conda-forge / conda-forge/conda-forge.github.io

Improving the conda-forge software supply chain with jake and OSSIndex

Đang mở
#1,486 4 bình luận 2 reaction 0 người được giao Xem trên GitHub
Ngôn ngữ chính
JavaScript
Star
170
Fork
320
Merge trung bình
2 ngày 10 giờ
Pull request đã merge (30 ngày)
5

Mô tả

We will (soon :crossed_fingers:) have [`jake`](https://github.com/sonatype-nexus-community/jake) [available from `conda-forge`](https://github.com/conda-forge/jake-feedstock), which, despite its serpentine branding, _appears_ to also know how to cross-correlate packages in `repo.anaconda.com` (only) to non-python "ecosystems" in their parlance, e.g. [postgresql](https://ossindex.sonatype.org/component/pkg:conda/postgresql) by using their free (as in rate-limited beer) [REST API](https://github.com/sonatype-nexus-community/jake/blob/main/jake/ossindex/ossindex.py#L41).

It would be _lovely_ if we could make this a semi-automated part of the conda-forge process for those of us that are stuck in the i-dotting and t-crossing business.

For example, this could initially become part of the CI-checkable "homework" in the `staged-recipes` pipeline, where we might catch some out-of-date upstreams which might encourage the future feedstock owner to get involved with _their_ (future) supply chain.

Some challenges:
- (as above) only knows about `anaconda` (not even `r` and `msys2`)
- it's somewhat unclear _which_ repo/ticketing system would even be the correct avenue for requesting that namespaces be added (these are supported by e.g. [`npm`](https://ossindex.sonatype.org/ecosystem/npm) but not [`conda`](https://ossindex.sonatype.org/ecosystem/conda))
- probably would get rate-limited almost immediately unless we figure out some agreement
- I don't have any relationship with the corporate entity that hosts the service
- the REST API works over `POST`, but _can_ be locally cached by `jake`... so _perhaps_ `staged-recipes`, at least, do some sort of caching, so we're not pounding them with `libstdc`, etc. requests

Alternatives:
- tidelift
- I _do_ know some people there, but haven't dug into it much, where they _also_ appear to have [unresolved issues](https://forum.tidelift.com/t/lifting-python-packages-across-pypi-and-conda/378/6) with multiple namespaces

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.