Skip to content

MeetingMinutes

Ayan Sinha Mahapatra edited this page Jul 31, 2023 · 121 revisions

We meet online on Mondays at 16:00 UTC as a reference. See https://www.timeanddate.com/worldclock/meeting.html to get the time in your timezone.

Join us at https://meet.jit.si/AboutCode

Old meeting notes been moved to:

Here are the running meeting notes:

AboutCode meeting - 2023-07-31 - Online on Jitsi

Participants and Agenda

  • Jay: GSoC updates
  • Ziad: GSoC updates
  • keshav: vers support in purldb
  • Hritik: purl.fyi
  • Omkar: testing in workbench
  • Tushar, Ayan, Jono, Swastik: Nothing to discuss

Discussions:

  • Jay:

some tests failing on sanexml, will push a PR for the same, need some help there. Also added PR in SCTK for fallback libraries integration: https://github.com/nexB/scancode-toolkit/pull/3476

  • Ziad:

Do we have regex for identifying purl? We can probably use the same thing in vulnerablecode where we lookup by purl and check for valid purl, we can do the same thing here too. Just importing with the PackageURL library should also work.

  • Keshav:

Support for univers in purldb package index: In cases where dependencies are not pinned, we only submit lowest package version here, and maybe we should send packageURL + vers to be indexed? https://github.com/nexB/univers/blob/main/src/univers/version_range.py Maybe we can start a basic implementation there, maybe list of tuples/mappings.

  • Hritik:

For https://purl.fyi/ it would be nice to consolidate all code we have scattered in different places, this could be a new option in purl_to_url, but there would be new dependencies, so we could also do this in purldb where we have existing code for source_urls etc. We had a GSoC project idea also on this: https://github.com/nexB/aboutcode/wiki/GSOC-2023#purldb-on-demand-retrieval-of-package-metadataarchives

  • Omkar:

Discussion on test files for workbench. We also need to support SCIO outputs once it has licenses support. It would be just adding more tests. Also UI review on deps dashboard and package/deps explorer, looks great, just one point about splitting the package-type and number of packages column into two.

AboutCode meeting - 2023-07-24 - Online on Jitsi

Participants and Agenda

  • Jay: update on GSoC
  • Jono: updating skeleton merge skeleton
  • Ziad: detecting PURL, NLP
  • Tushar, Keshav, Ayan, Omkar: no topic
  • Philippe: github using clearlydefined data (i.e. scancode)
  • Hritik: Vulntotal updates

Discussions:

AboutCode meeting - 2023-07-17 - Online on Jitsi

Participants and Agenda

  • Jay: update on your project
  • Jono: feedback on how display history on packages in purlDB
  • Ziad: safe HTML in Django
  • Tushar, Keshav: no topic
  • Ayan: absent, excused
  • Philippe: Skeleton
  • Omkar: queries on testing and depenencies

Discussions

  • Jay: update on project - Some issues in sanexml wrt. lxml to fix - Next up will be integration in ScanCode and run the tests, making then pass
  • Jono: feedback on how display history on packages in purlDB - History is simple text field. Each line is a timestamp and message - Should we return the history all times with a purl or have a different a different end-point? - A different a different end-point makes most sense
  • Ziad: safe HTML in Django - Need review of how to get the content of a file in git - Need to discuss purl-sync vocabulary - We discussed the data for following PackageURL
  • Philippe: Skeleton - The https://github.com/nexB/skeleton needs to be updated to remove Ubuntu 18 - We need a script to automate the base skeleton in many repos. Jono will give it a shot
  • Omkar: queries on testing and displaying dependencies - We discussed the display of the dependencies summary and provided feedback - We need an issue in SCTK so that it returns a name and icon for each package type or data_source - We discussed testing including tests that are data-driven

AboutCode meeting - 2023-02-06 - Online on Jitsi

Participants:

  • Tushar @tg1999
  • Keshav @keshavspace
  • Ayan @AyanSinhaMahapatra
  • swastik sharma @swastkk
  • Jay @35C4n0r
  • Akhil @lf32
  • Omkar @OmkarPh

Agenda:

  • GSoC
  • Misc

Discussion:

  • purldb still has to be updated with latest scancode and in a stable state for us to start adding good first issues there, so maybe this is better to do a month later. Meanwhile we can mark good first issues in other repositories, in vulnerablecode, scancode-toolkit, scancode.io etc for first time contributors.
  • Conclusions pipeline: Conclusions/alerts/review/to-do items in scancode.io is a workflow where we can review detections which are incorrect or needs careful manual review and where the data can be updated in place. This was asked as a tentative GSoC project but we are still finalizing the project ideas and it is advised to start looking at the project ideas list after aboutcode is selected at GSoC.
  • https://github.com/nexB/python-inspector/pull/119 was opened by swastik which was failing tests, as live packages are used for python-inspector tests and we need to regen these, we will also add this to the documentation.
  • Akhil has updated https://github.com/nexB/scancode.io/pull/450 with binary file support and replaced the Scan Text button with a Utilities drop down with the Detect License option which goes to /scantext/.
  • Phillipe needs to review https://github.com/nexB/scancode-workbench/pull/532, and please use scancode v31 with this as v32 is not supported yet here, see https://scancode-toolkit.readthedocs.io/en/latest/explanations/license-detection-reference.html for more updates there.

AboutCode meeting - 2023-01-23 - Online on Jitsi

Participants:

  • Tushar @tg1999
  • phillipe @pombredanne
  • Keshav @keshavspace
  • Ayan @AyanSinhaMahapatra
  • swastik sharma @swastkk
  • Jay @35C4n0r
  • Shrey Parekh
  • Shrijal Acharya

Agenda:

  • GSoC
  • corrupted advisories
  • yaml output
  • scancode toolkit reference scans
  • packaging and operating system support
  • cylconedx input in scancode.io

Discussion:

  • Need to review swastik's PR: https://github.com/nexB/python-inspector/pull/119
  • should we use both cyclonedx libraries from the cyclonedx-python and the hoppr library? - Keshav links: https://gitlab.com/hoppr/hoppr-cyclonedx-models/ and https://github.com/CycloneDX/cyclonedx-python short term: working with these projects to merge features We don't use XML and don't care about old versions. The hoppr library does for the last 2 cyclonedx versions, and it uses the JSON schema to create the models. We can start using hoppr/hoppr-cyclonedx-models in scancode.io and then maybe later we can use it in scancode-toolkit too.
  • JSON to XML conversion for cyclonedx -> library exists which works as a single executable in linux/windows/mac.
  • advisories which were imported by previous importers, which aren't compatible to current models. We can delete everything from a importer, when we are reimporting from the same. There's a problem of stale and outdated data, and there's a problem of not discarding data that is used elsewhere also. We can consider archiving for this, or consider adding a deprecated flag.
  • more people running non-intel architechture, which doesn't work The key thing would be a single executable: like Jono's work on a scancode.io appimage. We should also have app archives for all python versions which is python 3.7-3.11 and in linux/mac/windows. No arm for now, but would be nice. Another thing would be https://github.com/nexB/scancode-toolkit/issues/3205 If we are using other libraries, we have to write wrappers on them to match the same API. Serializing is another problem. Pyahocorasick is going to be the hardest, as this is a trie structure and saving/loading from disk is not simple.
  • https://github.com/nexB/aboutcode/wiki/GSOC-2023 GSoC project ideas were discussed, and we need to further edit this and make all the projects have a clear goal and some detailed instructions to explain them better, Ideas related to vulnerablecode will be discussed in the vulnerabelcode call tomorrow see https://github.com/nexB/vulnerablecode/wiki/WeeklyMeetings.
  • We uncovered that the scancode yaml output does not produce valid yaml in certain cases where there are license references and/or matched text in the yaml output and the license text has whitespaces/blank lines. for example, happens in the case of apache-2.0 license text. The solution can't be just to remove whitespaces as they are important, but the check has to be done at saneyaml and we have to produce valid yaml there.
  • scancode-toolkit-reference-scan scripts are not working because of the dependency issues present while pip installing older versions, and maybe we should be using git checkout instead of pip install here.

AboutCode meeting - 2023-01-16 - Online on Jitsi

Participants:

  • Tushar @tg1999
  • Jay @35C4n0r
  • phillipe @pombredanne
  • swastik sharma @swastkk
  • Keshav @keshavspace
  • Ayan @AyanSinhaMahapatra
  • Jono @jyang
  • Akhil @lf32
  • Heet Dhorajiya

Agenda:

  • scancode.io appimage
  • dependency issues
  • scancode-toolkit release
  • GSoC project ideas
  • skeleton

Discussion:

AboutCode meeting - 2023-01-02 - Online on Jitsi

Participants:

  • Tushar @tg1999
  • Hritik @Hritik14
  • Jay @35C4n0r
  • phillipe @pombredanne
  • swastik sharma @swastkk
  • Keshav @keshavspace

Agenda:

Clone this wiki locally