formats
主要語言
Python
星號
2.6k
分支
791
平均合併
1 天 12 小時
30 天內合併 PR
5

描述

### Description
It is a common pattern to have a computed version for a setup.py.
This means that we cannot detect the version in this case. This is even the case in the current scancode-toolkit.
See for instance:
https://github.com/nexB/scancode-toolkit/blob/c3c92ff121632ea5db835f1c460c7d483a91a5d6/setup.py#L101

In simpler cases we should be able to detect the convention of using a "dunder" `__version__` field such as in six:

- in setup.py https://github.com/benjaminp/six/blob/c0be8815d13df45b6ae471c4c436cce8c192245d/setup.py#L47 where a `version=six.__version__` is used
- in the six.py module where the `__version__` is defined https://github.com/benjaminp/six/blob/c0be8815d13df45b6ae471c4c436cce8c192245d/six.py#L32

We also need to clean up the mess we are about to create with the new break out in repos for #2233 and the use of setuptools_scm that would completely remove any version references from setup.py/.cfg https://github.com/nexB/typecode/blob/a337e7484ec563f47c2e6d3ce650448d69b13549/setup.cfg
See https://github.com/nexB/typecode/issues/3

One approach to a solution may be in the many possible tools listed in #253
See also https://packaging.python.org/guides/single-sourcing-package-version/

A good test is with this list of download URLs:
- https://files.pythonhosted.org/packages/05/54/3324b0c46340c31b909fcec598696aaec7ddc8c18a63f2db352562d3354c/cffi-1.14.0.tar.gz
- https://files.pythonhosted.org/packages/05/8c/40cd6949373e23081b3ea20d5594ae523e681b6f472e600fbc95ed046a36/urllib3-1.25.9.tar.gz
- https://files.pythonhosted.org/packages/0f/86/e19659527668d70be91d0369aeaa055b4eb396b0f387a4f92293a20035bd/pycparser-2.20.tar.gz
- https://files.pythonhosted.org/packages/20/96/b7d1e668b90270d0d68a8360ce3d01ed5f34aada55aaeb0c9bf3e9f03ae2/flit-2.3.0.tar.gz
- https://files.pythonhosted.org/packages/21/9f/b251f7f8a76dec1d6651be194dfba8fb8d7781d10ab3987190de8391d08e/six-1.14.0.tar.gz
- https://files.pythonhosted.org/packages/2f/e0/3d435b34abd2d62e8206171892f174b180cd37b09d57b924ca5c2ef2219d/docutils-0.16.tar.gz
- https://files.pythonhosted.org/packages/40/a7/ded59fa294b85ca206082306bba75469a38ea1c7d44ea7e1d64f5443d67a/certifi-2020.6.20.tar.gz
- https://files.pythonhosted.org/packages/59/11/1dd5c70f0f27a88a3a05772cd95f6087ac479fac66d9c7752ee5e16ddbbc/paho-mqtt-1.5.0.tar.gz
- https://files.pythonhosted.org/packages/75/28/521c6dc7fef23a68368efefdcd682f5b3d1d58c2b90b06dc1d0b805b51ae/wheel-0.34.2.tar.gz
- https://files.pythonhosted.org/packages/89/43/07d07654ee3e25235d8cea4164cdee0ec39d1fda8e9203156ebe403ffda4/pexpect-4.6.0.tar.gz
- https://files.pythonhosted.org/packages/bb/92/e51c58d463ebbabb7b226662655cef6d17d3b4b83f570b08f6be0fe2b1b8/flit_core-2.3.0.tar.gz
- https://files.pythonhosted.org/packages/cb/19/57503b5de719ee45e83472f339f617b0c01ad75cba44aba1e4c97c2b0abd/idna-2.9.tar.gz
- https://files.pythonhosted.org/packages/da/67/672b422d9daf07365259958912ba533a0ecab839d4084c487a5fe9a5405f/requests-2.24.0.tar.gz
- https://files.pythonhosted.org/packages/f4/ba/98ee2054a2d7b8bebd367d442e089489250b6dc2aee558b000e961467212/pytoml-0.1.21.tar.gz
- https://files.pythonhosted.org/packages/fc/bb/a5768c230f9ddb03acc9ef3f0d4a3cf93462473795d18e9535498c8f929d/chardet-3.0.4.tar.gz
- https://github.com/python/asyncio/archive/master.zip

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。