Hacker News Reader

At my employer we do the same thing for pretty much all software shipped to customers. (X thousand packages, across 5 arches, across 5 releases)

There is an ongoing effort and it becomes more complex with vendored packages, embedded jars and 'containers'.

I'm assuming that the indexing is done at compile time, how far back into your dep tree do you go ?

View on HN

It's currently only at the top-level package level, and so the data is simply taken from the package manager.

I want it to go one level deeper (we use dh-virtualenv to put several Python packages into one Debian package, but that's only done in a very small part of the company).

Of course then there could be C libraries packaged with the Python libraries packaged in a Debian repository, so we'd need another level eventually...

Reply on news.ycombinator.com