-
-
Notifications
You must be signed in to change notification settings - Fork 627
Closed
Description
We should make the package consolidation logic from the consolidation plugin a default function of the Package scanning option. The consolidation plugin would then be focused on files that are not part of a package so we can perform logical groupings on them.
Some changes that would have to change on the Package model/Package scanning process:
- Remove root_path from Package. There is no universal root path for all Packages.
- Tag a resource if it is part of one or more Package during a Package scan. This would be similar to the
consolidated_tofield, where it would be a list of purls. Possible name for this field isfor_packages. - Return detected Packages in a new top level codebase attribute. This would be a set of all detected packages from a codebase.
- Add primary license expression/copyright/holders to Package models, which is populated from top-level key package files (manifests, etc.)
- Add secondary license expression/copyrights/holders to Package. This is populated from the detected license expressions/copyrights of Package resources, excluding top-level key files.
Here is an updated design:
The key elements are to:
- report
packagesas top-level. The data structure is the same as the one at the file level but will be the merged data from possibly several manifests and lock files. - track which files are part of a given package instance
Package model updates
- Package model updates: Add new
package_instance#2691 - Package model updates: Add
package_manifest_pathsattribute #2692 - Package model updates: Add new
PackageManifestclass #2747
Files model updates
- Files model updates: add
for_packagesattribute #2693 - Files model updates: Rename the current file-level
packagestopackage_manifests. #2694
This could look this way:
packages (aka. package instances)
package
package_manifest_paths
... data...
files:
package_manifests: [...] (formerly named packages)
for_packages: [ list of
{ package_url: pkg:foo/bar@12, package_instance: UUID}
]
For later:
- sub-packages/embedded could be 1) listed directly as
packagesof their own 2) related to their parent (or the parent related to them) - we could also track the
file_pathsunder each top level package instance - get all packages to have actual files
- migrate system packages (Alpine, RPM, Debian, Windows) to new model