aboutcode-org / aboutcode-org/scancode-toolkit
Implement Alpine APKBUILD parser in packagedcode
- Dominant language
- Python
- Stars
- 2.6k
- Forks
- 791
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 5
Description
## Short Description
Add Alpine's APKBUILD (apk package recipe) parser that would live in src/packagedcode/alpine_build.py and return a Package object.
## Possible Labels
copyright scan
email and url scan
license scan
## Select Category
- [ x ] Enhancement
- [ x ] Add License/Copyright
- [ ] Scan Feature
- [ ] Packaging
- [ ] Documentation
- [ x ] Expand Support
- [ ] Other
## **Describe the Update**
Alpine packages lack some necessary information to generate a compliance report (e.g. copyright, full license text, source code & patches).
Those are avaliable only in the aports repository (each package has reference to commit sha in aports repo, specifically in the APKBUILD files.
This code would be later used in scancode.io to create a pipeline that would get recipes for packages-> parse them and get source code, pathces, etc -> scan them & add missing information gathered from the package recipe & its code
## **How This Feature will help you/your organization**
At ONAP we're trying to switch our images to Alpine, as it is a GPLv3 free base image (ONAP Technical Steering Committee decided to avoid GPLv3 as much as possible)
This will be a brick towards having complete information about alpine pkgs in scancode.io to be able to generate compliance documentation.
## **Possible Solution/Implementation Details**
One issue found so far is bash param subst being used in the recipes which needs to be handled.
## **Example/Links if Any**
https://wiki.alpinelinux.org/wiki/APKBUILD_Reference
https://wiki.alpinelinux.org/wiki/APKBUILD_examples:Multiple_Subpackages
a bit related to #2061
## **Can you help with this Feature**
@quepop
Contributor guide
Assessment
This issue has not been assessed yet.