tools-python
tools-python copied to clipboard
spdx
Python library deprecated in favor of Go library, or actively maintained?
@licquia Sorry to bother, but is this project still being actively maintained, or has it been deprecated in favor of the go tools? My team would really like to use this tool, but had some concerns with the number of open issues and PRs.
No answer is an answer? I also want to ask, if this project is maintained as there still seems to be problems with SPDX 2.2 while the Java Project is already working on 2.3.
I tried to use the parser on an SPDX that validates in the online validator, but throws errors when trying to read with the python library which does not get my hopes up that this is used very often.
@jblu42 I've been actively working with @kestewart to recruit more maintainer bandwidth for this project. Let me know if you are interested in helping out in this effort. I have found some usage of the libraries through different forks but the merges back are stalled. I maintain the Java libraries and I'm not much of a Python person, otherwise I would help more myself.
@goneall Thanks for the quick answer! I think this is at least a positive sign that there is still work done here. I probably can contribute with a few patches, but for active work I am currently lacking the time. I am looking into the problem why my online validated SPDX is not reading into the python lib, but with the stale merges it would be great to know if somebody already fixed that problem, but will keep working on this.
@jblu42 @juspence this project needs help for its maintainance. This can come in the form of time or money :) @juspence I am not sure that using Go is an alternative for a Python library. If anything creating a Python binding to a Go native could work but would not be a straight forward solution IMHO.
@jblu42 Understand the lack of time - but any contribution is appreciated. If you find stale merges that you think will fix this, pls. review and add a comment to the PR. I can merge in the PR as long as someone with more Python experience that I reviews the changes.
@jblu42 To answer your initial question, I'm still coming up to speed on maintenance, and am doing what I can. I hope to have things under control over the next few months.
I think it is universally agreed that this project was lacking maintainer bandwidth for a while. We got some more bandwidth now and are working on improving things, but there is still quite a bit of backlog to clear up before we can make more radical changes. Help in the form of issues, PRs or reviews is always welcome!
I hope this answers the question, I'll close the issue for now. Hopefully, significant improvements will be visible soon.
@nicoweidner Thanks to you and the current contributors, this project is making a lot of progress again. Can you consider regular releases, this helps e.g. retrieving working copies from pypi.org with bugs fixed. Last release on pypi is from 2019.
The rough plan is to fix and merge all the outstanding PRs and potentially fix some issues that are considered very important, then create a new release. After that, we want to address some bigger changes to the data model before creating a new release with many breaking changes.