Set up integration with Packit

[siteshwar]

This issue tracks integration with the PackIt service. Possible blocker has been discussed earlier.

@lachmanfrantisek @lbarcziova Please leave your comments, if I missed anything.

EDIT: Related issue in PackIt upstream.

[kdudka]

@siteshwar If I remember correctly, there was a request by PackIt team on the last two quarterly meetings to make osh-cli accept SRPMs specified by URLs. I think the initial implementation should be pretty simple but I am not sure if we track this anywhere.

[siteshwar]

@kdudka It is tracked through openscanhub/openscanhub#248.

[siteshwar]

I discussed this issue with @lachmanfrantisek and we agreed to do a prototype with PackIt command line client:

• It should look similar to the Copr integration in PackIt. Reference code:
  • https://github.com/packit/packit/blob/main/packit/cli/builds/copr_build.py#L29
  • https://github.com/packit/packit/blob/9f43ce16fdc57de83db8fb79dc23d11ba89b1c3d/packit/api.py#L1920
• We agreed to introduce a dependency on the osh-cli package (at least in the draft), as OpenScanHub does not have a REST API and integration with xmlrpc could be tricky to do directly.
• Contribution guidelines can be found at https://github.com/packit/packit/blob/main/CONTRIBUTING.md#running

[siteshwar]

I discussed this issue with @lachmanfrantisek today and we agreed to introduce a packit build in-osh subcommand. Its implementation should look like:

• packit build in-osh: Perform a full scan (osh-cli mock-build) on the project.
• packit build in-osh --srpm-version-diff second.srpm: Perform a differential build (osh-cli version-diff-build) with the second srpm.

We managed to hack together a basic prototype of the CLI command. But it needs to be polished before a pull request can be opened against upstream.

[kdudka]

Thank you for working on this! My proposal is to give the subcommand a more self-explaining name, such as scan-in-osh. Otherwise this may arouse an impression that OSH is a build service.

[siteshwar]

Thank you for working on this! My proposal is to give the subcommand a more self-explaining name, such as scan-in-osh. Otherwise this may arouse an impression that OSH is a build service.

@kdudka packit has build subcommand, but not scan. So, for copr the command looks like packit build in-copr.

@lachmanfrantisek Do you think we can introduce a scan subcommand? This may be useful if you plan to integrate with other scanners in the future.

[lachmanfrantisek]

Hmm, we don't have any other scanning integration planned now. Since it actually performs a build during the OSH scan, I would probably leave it as is for now... We can definitely change this or make an alias if we realise this was a bad idea. But with Packit, the CLI is not too important compared to the service.

[kdudka]

My proposal was not to replace build but to replace in-osh with scan-in-osh (or perhaps scan-with-osh?), which I thought would be trivial. But keeping the current name is also fine.

[lbarcziova]

I agree build in-osh may be misleading and would rather go with a simple command scan-in-osh.

[siteshwar]

This issue should be followed up by the Packit team through packit/packit-service#2107 and packit/packit-service#2454.

I am closing it, as there is nothing to be done from OSH side.