Prescriptions to heal your applications and application dependencies.
We wanted to create a repository that keeps a database of known issues in Python open-source eco-system, as well as suggestions for Python libraries and runtime environments they can run in. The database is used in Thoth to resolve high quality Python software stacks. The linked blog post describes prescriptions more in-depth.
When using OpenShift or Kubernetes, one provides manifest files that state how the desired state of a cluster should look like. Prescriptions might be seen analogous to this - prescriptions provide a way to declaratively state how the desired dependency resolution should look like considering the prescribed rules. Then, it’s up to the reinforcement learning algorithm implemented in Thoth's adviser to find a solution in the form of a lockfile respecting the prescribed rules, requirements for the application and other inputs to the Thoth's cloud resolver.
See the linked presentation or YouTube video for more info.
If you would like to write a prescription for resolver, check the following docs.
If you spotted an issue in Python dependencies or Python ecosystem, just let us know by openning an issue and we will help you with writing a prescription.
Currently implemented handlers in Thoth's weekly cronjob allow to auto-generate prescriptions for the given data:
- CVE present in a package, from the PyPA advisory-database
- Project maintenance and development practices as evaluated by the OSSF Security Scorecards
- Information on package maintainance obtained via the GitHub API: if the given project is marked as archived, is forked from another project, hosts release notes, its number of maintainers, stars, contributors.
- The package size, number of downloads, maintainers and last release date from PyPI.
Prescriptions are released as a blob. During the tag release session of thoth-adviser, the s2i process clones the prescriptions repo with the latest tag information.
The prescription database is released under the terms of GNU Affero General Public License v3.0 or later. See the LICENSE file for more info.
Copyright © 2021 AICoE Project Thoth; Red Hat Inc.