pkg-inventory: scanner script to discover all apt/apk/pypi packages from repo #159

New Issue

kert · 2026-03-24T03:54:38Z

kert commented

2026-03-24 03:54:38 +00:00

Goal

Create a single script (dev/scripts/pkg_inventory.py) that parses the entire repo and emits a canonical JSON manifest of every package installed across all Dockerfiles, pyproject.toml, uv.lock, CI workflows, and shell scripts.

Scope

Parse apt-get install / apk add from all Dockerfiles
Parse dependencies and [dependency-groups] from pyproject.toml
Parse uv add commands in Dockerfiles (notebooks)
Parse CI workflow curl-installed tools (crane, trivy, uv)
Output: data/pkg-manifest.json with sections {"apt": [...], "apk": [...], "pypi": [...], "ci_tools": [...]}
Must be idempotent and deterministic (sorted, stable output)
Include version constraints where declared

Acceptance

uv run python dev/scripts/pkg_inventory.py produces data/pkg-manifest.json
Output matches manual audit (no missing, no surplus)
Script runs in <5s on this repo

## Goal Create a single script (`dev/scripts/pkg_inventory.py`) that parses the entire repo and emits a canonical JSON manifest of every package installed across all Dockerfiles, pyproject.toml, uv.lock, CI workflows, and shell scripts. ## Scope - Parse `apt-get install` / `apk add` from all Dockerfiles - Parse `dependencies` and `[dependency-groups]` from pyproject.toml - Parse `uv add` commands in Dockerfiles (notebooks) - Parse CI workflow curl-installed tools (crane, trivy, uv) - Output: `data/pkg-manifest.json` with sections `{"apt": [...], "apk": [...], "pypi": [...], "ci_tools": [...]}` - Must be idempotent and deterministic (sorted, stable output) - Include version constraints where declared ## Acceptance - [ ] `uv run python dev/scripts/pkg_inventory.py` produces `data/pkg-manifest.json` - [ ] Output matches manual audit (no missing, no surplus) - [ ] Script runs in <5s on this repo

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-03-24 03:54:38 +00:00

kert added the ci pipeline labels 2026-03-24 03:54:38 +00:00

kert referenced this issue from a commit

2026-03-24 03:58:33 +00:00

add package supply chain scaffold: inventory scanner, drift detector, pipeline spec

kert closed this issue

2026-03-24 04:34:59 +00:00

kert referenced a pull request that will close this issue

2026-03-24 04:35:35 +00:00

feat: package supply chain — inventory, mirrors, drift, vuln scanning #169

Sign in to join this conversation.