Skip to content

Project Ideas DependentCode A Mostly Universal Package Dependency Resolver

Jump to bottom
Philippe Ombredanne edited this page Feb 24, 2022 · 6 revisions

DependentCode: a mostly universal Package dependency resolver

To install code, software package management tools need to determine which dependent package of which version to install. Each ecosystem has evolved their own ways to deal with versioning and resolve the dependencies.

Is a unified dependency resolution strategy attainable across all package ecosystems?

The goal of this project is to create a (mostly) universal package dependency resolution tool that should leverage the detected packages and package dependencies from ScanCode as Package URLs (purls) and Version Range (vers) and provide a good enough way to resolve the dependencies "transitive closure" for many system and application package formats.

This would be a way to advance towards a unified software package dependency resolution strategy.

ScanCode can already parse and collect first-level direct dependencies from package manifests present in a codebase. It can also collect resolved dependencies from lock files.

This project would build on this to provide a mostly universal dependency resolution to get all other package transitive dependencies either:

  • in a generic way, using its own resolution engine and strategies, possibly using a SAT solver or using simple strategies ( such as latest version, pubgrub, minimum version, etc.)
  • or using each package management tool, either reusing the resolvers from ORT or crafting new resolvers wrapping existing package tools.

Goals of project(s) in this space would be to :

http://aboutcode.org/

Clone this wiki locally