anchore / anchore/syft

improve capture regex in setup.py cataloger

Open
#151 0 comments 0 reactions 0 assignees View on GitHub
ecosystem:python
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
1d 5h
Merged PRs (30d)
42

Description

As pointed out in PR https://github.com/anchore/syft/pull/150

In the Python `setup.py` cataloger, there is an opportunity to be more lenient with spaces and capture more environment marker cases with `['"]\s*([\w]+\s*==\s*[\w\.]*)\s*[;'"]` which would find `ipaddress==1.0` in:
```
setup(
...
install_requires=[
'six',
'humanize',
],
extras_require={
':python_version == "2.7"': [
'ipaddress==1.0',
],
},
)
```

Contributor guide

Open the contributing guide

Research direction

Start with the Python setup.py cataloger and review PR #150 for the existing capture behavior. Check the regex against the setup.py example in this issue, including spaces and the python_version marker; done means the dependency ipaddress==1.0 is captured without regressing ordinary requirements.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
tooling
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.