aboutcode-org / aboutcode-org/scancode-toolkit

Implement Alpine APKBUILD parser in packagedcode

未关闭
#2,541 5 条评论 1 个 reaction 已指派 0 人 在 GitHub 查看
new feature package scan package-formats
主要语言
Python
星标
2.6k
派生
791
平均合并
1 天 12 小时
30 天内合并 PR
5

描述

## Short Description
Add Alpine's APKBUILD (apk package recipe) parser that would live in src/packagedcode/alpine_build.py and return a Package object.

## Possible Labels
copyright scan
email and url scan
license scan

## Select Category
- [ x ] Enhancement
- [ x ] Add License/Copyright
- [ ] Scan Feature
- [ ] Packaging
- [ ] Documentation
- [ x ] Expand Support
- [ ] Other

## **Describe the Update**
Alpine packages lack some necessary information to generate a compliance report (e.g. copyright, full license text, source code & patches).
Those are avaliable only in the aports repository (each package has reference to commit sha in aports repo, specifically in the APKBUILD files.
This code would be later used in scancode.io to create a pipeline that would get recipes for packages-> parse them and get source code, pathces, etc -> scan them & add missing information gathered from the package recipe & its code

## **How This Feature will help you/your organization**
At ONAP we're trying to switch our images to Alpine, as it is a GPLv3 free base image (ONAP Technical Steering Committee decided to avoid GPLv3 as much as possible)
This will be a brick towards having complete information about alpine pkgs in scancode.io to be able to generate compliance documentation.

## **Possible Solution/Implementation Details**
One issue found so far is bash param subst being used in the recipes which needs to be handled.

## **Example/Links if Any**
https://wiki.alpinelinux.org/wiki/APKBUILD_Reference
https://wiki.alpinelinux.org/wiki/APKBUILD_examples:Multiple_Subpackages

a bit related to #2061

## **Can you help with this Feature**
@quepop

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。