aboutcode-org / aboutcode-org/scancode-toolkit

Add support for container-based style packages (appimage, snap, flatpacks and similar)

Đang mở
#2,602 0 bình luận 0 reaction 0 người được giao Xem trên GitHub
package scan package-formats
Ngôn ngữ chính
Python
Star
2.6k
Fork
791
Merge trung bình
1 ngày 12 giờ
Pull request đã merge (30 ngày)
5

Mô tả

These are packages that are container-image like.
See
- https://en.wikipedia.org/wiki/Snap_(package_manager) and https://github.com/snapcore . Using `snap download ` fetches an `.assert` deb822-like file with keys and checksums and a `.snap` file which is squashfs image (that extractcode can extract). Inside there is little package details and license data and files available, beyond some Debian copyright (e.g. this is a likely messy thing to analyze)

- https://en.wikipedia.org/wiki/AppImage and https://github.com/AppImage . The distribution format is an Elf self-executable that contains its payload

- https://en.wikipedia.org/wiki/Flatpak and https://github.com/flatpak . The actual on-disk format and the ability to directly download one needs research. This seems to be some kind of OCI/docker container image. See https://docs.flatpak.org/en/latest/usb-drives.html?highlight=offline and https://unix.stackexchange.com/questions/404905/offline-install-of-a-flatpak-application
See also https://opencontainers.org/posts/blog/2018-11-07-bringing-oci-images-to-the-desktop-with-flatpak/#flatpaks-as-oci-images

Since all these are essentially similar to containers, the comprehensive scan may be a job for scancode.io

For snaps for instance, we have this:
```
$ curl -s -H "Snap-Device-Series: 14" https://api.snapcraft.io/v2/snaps/info/chromium | jq .
{
"channel-map": [],
"default-track": null,
"name": "chromium",
"snap": {
"license": "Apache-2.0 AND BSD-3-Clause AND LGPL-2.0 AND LGPL-2.1 AND MIT AND MS-PL AND (GPL-2.0+ OR LGPL-2.1+ OR MPL-1.1)",
"name": "chromium",
"prices": {},
"publisher": {
"display-name": "Canonical",
"id": "canonical",
"username": "canonical",
"validation": "verified"
},
"snap-id": "XKEcBqPM06H1Z7zGOdG5fbICuf8NWK5R",
"store-url": "https://snapcraft.io/chromium",
"summary": "Chromium web browser, open-source version of Chrome",
"title": "Chromium"
},
"snap-id": "XKEcBqPM06H1Z7zGOdG5fbICuf8NWK5R"
}
```

For flathub for flatpacks, we have this:
```
$ curl -s https://flathub.org/api/v1/apps/org.mozilla.firefox | jq .
{
"flatpakAppId": "org.mozilla.firefox",
"name": "Firefox",
"summary": "Mozilla Firefox Web Browser",
"description": "

The Firefox standalone app for Linux is here.................",
"developerName": null,
"projectLicense": "MPL-2.0",
"homepageUrl": "https://www.mozilla.org/firefox/",
"donationUrl": "https://donate.mozilla.org/",
"translateUrl": "https://wiki.mozilla.org/L10n:Starting_a_localization",
"bugtrackerUrl": "https://bugzilla.mozilla.org/",
"helpUrl": "https://support.mozilla.org/",
"categories": [
{
"name": "Network"
},
{
"name": "WebBrowser"
}
],
"downloadFlatpakRefUrl": "https://dl.flathub.org/repo/appstream/org.mozilla.firefox.flatpakref",
"currentReleaseVersion": "90.0.2",
"currentReleaseDescription": null,
[...]
"currentReleaseDate": "2021-07-22",
"inStoreSinceDate": null
}
```

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.