conda-forge / conda-forge/conda-forge.github.io

Improving the conda-forge software supply chain with jake and OSSIndex

未关闭
#1,486 4 条评论 2 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
JavaScript
星标
170
派生
320
平均合并
2 天 10 小时
30 天内合并 PR
5

描述

We will (soon :crossed_fingers:) have [`jake`](https://github.com/sonatype-nexus-community/jake) [available from `conda-forge`](https://github.com/conda-forge/jake-feedstock), which, despite its serpentine branding, _appears_ to also know how to cross-correlate packages in `repo.anaconda.com` (only) to non-python "ecosystems" in their parlance, e.g. [postgresql](https://ossindex.sonatype.org/component/pkg:conda/postgresql) by using their free (as in rate-limited beer) [REST API](https://github.com/sonatype-nexus-community/jake/blob/main/jake/ossindex/ossindex.py#L41).

It would be _lovely_ if we could make this a semi-automated part of the conda-forge process for those of us that are stuck in the i-dotting and t-crossing business.

For example, this could initially become part of the CI-checkable "homework" in the `staged-recipes` pipeline, where we might catch some out-of-date upstreams which might encourage the future feedstock owner to get involved with _their_ (future) supply chain.

Some challenges:
- (as above) only knows about `anaconda` (not even `r` and `msys2`)
- it's somewhat unclear _which_ repo/ticketing system would even be the correct avenue for requesting that namespaces be added (these are supported by e.g. [`npm`](https://ossindex.sonatype.org/ecosystem/npm) but not [`conda`](https://ossindex.sonatype.org/ecosystem/conda))
- probably would get rate-limited almost immediately unless we figure out some agreement
- I don't have any relationship with the corporate entity that hosts the service
- the REST API works over `POST`, but _can_ be locally cached by `jake`... so _perhaps_ `staged-recipes`, at least, do some sort of caching, so we're not pounding them with `libstdc`, etc. requests

Alternatives:
- tidelift
- I _do_ know some people there, but haven't dug into it much, where they _also_ appear to have [unresolved issues](https://forum.tidelift.com/t/lifting-python-packages-across-pypi-and-conda/378/6) with multiple namespaces

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。