Comments (4)
#1273 has been dismissed, is this even still useful without it?
from cli.
#1273 has been dismissed, is this even still useful without it?
I still think so. Here is another example that shows how the results of parsing the same input package results in different names, where the only difference is whether it gets parsed as a lockfile or manifest.
❯ phylum --version
phylum v5.8.1
❯ cat requirements.txt
RuAmEl...YAML---CLib==0.2.8
❯ phylum parse --lockfile-type pip requirements.txt
[
{
"name": "RuAmEl...YAML---CLib",
"version": "0.2.8",
"type": "pypi",
"lockfile": "requirements.txt"
}
]
❯ vim requirements.txt
❯ cat requirements.txt
RuAmEl...YAML---CLib
❯ phylum parse --lockfile-type pip requirements.txt
Generating lockfile for manifest "requirements.txt" using Pip…
[
{
"name": "ruamel.yaml.clib",
"version": "0.2.8",
"type": "pypi",
"lockfile": "requirements.txt"
}
]
The expectation is that name of the parsed package is normalized and will be the same in both cases...ruamel-yaml-clib
in this case.
from cli.
My concern here is that "normalization" is not the correct behavior. As can be seen from your example:
❯ phylum parse --lockfile-type pip requirements.txt
Generating lockfile for manifest "requirements.txt" using Pip…
[
{
"name": "PyYAML",
"version": "6.0.1",
"type": "pypi",
"lockfile": "requirements.txt"
},
{
"name": "Pillow",
"version": "10.1.0",
"type": "pypi",
"lockfile": "requirements.txt"
}
]
These package names are provided by pip
because lockfile generation happened, but they are not "normalized". Instead, they are the canonical names for these packages... The normalization rules that you provide are only used for deduplication.
The canonical name for a package can only be known by looking up that package in the registry. Which leaves us with two options:
- Output the normalized name instead of the canonical name
- Make network requests to the registry to find the canonical name
Option 2 is clearly outside the scope of a lockfile parser and Option 1 leads to results that are technically incorrect...
And just like #1273, this issue really only exists when using requirements.txt
files as lockfiles... Because any lockfile generator should convert package names to the canonical name.
So unless there is an option that I am missing, I don't think there is any reasonable action that we can take to resolve this issue.
from cli.
Okay...points taken. This issue will be closed.
from cli.
Related Issues (20)
- Workspace entries in `pnpm` lockfiles fail to parse
- Display project id after creation
- Rename uses of "lockfile" term
- Parse results not deduplicated HOT 1
- Parsing BOM files with unsupported ecosystems
- Incorrect parsing for renamed npm packages
- Lockfile generation in sandbox broken for `cargo` on macOS
- Return unique error code for disabled lockfile generation
- Lockfile generation fails in Docker containers HOT 2
- Lockifest manifests generate errors when `--no-generation` set HOT 4
- Enable sandboxed lockfile generation in extensions HOT 1
- Yarn v1 renamed dependencies not handled correctly HOT 1
- Allow `project status` command to work without `.phylum_project` file
- Include `alias` information in the output of `phylum parse`
- `phylum package` should return CVE data.
- Lockfile information missing `phylum parse`
- Avoid unrelated output in `parse-sandboxed`
- Logging from `parse-sandboxed` should be forwarded
- Extension API: Submit by PURL
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from cli.