-
Notifications
You must be signed in to change notification settings - Fork 241
Open
Description
Currently, we have several requirements.txt files:
- src/install/requirements_pre_install.txt
- src/install/requirements_frontend.txt
- src/install/requirements_common.txt
- src/install/requirements_backend.txt
- src/plugins/analysis/users_and_passwords/requirements.txt
- src/plugins/analysis/linter/requirements.txt
- src/plugins/analysis/cve_lookup/requirements.txt
- src/plugins/analysis/binwalk/requirements.txt
- src/plugins/analysis/architecture_detection/requirements.txt
- src/plugins/analysis/kernel_config/requirements.txt
At least for the four non-plugin files dependencies, we could unify them in the pyproject.toml using poetry.
To represent the individual files we could use poetry groups.
Advantages:
- Unified dependency
- Automatic creation of a lockfile
- Automatic creation of a project specific venv
- Packaging support (If we decide to implement Create Python Package #882)
Disadvantages:
- Dependency on poetry
I consider this issue resolved if the following is fulfilled:
- All non-plugin-specific dependencies are defined using poetry
- A pre-commit hook is added to check validity of the
poetry.lockandpyproject.toml - The CI runs the above hook
- The CI uses the
poetry.lockfile
See also #1335
Metadata
Metadata
Assignees
Labels
No labels