aboutcode-org / aboutcode-org/scancode-toolkit

Add support for container-based style packages (appimage, snap, flatpacks and similar)

Abierto
#2,602 0 comentarios 0 reacciones 0 asignados Ver en GitHub
package scan package-formats
Lenguaje dominante
Python
Estrellas
2.6k
Forks
791
Merge medio
1 d 12 h
PR fusionados (30 d)
5

Descripción

These are packages that are container-image like.
See
- https://en.wikipedia.org/wiki/Snap_(package_manager) and https://github.com/snapcore . Using `snap download ` fetches an `.assert` deb822-like file with keys and checksums and a `.snap` file which is squashfs image (that extractcode can extract). Inside there is little package details and license data and files available, beyond some Debian copyright (e.g. this is a likely messy thing to analyze)

- https://en.wikipedia.org/wiki/AppImage and https://github.com/AppImage . The distribution format is an Elf self-executable that contains its payload

- https://en.wikipedia.org/wiki/Flatpak and https://github.com/flatpak . The actual on-disk format and the ability to directly download one needs research. This seems to be some kind of OCI/docker container image. See https://docs.flatpak.org/en/latest/usb-drives.html?highlight=offline and https://unix.stackexchange.com/questions/404905/offline-install-of-a-flatpak-application
See also https://opencontainers.org/posts/blog/2018-11-07-bringing-oci-images-to-the-desktop-with-flatpak/#flatpaks-as-oci-images

Since all these are essentially similar to containers, the comprehensive scan may be a job for scancode.io

For snaps for instance, we have this:
```
$ curl -s -H "Snap-Device-Series: 14" https://api.snapcraft.io/v2/snaps/info/chromium | jq .
{
"channel-map": [],
"default-track": null,
"name": "chromium",
"snap": {
"license": "Apache-2.0 AND BSD-3-Clause AND LGPL-2.0 AND LGPL-2.1 AND MIT AND MS-PL AND (GPL-2.0+ OR LGPL-2.1+ OR MPL-1.1)",
"name": "chromium",
"prices": {},
"publisher": {
"display-name": "Canonical",
"id": "canonical",
"username": "canonical",
"validation": "verified"
},
"snap-id": "XKEcBqPM06H1Z7zGOdG5fbICuf8NWK5R",
"store-url": "https://snapcraft.io/chromium",
"summary": "Chromium web browser, open-source version of Chrome",
"title": "Chromium"
},
"snap-id": "XKEcBqPM06H1Z7zGOdG5fbICuf8NWK5R"
}
```

For flathub for flatpacks, we have this:
```
$ curl -s https://flathub.org/api/v1/apps/org.mozilla.firefox | jq .
{
"flatpakAppId": "org.mozilla.firefox",
"name": "Firefox",
"summary": "Mozilla Firefox Web Browser",
"description": "

The Firefox standalone app for Linux is here.................",
"developerName": null,
"projectLicense": "MPL-2.0",
"homepageUrl": "https://www.mozilla.org/firefox/",
"donationUrl": "https://donate.mozilla.org/",
"translateUrl": "https://wiki.mozilla.org/L10n:Starting_a_localization",
"bugtrackerUrl": "https://bugzilla.mozilla.org/",
"helpUrl": "https://support.mozilla.org/",
"categories": [
{
"name": "Network"
},
{
"name": "WebBrowser"
}
],
"downloadFlatpakRefUrl": "https://dl.flathub.org/repo/appstream/org.mozilla.firefox.flatpakref",
"currentReleaseVersion": "90.0.2",
"currentReleaseDescription": null,
[...]
"currentReleaseDate": "2021-07-22",
"inStoreSinceDate": null
}
```

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.