Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Conan: Get real provenance data #2037

Closed
fviernau opened this issue Dec 10, 2019 · 3 comments
Closed

Conan: Get real provenance data #2037

fviernau opened this issue Dec 10, 2019 · 3 comments
Labels
analyzer About the analyzer tool

Comments

@fviernau
Copy link
Member

The VCS location of several Conan dependencies point to repositories which contain only recipes used to publish these packages on Conan Central, but not the actual source code of the packages.
As result the actual sources are not being scanned, see e.g. [1,2,3].

[1] https://bintray.com/conan/conan-center
[2] https://bincrafters.readthedocs.io/en/latest/
[3] https://github.com/bincrafters/conan-protobuf
fviernau added a commit that referenced this issue Dec 10, 2019
@fviernau
README.md: Make the Conan integration experimental
bfc8429 
As the VCS locations returned by that package manager often times do not
contain the actual source code for the respective package but just a
receipe to build the conan package, see #2037.

Signed-off-by: Frank Viernau <frank.viernau@here.com>
@fviernau fviernau mentioned this issue Dec 10, 2019
Merged
@sschuberth sschuberth added analyzer About the analyzer tool bug labels Dec 10, 2019
fviernau added a commit that referenced this issue Dec 10, 2019
@fviernau
README.md: Make the Conan integration experimental
42df19f 
As the VCS locations returned by that package manager often times do not
contain the actual source code for the respective package but just a
receipe to build the conan package, see #2037.

Signed-off-by: Frank Viernau <frank.viernau@here.com>
fviernau added a commit that referenced this issue Dec 10, 2019
@fviernau
README.md: Make the Conan integration experimental
13c84be 
As the VCS locations returned by that package manager often times do not
contain the actual source code for the respective package but just a
receipe to build the conan package, see #2037.

Signed-off-by: Frank Viernau <frank.viernau@here.com>
@sschuberth

This comment has been minimized.

Sign in to view
@sschuberth
Copy link
Member

See the Recipe and Sources in a Different Repo docs for details.

@sschuberth
Copy link
Member

Looks like we might be able to get the source artifact from conandata.yml, see e.g. https://github.com/conan-io/conan-center-index/blob/94f7d4a880470c3d6218d0e3f9b6c8ab869e6063/recipes/openssl/3.x.x/conandata.yml

@sschuberth sschuberth mentioned this issue Oct 4, 2021
Merged
mnonnenmacher added a commit that referenced this issue Oct 4, 2021
@mnonnenmacher
Conan: Try to get the VCS info from the homepage
ee7d2c9 
Do not parse the VCS info from the output of "conan info", because this
only ever points to the recipe of the package, but not to the source
code. Usually this points to the ConanCenter index [1].

Instead, try to parse the VCS info from the homepage URL of the package.

This partly addresses #2037.

[1] https://github.com/conan-io/conan-center-index

Signed-off-by: Martin Nonnenmacher <martin.nonnenmacher@bosch.io>
mnonnenmacher added a commit that referenced this issue Oct 4, 2021
@mnonnenmacher
Conan: Parse the source artifact from the local repository
83a9cd3 
Try to parse the source artifact information for packages from the
conandata.yml file in the local repository.

Resolves #2037.

Signed-off-by: Martin Nonnenmacher <martin.nonnenmacher@bosch.io>
@mnonnenmacher mnonnenmacher mentioned this issue Oct 4, 2021
Merged
mnonnenmacher added a commit that referenced this issue Oct 5, 2021
@mnonnenmacher
Conan: Try to get the VCS info from the homepage
a6ee4c8 
Do not parse the VCS info from the output of "conan info", because this
only ever points to the recipe of the package, but not to the source
code. Usually this points to the ConanCenter index [1].

Instead, try to parse the VCS info from the homepage URL of the package.

This partly addresses #2037.

[1] https://github.com/conan-io/conan-center-index

Signed-off-by: Martin Nonnenmacher <martin.nonnenmacher@bosch.io>
mnonnenmacher added a commit that referenced this issue Oct 5, 2021
@mnonnenmacher
Conan: Parse the source artifact from the local repository
63478cd 
Try to parse the source artifact information for packages from the
conandata.yml file in the local repository.

Resolves #2037.

Signed-off-by: Martin Nonnenmacher <martin.nonnenmacher@bosch.io>
mnonnenmacher added a commit that referenced this issue Oct 5, 2021
@mnonnenmacher
Conan: Try to get the VCS info from the homepage
2b511e6 
Do not parse the VCS info from the output of "conan info", because this
only ever points to the recipe of the package, but not to the source
code. Usually this points to the ConanCenter index [1].

Instead, try to parse the VCS info from the homepage URL of the package.

This partly addresses #2037.

[1] https://github.com/conan-io/conan-center-index

Signed-off-by: Martin Nonnenmacher <martin.nonnenmacher@bosch.io>
mnonnenmacher added a commit that referenced this issue Oct 5, 2021
@mnonnenmacher
Conan: Parse the source artifact from the local repository
3e11d71 
Try to parse the source artifact information for packages from the
conandata.yml file in the local repository.

Resolves #2037.

Signed-off-by: Martin Nonnenmacher <martin.nonnenmacher@bosch.io>
mnonnenmacher added a commit that referenced this issue Oct 5, 2021
@mnonnenmacher
Conan: Try to get the VCS info from the homepage
02358a2 
Do not parse the VCS info from the output of "conan info", because this
only ever points to the recipe of the package, but not to the source
code. Usually this points to the ConanCenter index [1].

Instead, try to parse the VCS info from the homepage URL of the package.

This partly addresses #2037.

[1] https://github.com/conan-io/conan-center-index

Signed-off-by: Martin Nonnenmacher <martin.nonnenmacher@bosch.io>
mnonnenmacher added a commit that referenced this issue Oct 5, 2021
@mnonnenmacher
Conan: Parse the source artifact from the local repository
eb77a1c 
Try to parse the source artifact information for packages from the
conandata.yml file in the local repository.

Resolves #2037.

Signed-off-by: Martin Nonnenmacher <martin.nonnenmacher@bosch.io>
mnonnenmacher added a commit that referenced this issue Oct 5, 2021
@mnonnenmacher
Conan: Try to get the VCS info from the homepage
9af7b89 
Do not parse the VCS info from the output of "conan info", because this
only ever points to the recipe of the package, but not to the source
code. Usually this points to the ConanCenter index [1].

Instead, try to parse the VCS info from the homepage URL of the package.

This partly addresses #2037.

[1] https://github.com/conan-io/conan-center-index

Signed-off-by: Martin Nonnenmacher <martin.nonnenmacher@bosch.io>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
analyzer About the analyzer tool
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@sschuberth @fviernau