microsoft / microsoft/component-detection

Python: Component-governance extraction from setup.py does not include setup.cfg/pyproject.toml if executed from different dir.

Open
#244 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

detector:pip status:requirements type:feature
Dominant language
C#
Stars
553
Forks
135
Avg merge
20h 58m
Merged PRs (30d)
6

Description

The python code used to extract dependencies from setup.py would normally respect dependencies declared in more modern ways using setup.cfg/pyproject.toml but only if executed from the same directory.

E.g. changing the bundled code:

```
import distutils.core; setup=distutils.core.run_setup('{filePath.Replace('\\', '/')}'); print(setup.install_requires)
```

to something like (pseudocode)

```
import os; os.chdir(pathtofolderwithsetuppy); import distutils.core; setup=distutils.core.run_setup('{filePath.Replace('\\', '/')}'); print(setup.install_requires)
```
would also ensure that dependencies declared in setup.cfg/pyproject.toml (pep 621) would be included.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Locate the bundled Python dependency-extraction code that calls distutils.core.run_setup on setup.py. Reproduce it with setup.cfg or pyproject.toml dependencies while running from a different directory, then verify that the extracted dependencies match those found when run beside setup.py.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
devtools
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.