6 ms·

Appears to be only for Ruby gems and Node.js packages. It's a start, though I was hoping to be able to indicate C++ library dependencies. The lack of Python re

• pknopf 9y ago
  How would you effectively do this in a way that is cross-build-platform friendly? CMAKE? autoconf? submodules? I don't see that happening.
  • adekok 9y ago
    Text files? If people get value from it, editing a simple text file once or twice a year wouldn't be difficult.
    • pknopf 9y ago
      I see. A text file that just declares that "this project uses lib 2.1". It isn't a part of the build system in any way. That would be awesome.
    • scott_karana 9y ago
      Adding a second source of truth sounds like a bad idea to me. Now you have to update it in lockstep? No thanks.
      • icebraining 9y ago
        You could make the build tool generate this standard file.
        • scott_karana 9y ago
          It's still a many to many problem in both cases. Option 1: Adding feature to npm/composer/gem/pip ad infinitum Option 2: add per-language parser support to the alerting tool instead. Option 2 doesn't necessitate a new (information-duplicating, still potentially error prone) standard, and can likely leverage available, tested libraries ;-)
          • matt_kantor 9y ago
            On the other hand, option #1 requires neither effort nor consent from GitHub to onboard new languages/dependency managers.
      • adekok 9y ago
        A few things things: * any non Javascript / ruby / go languages don't have standard packages, package names, etc. * any non Javascript / ruby / go languages may be using one of many build systems. It's just too hard to troll through random build systems to see what dependencies are used * therefore, a simple text file is what will work, and is what will be trivial for everyone to use * if you find it too hard to update one line in a text file when you add (for example) a new dependency on libldap... you shouldn't be programming
        • _Codemonkeyism 9y ago
          " any non Javascript / ruby / go" Would have thought Maven popularized standard package names and build dependency (POM) files.
          • oblio 9y ago
            Even more than that, Maven came up with the groupId concept, which I think is under-utilized by many other package managers... The leftpad fiasco could have been mitigated with it, for example.
          • adekok 9y ago
            How many C / C++ projects use Maven?
• dflock 9y ago
  > with Python support coming in 2018.
• Dunedan 9y ago
  In the meanwhile you can use a combination of pre-commit (http://pre-commit.com/ http://pre-commit.com/) and safety-db (https://github.com/pyupio/safety-db https://github.com/pyupio/safety-db) in form of https://github.com/Lucas-C/pre-commit-hooks-safety https://github.com/Lucas-C/pre-commit-hooks-safety That allows you to run a check for vulnerable packages before each commit and via CI.
  • nerdwaller 9y ago
    Also for python `pipenv check`[0] to do security checks (obviously for known vulnerabilities) if you use pipenv[1] to manage dependencies. [0] https://docs.pipenv.org/advanced.html#detection-of-security-vulnerabilities https://docs.pipenv.org/advanced.html#detection-of-security-... [1] https://github.com/kennethreitz/pipenv https://github.com/kennethreitz/pipenv
• pavel_lishin 9y ago
  Support for POM files would be nice, too.
  • RhodesianHunter 9y ago
    Especially since adding pom and/or gradle files would knock out support for a half-dozen languages.
  • gonzoyumo 9y ago
    https://gemnasium.com https://gemnasium.com just launched maven support, you can give it a try!
• sciurus 9y ago
  Yeah, but for proper python support you need to handle setup.py too, which being python code is more complex. https://python-packaging.readthedocs.io/en/latest/dependencies.html https://python-packaging.readthedocs.io/en/latest/dependenci...
  • scrollaway 9y ago
    And setup.cfg! Example: https://github.com/HearthSim/python-hslog/blob/master/setup.cfg https://github.com/HearthSim/python-hslog/blob/master/setup....
    • nikcub 9y ago
      and Pipfile - which is what i've switched to in recent projects, example[0] Altho you can write to one of the other formats or read from it - you'd have to tell the scanner what the true build source is [0] https://github.com/kennethreitz/pipenv/blob/master/Pipfile https://github.com/kennethreitz/pipenv/blob/master/Pipfile
      • nerdwaller 9y ago
        I mentioned this elsewhere here, but check out `pipenv check`[0] and just run it in CI or as a precommit hook. [0] https://docs.pipenv.org/advanced.html#detection-of-security-vulnerabilities https://docs.pipenv.org/advanced.html#detection-of-security-...
  • jdc0589 9y ago
    I imagine they are just going to pick one.
• username223 9y ago
  Another cost of every language wanting at least one of its own dependency managers, often tightly integrated with the build system. The least-bad solution at this point would be to spin up a clean image, install the package in question, and figure out what else was also installed.
• Rotareti 9y ago
  > The lack of Python requirements.txt support is a bit odd I hope they go with Pipfile/Pipfile.lock [0] and pipenv [1] rigth away! [0] https://github.com/pypa/pipfile https://github.com/pypa/pipfile [1] https://github.com/kennethreitz/pipenv https://github.com/kennethreitz/pipenv
• rasjani 9y ago
  Point probably for lacking support for other than npm&gem packages is that for those langs/formats, there is a good sources for getting that sort of data externally.
• hobarrera 9y ago
  Actually, Pipfiles are more akin to the two supported mechanisms, requirements.txt is not always used with version pinning