conda-forge / conda-forge/conda-forge.github.io

Improving the conda-forge software supply chain with jake and OSSIndex

Abierto
#1,486 4 comentarios 2 reacciones 0 asignados Ver en GitHub
Lenguaje dominante
JavaScript
Estrellas
170
Forks
320
Merge medio
2 d 10 h
PR fusionados (30 d)
5

Descripción

We will (soon :crossed_fingers:) have [`jake`](https://github.com/sonatype-nexus-community/jake) [available from `conda-forge`](https://github.com/conda-forge/jake-feedstock), which, despite its serpentine branding, _appears_ to also know how to cross-correlate packages in `repo.anaconda.com` (only) to non-python "ecosystems" in their parlance, e.g. [postgresql](https://ossindex.sonatype.org/component/pkg:conda/postgresql) by using their free (as in rate-limited beer) [REST API](https://github.com/sonatype-nexus-community/jake/blob/main/jake/ossindex/ossindex.py#L41).

It would be _lovely_ if we could make this a semi-automated part of the conda-forge process for those of us that are stuck in the i-dotting and t-crossing business.

For example, this could initially become part of the CI-checkable "homework" in the `staged-recipes` pipeline, where we might catch some out-of-date upstreams which might encourage the future feedstock owner to get involved with _their_ (future) supply chain.

Some challenges:
- (as above) only knows about `anaconda` (not even `r` and `msys2`)
- it's somewhat unclear _which_ repo/ticketing system would even be the correct avenue for requesting that namespaces be added (these are supported by e.g. [`npm`](https://ossindex.sonatype.org/ecosystem/npm) but not [`conda`](https://ossindex.sonatype.org/ecosystem/conda))
- probably would get rate-limited almost immediately unless we figure out some agreement
- I don't have any relationship with the corporate entity that hosts the service
- the REST API works over `POST`, but _can_ be locally cached by `jake`... so _perhaps_ `staged-recipes`, at least, do some sort of caching, so we're not pounding them with `libstdc`, etc. requests

Alternatives:
- tidelift
- I _do_ know some people there, but haven't dug into it much, where they _also_ appear to have [unresolved issues](https://forum.tidelift.com/t/lifting-python-packages-across-pypi-and-conda/378/6) with multiple namespaces

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.