aboutcode-org / aboutcode-org/scancode-toolkit

Add support for container-based style packages (appimage, snap, flatpacks and similar)

オープン
#2,602 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る
package scan package-formats
主要言語
Python
スター
2.6k
フォーク
791
平均マージ
1日 12時間
マージ済み PR(30日)
5

説明

These are packages that are container-image like.
See
- https://en.wikipedia.org/wiki/Snap_(package_manager) and https://github.com/snapcore . Using `snap download ` fetches an `.assert` deb822-like file with keys and checksums and a `.snap` file which is squashfs image (that extractcode can extract). Inside there is little package details and license data and files available, beyond some Debian copyright (e.g. this is a likely messy thing to analyze)

- https://en.wikipedia.org/wiki/AppImage and https://github.com/AppImage . The distribution format is an Elf self-executable that contains its payload

- https://en.wikipedia.org/wiki/Flatpak and https://github.com/flatpak . The actual on-disk format and the ability to directly download one needs research. This seems to be some kind of OCI/docker container image. See https://docs.flatpak.org/en/latest/usb-drives.html?highlight=offline and https://unix.stackexchange.com/questions/404905/offline-install-of-a-flatpak-application
See also https://opencontainers.org/posts/blog/2018-11-07-bringing-oci-images-to-the-desktop-with-flatpak/#flatpaks-as-oci-images

Since all these are essentially similar to containers, the comprehensive scan may be a job for scancode.io

For snaps for instance, we have this:
```
$ curl -s -H "Snap-Device-Series: 14" https://api.snapcraft.io/v2/snaps/info/chromium | jq .
{
"channel-map": [],
"default-track": null,
"name": "chromium",
"snap": {
"license": "Apache-2.0 AND BSD-3-Clause AND LGPL-2.0 AND LGPL-2.1 AND MIT AND MS-PL AND (GPL-2.0+ OR LGPL-2.1+ OR MPL-1.1)",
"name": "chromium",
"prices": {},
"publisher": {
"display-name": "Canonical",
"id": "canonical",
"username": "canonical",
"validation": "verified"
},
"snap-id": "XKEcBqPM06H1Z7zGOdG5fbICuf8NWK5R",
"store-url": "https://snapcraft.io/chromium",
"summary": "Chromium web browser, open-source version of Chrome",
"title": "Chromium"
},
"snap-id": "XKEcBqPM06H1Z7zGOdG5fbICuf8NWK5R"
}
```

For flathub for flatpacks, we have this:
```
$ curl -s https://flathub.org/api/v1/apps/org.mozilla.firefox | jq .
{
"flatpakAppId": "org.mozilla.firefox",
"name": "Firefox",
"summary": "Mozilla Firefox Web Browser",
"description": "

The Firefox standalone app for Linux is here.................",
"developerName": null,
"projectLicense": "MPL-2.0",
"homepageUrl": "https://www.mozilla.org/firefox/",
"donationUrl": "https://donate.mozilla.org/",
"translateUrl": "https://wiki.mozilla.org/L10n:Starting_a_localization",
"bugtrackerUrl": "https://bugzilla.mozilla.org/",
"helpUrl": "https://support.mozilla.org/",
"categories": [
{
"name": "Network"
},
{
"name": "WebBrowser"
}
],
"downloadFlatpakRefUrl": "https://dl.flathub.org/repo/appstream/org.mozilla.firefox.flatpakref",
"currentReleaseVersion": "90.0.2",
"currentReleaseDescription": null,
[...]
"currentReleaseDate": "2021-07-22",
"inStoreSinceDate": null
}
```

コントリビューションガイド

コントリビューションガイドを開く

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。