Fridolín Pokorný

Solver should report exact package hash that was used to install a package

15

**Is your feature request related to a problem? Please describe.** Currently, Thoth provides all the artifact hashes in the lockfile that were found on the index and it lets the...

Failed to validate prescriptions for organization `1132719438`

7

**Describe the bug** ``` 2022-04-25 16:13:32,881 226484 WARNING thoth.common:340: Logging to a Sentry instance is turned off 2022-04-25 16:13:32,882 226484 INFO thoth.adviser:253: Version: 0.53.0 2022-04-25 16:13:32,883 226484 INFO thoth.adviser:978: Validating...

Provide a script that creates markdown report out of prescriptions for a package

5

**Is your feature request related to a problem? Please describe.** As discussed at the TF SIG build community meeting, let's provide a way to generate a markdown file for TensorFlow....

[Spike][8pt]Perform dynamic source code analysis to give more security related guidenance

20

**Is your feature request related to a problem? Please describe.** I, as a Thoth user, would like to consume recommendations that are derived out of dynamic source code analysis. As...

Audit containerized environments

9

**Is your feature request related to a problem? Please describe.** As a user of Thoth, I would like to submit my container image to Thoth services and Thoth should give...

Data driven decisions based on data from PyPI

7

**Is your feature request related to a problem? Please describe.** As a user of Thoth, I would like to get guidance on which software is used in the Python community....

Evaluate possible integration with OpenSSF package analysis

5

See: https://openssf.org/blog/2022/04/28/introducing-package-analysis-scanning-open-source-packages-for-malicious-behavior/ https://github.com/ossf/package-analysis Let's check if data produced by this tool are valuable for Thoth. If so, let's see what our integration points look like. - [ ] check what...

Use SARIF schema when reporting flaws to GitHub

9

**Is your feature request related to a problem? Please describe.** See https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning

Provide SLA and license for the cloud based resolver community

11

**Is your feature request related to a problem? Please describe.** As a user of Thoth, I would like to see what is SLA and what I can expect+what is expected...

[3pt] Move away from setuptools and use pyproject.toml instead

13

**Is your feature request related to a problem? Please describe.** As Thoth, I would like to get rid of setuptools and start using pyproject.toml-based projects as that's how Python community...