Custom Integration with Conan Package Manager

Overview

Conan is a dependency and package manager for C and C++ languages. It is free and open-source, works on all platforms (Windows, Linux, OSX, FreeBSD, Solaris, etc.), and can be used to develop for all targets, including embedded, mobile (iOS, Android), and bare metal. It also integrates with all build systems like CMake, Visual Studio (MSBuild), Makefiles, etc., including proprietary ones.

Prerequisite

• Conan v2.0.0 or greater (you can check the version by running: conan -v)
• Python v3 (so you can run the script)

Integration

This integration uses the conan graph info command to retrieve the dependency graph and source code for all dependencies. From this data, it generates fossa-deps file with vendored-dependencies and custom-dependencies.

To use this integration,

1. Download make_fossa_deps_conan.py python script, and place it in the same directory as conanfile.txt or conanfile.py.
2. Build your project (ensure it compiles)
3. Run python make_fossa_deps_conan.py (this will generate fossa-deps.yaml in the same directory)
4. Run fossa analyze && fossa test

Analysis

In this approach, make_fossa_deps_conan.py does the followings:

1. Retrieve the project's dependency graph via the conan graph info command
2. Uses -c tools.build:download_source=True option to ensure Conan always retrieves source code
3. For each requirement with non build context and source code directory, it builds a vendor-dependency entry in the fossa-deps.yaml file
4. For each requirement with non build context and empty source code directory, it builds a custom-dependency entry in the fossa-deps.yaml file

Limitations

This integration method uses vendored-dependencies and custom-dependencies functionalities, and as such, it does not provide the following,

• Security functionalities (FOSSA will not be able to identify vulnerabilities, only licensing and copyright issues)
• Author information (in dependency view)

This integration example uses the best alternative mode of analysis for each dependency. It tries to locate the source code for each dependency, and if it fails to locate the source code, it will create this dependency as custom-dependency entry in the fossa-deps file. In this case, it will use a declared license for this dependency.

If the script locates the source code, it will create vendor-dependency entry in the fossa-deps file.

Example

# install Conan and some prerequisitesapt-get -y install python3 pip git wgetpip3 install conanwget https://raw.githubusercontent.com/fossas/fossa-cli/master/install-latest.shbash install-latest.sh # check the Conan versionconan --version # retrieve example projectsgit clone https://github.com/conan-io/examples2.gitcd /examples2/tutorial/consuming_packages/simple_cmake_project # buildconan profile detect --forceconan install . --output-folder=build --build=missing # download make_fossa_deps_conan.pywget https://raw.githubusercontent.com/fossas/fossa-cli/master/docs/walkthroughs/make_fossa_deps_conan.py # Set your API key. Get this from the FOSSA web application.export FOSSA_API_KEY=XXXX # Perform analysispython3 make_fossa_deps_conan.pyfossa analyze # Perform testfossa test

F.A.Q

1. Why doesn't FOSSA offer native Conan package manager analysis?

FOSSA is actively working to develop native Conan support. We want to build a functionality that provides accurate and repeatable analysis for all versions of the Conan package manager. This integration script is supplied as a potential option if you want to start using FOSSA for Conan immediately.

2. Why do I need Conan v2 or greater?

This integration example uses the conan graph info command with --format json and -c tools.build:download_source=True option, which are only available in Conan v2 (v2.0.0+).

3. I want to use a custom profile or provide additional options.

You can provide any additional conan graph info options (except --format or -f)

To do so, provide options to the Python script. For example,

>> python3 make_fossa_deps_conan.py -s compiler=gcc

4. How can I get help with this integration?

You can file a support ticket with FOSSA helpdesk.

5. How do I always use a declared license?

This can be achieved by modifying make_fossa_deps_conan.py. In the script, you can choose to always create custom-dependency entry, this will ensure that declared license is always used.

References

• Conan Package Manager
• Conan graph command