conda-forge / conda-forge/conda-forge.github.io
Improving the conda-forge software supply chain with jake and OSSIndex
- 主要语言
- JavaScript
- 星标
- 170
- 派生
- 320
- 平均合并
- 2 天 10 小时
- 30 天内合并 PR
- 5
描述
We will (soon :crossed_fingers:) have [`jake`](https://github.com/sonatype-nexus-community/jake) [available from `conda-forge`](https://github.com/conda-forge/jake-feedstock), which, despite its serpentine branding, _appears_ to also know how to cross-correlate packages in `repo.anaconda.com` (only) to non-python "ecosystems" in their parlance, e.g. [postgresql](https://ossindex.sonatype.org/component/pkg:conda/postgresql) by using their free (as in rate-limited beer) [REST API](https://github.com/sonatype-nexus-community/jake/blob/main/jake/ossindex/ossindex.py#L41).
It would be _lovely_ if we could make this a semi-automated part of the conda-forge process for those of us that are stuck in the i-dotting and t-crossing business.
For example, this could initially become part of the CI-checkable "homework" in the `staged-recipes` pipeline, where we might catch some out-of-date upstreams which might encourage the future feedstock owner to get involved with _their_ (future) supply chain.
Some challenges:
- (as above) only knows about `anaconda` (not even `r` and `msys2`)
- it's somewhat unclear _which_ repo/ticketing system would even be the correct avenue for requesting that namespaces be added (these are supported by e.g. [`npm`](https://ossindex.sonatype.org/ecosystem/npm) but not [`conda`](https://ossindex.sonatype.org/ecosystem/conda))
- probably would get rate-limited almost immediately unless we figure out some agreement
- I don't have any relationship with the corporate entity that hosts the service
- the REST API works over `POST`, but _can_ be locally cached by `jake`... so _perhaps_ `staged-recipes`, at least, do some sort of caching, so we're not pounding them with `libstdc`, etc. requests
Alternatives:
- tidelift
- I _do_ know some people there, but haven't dug into it much, where they _also_ appear to have [unresolved issues](https://forum.tidelift.com/t/lifting-python-packages-across-pypi-and-conda/378/6) with multiple namespaces
贡献指南
评估
这个 Issue 还没有评估数据。