Comment by hungryhobbit
4 days ago
Dependencies: PyPI, Maven, Go, Ruby
This looks like a cool project, but why on earth would it need Python, Java, Go, AND Ruby?
4 days ago
Dependencies: PyPI, Maven, Go, Ruby
This looks like a cool project, but why on earth would it need Python, Java, Go, AND Ruby?
It doesn't need them, it parses SBOMs and manifests from their ecosystems. I think you misunderstood this section of the README.
> Dependencies | SBOM / manifest parsing across npm, PyPI, Maven, Go, Ruby; flags unpinned, shadow, or non-registry deps.
The project seems like it only requires Python >= 3.9!
I think these are just the package managers that it supports parsing dependencies for. The actual script seems to just be a single python file.
It does seem like the repo is missing some files though; make is mentioned in the README but no makefile and no list of python dependencies for the script that I can see.
Yeah to be fair I need to clean it up, was stuck in the testing diff strategies and making it work and just wanted to get feedback asap before moving on to the next step (didn't want to spend too much time on something and turns out I was wrong about something badly) - next step is to get it all cleaned up.