aboutcode-org / aboutcode-org/scancode-toolkit

Properly detect Alpine virtual packages

Open
#2,774 1 comment 0 reactions 0 assignees View on GitHub
bug package scan
Dominant language
Python
Stars
2.6k
Forks
791
Avg merge
1d 12h
Merged PRs (30d)
5

Description

### Description

Alpine linux installed packages may be "virtual" such as with this snippet of installed DB
```
P:.postgis-rundeps
V:20210104.190748
A:noarch
S:0
I:0
T:virtual meta package
U:
L:
D:json-c geos gdal proj protobuf-c libstdc++
```

This was created from this https://github.com/postgis/docker-postgis/blob/e5e0e9b3b38acb6e4f1f16ed0c697c9f6cb2cf1e/Dockerfile.alpine.template#L61

`.postgis-rundeps` was created at install time and does not exist as a "real" package. This is instead just a collection of dependencies, therefore it cannot have much of an origin or license. This is a "virtual meta package". It can be identified because of its installed "description" with this value "T:virtual meta package"

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.