Re: Lintian as a static analysis framework

[Niels Thykier <niels@thykier.net>]

On 2011-07-09 14:36, Stefano Zacchiroli wrote:
> On Fri, Jul 08, 2011 at 10:36:07AM +0200, Niels Thykier wrote:
>> So basically incrementally pulling packages from a mirror via Sources
>> file? I cannot help but think we must do something like that on
>> lintian.d.o (especially considering we usually do incremental runs).
> 
> Yes, although I'd like to think of it as a "syncing" operation, rather
> than a simple pull. That is because you need to handle all the usual
> "directions" and details of (one-way) syncing, namely:
> 
> - pull in new stuff from your "upstream"
> - delete local stuff which has gone from upstream
> - be able to do both incremental runs and full runs
> 

Certainly :)

>>> Then I need an easy way to access all (unpacked) source packages I have,
>>> query their package metadata, find their root directory and run my
>>> analysis tool of choice on the source package.
>>
>> Bulk access or a "given package name (possibly + version and arch) give
>> me the rest of the metadata and the root dir of the unpacked package"?
> 

I think I was unclear here; my intention for the question was more down
the lines of how will you access the data (e.g. the root dir)?  Do you
plan on doing all the processing when sync'ing or will you also need to
do queries in-between syncs?
  As I recall, we (mostly?) use the former pattern on lintian.d.o, so if
you need the other type of queries we may need to make a few changes to
our code to accommodate your needs. :)

> An annoyance to overcome is the differences existing among: 1) source
> name and version (with epoch), 2) .dsc name (without epoch), 3) root dir
> of the unpacked source (which is not granted to have a specific name).
> It's all trivial to deal with, of course, but it's something that anyone
> having to implement something like this will have to deal with, and
> hence a good target for factorization.
> 
> For my use cases, I'm not really using any more package metadata than
> the above (in particular, I'm not using any information about binary
> packages and therefore I don't need any architecture related information
> either). But I can easily imagine others needing more metadata than me.
> 
> On the other hand, once the root dir of the unpacked source package is
> known, it's easy to parse debian/control there.
> 
> [...]

I take it you want a debian/control parser to go with that? :P

~Niels