Skip to content

Report Packages at the codebase-level #2098

@JonoYang

Description

@JonoYang

We should make the package consolidation logic from the consolidation plugin a default function of the Package scanning option. The consolidation plugin would then be focused on files that are not part of a package so we can perform logical groupings on them.

Some changes that would have to change on the Package model/Package scanning process:

  • Remove root_path from Package. There is no universal root path for all Packages.
  • Tag a resource if it is part of one or more Package during a Package scan. This would be similar to the consolidated_to field, where it would be a list of purls. Possible name for this field is for_packages.
  • Return detected Packages in a new top level codebase attribute. This would be a set of all detected packages from a codebase.
  • Add primary license expression/copyright/holders to Package models, which is populated from top-level key package files (manifests, etc.)
  • Add secondary license expression/copyrights/holders to Package. This is populated from the detected license expressions/copyrights of Package resources, excluding top-level key files.

Here is an updated design:

The key elements are to:

  • report packages as top-level. The data structure is the same as the one at the file level but will be the merged data from possibly several manifests and lock files.
  • track which files are part of a given package instance

Package model updates

Files model updates

This could look this way:

packages (aka. package instances)
  package
    package_manifest_paths
    ... data...

files:
   package_manifests: [...] (formerly named packages)
   for_packages: [ list of 
     { package_url: pkg:foo/bar@12, package_instance: UUID}
   ]

For later:

  • sub-packages/embedded could be 1) listed directly as packages of their own 2) related to their parent (or the parent related to them)
  • we could also track the file_paths under each top level package instance
  • get all packages to have actual files
  • migrate system packages (Alpine, RPM, Debian, Windows) to new model

Metadata

Metadata

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions