trailofbits / it-depends

A tool to automatically build a dependency graph and Software Bill of Materials (SBOM) for packages and arbitrary source code repositories.

It-Depends

It-Depends is a tool to automatically build a dependency graph and Software Bill of Materials (SBOM) for packages and arbitrary source code repositories. You can use it to enumerate all third party dependencies for a software package, map those dependencies to known security vulnerabilities, as well as compare the similarity between two packages based on their dependencies.

To the best of our knowledge, It-Depends is the only such tool with the following features:

• Support for C/C++ projects (both autootools and cmake)
• Automated resolution of native library dependencies partially based on dynamic analysis (e.g., the Python package pytz depends on the native library libtinfo.so.6)
• Enumeration of all possible dependency resolutions, not just a single feasible resolution
• A comparison metric for the similarity between two packages based on their dependency graph

Features ⭐

• Supports Go, JavaScript, Rust, Python, and C/C++ projects.
• Accepts source code repositories or package specifications like pip:it-depends
• Extracts dependencies of cmake/autotool repostories without building it
• Finds native dependencies for high level languages like Python or JavaScript
• Provides visualization based on vis.js or dot
• Matches dependencies and CVEs
• Export Software Bills of Materials (SBOMs)
  • Machine-intelligible JSON output
  • Support for the SPDX standard is in active development

Can It-Depends Do It? It Depends. 🍋

• It-Depends does not detect vendored or copy/pasted dependencies
• Results from build systems like autotools and cmake that entail arbitrary computation at install time are best-effort
• Resolution of native dependencies is best-effort
  • Some native dependencies are resolved through dynamic analysis
  • Native dependencies are inferred by cross-referencing file requirements against paths provided by the Ubuntu package repository; dependencies may be different across other Linux distributions or Ubuntu versions
• It-Depends attempts to resolve all possible package versions that satisfy a dependency
  • It-Depends does not find a single satisfying package resolution
  • The list of resolved packages is intended to be a superset of the packages required by the installation of a package on any system
  • The --audit feature may discover vulnerabilities in upstream dependencies that are either not exploitable in the target package or are in a package version that cannot exist in any valid dependency resolution of the target package
• It-Depends caches data that it expects to be immutable in a local database
  • If a package is ever deleted or yanked from a package repository after it was already cached, It-Depends will continue to use the cached data unless the cache is cleared with --clear-cache

Quickstart 🚀

$ pip3 install it-depends

Running it 🏃

Run it-depends in the root of the source repository you would like to analyze:

$ cd /path/to/project
$ it-depends

or alternatively point it to the path directly:

$ it-depends /path/to/project

or alternatively specify a package from a public package repository:

$ it-depends pip:numpy
$ it-depends apt:[email protected]
$ it-depends npm:lodash@>=4.17.0

It-Depends will output the full dependency hierarchy in JSON format. Additional output formats such as Graphviz/Dot are available via the --output-format option.

It-Depends can automatically try to match packages against the OSV vulnerability database with the --audit option. This is a best-effort matching as it is based on package names, which might not always consistent. Any discovered vulnerabilities are added to the JSON output.

It-Depends attempts to parallelize as much of its effort as possible. To limit the maximum number of parallel tasks, use the --max-workers option.

By default, It-Depends recursively resolves all packages' dependencies to construct a complete dependency graph. The depth of the recursion can be limited using the --depth-limit option. For example,

$ it-depends pip:graphtage --depth-limit 1

will only enumerate the direct dependencies of Graphtage.

Examples 🧑‍🏫

Here is an example of running It-Depends on its own source repository:

This is the resulting json with all the discovered dependencies. This is the resulting Graphviz dot file producing this

This is the resulting dependency graph:

It-Depends’ Dependencies 🎭

JavaScript requires npm
Rust requires cargo
Python requires pip
C/C++ requires autotools and/or cmake
Several native dependencies are resolved using Ubuntu’s file to path database apt-file, but this is seamlessly handled through an Ubuntu docker container on other distributions and operating systems
Currently docker is used to resolve native dependencies

Development 👷

$ git clone https://github.com/trailofbits/it-depends
$ cd it-depends
$ python3 -m venv venv  # Optional virtualenv
$ ./venv/bin/activate   # Optional virtualenv
$ pip3 install -e '.[dev]'
$ git config core.hooksPath ./hooks  # Optionally enable git commit hooks for linting

License and Acknowledgements 📃️

This research was developed by Trail of Bits based upon work supported by DARPA under Contract No. HR001120C0084 (Distribution Statement A, Approved for Public Release: Distribution Unlimited). Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the United States Government or DARPA.

Felipe Manzano and Evan Sultanik are the active maintainers, but Alessandro Gario, Eric Kilmer, Alexander Remie, and Henrik Brodin all made significant contributions to the tool’s inception and development.

It-Depends is licensed under the GNU Lesser General Public License v3.0. Contact us if you’re looking for an exception to the terms.

© 2021, Trail of Bits.

it-depends's Issues

Error: "Can not resolve . "

When I try to run it-depends on a git repository I get this "Can not resolve . " response immediately.
There are several "dot" files simply named ".env" or similar in the repository.

I'm sure this is a noob pitfall of some sort - feel free to enlighten me harshly ;-)

Tried out natively on Windows 11 and also via WSL. Same result.

it-depends does not find Docker on Mac

I am on a Mac and have Docker desktop installed and running. However, it-depends is still giving me Docker not installed. Try 'sudo apt install docker'

Here are some outputs:

Trying to run it-depends on a repo

❯ it-depends
resolving .: 0 dependencies [00:00, ? dependencies/s]Processing /Users/alfred.kedhammar/code/repos/scilifelab_epps
  Installing build dependencies ... done
  Getting requirements to build wheel ... done
  Preparing metadata (pyproject.toml) ... done
Building wheels for collected packages: scilifelab-epps
  Building wheel for scilifelab-epps (pyproject.toml) ... done
  Created wheel for scilifelab-epps: filename=scilifelab_epps-1.0-py3-none-any.whl size=164278 sha256=b120939382047c8c17372c477b44189fe6bc988bb59c5f160cdcb0849f02ba96
  Stored in directory: /private/var/folders/st/7720p4gn38vd042pfr7m2gh978ww82/T/pip-ephem-wheel-cache-aaac7fo5/wheels/ba/5e/ca/d4c860146b36605d8db6a591cb365aea094b257dd90850beb4
Successfully built scilifelab-epps
2023-12-22 12:42:46 [info     ] init johnnydist                [johnnydep.lib] dist=/var/folders/st/7720p4gn38vd042pfr7m2gh978ww82/T/tmp0syv5gz3/scilifelab_epps-1.0-py3-none-any.whl parent=None
2023-12-22 12:42:46 [info     ] init johnnydist                [johnnydep.lib] dist=CouchDB==1.2 parent=scilifelab-epps==1
2023-12-22 12:42:47 [info     ] init johnnydist                [johnnydep.lib] dist=genologics==1.0.0 parent=scilifelab-epps==1
2023-12-22 12:42:47 [info     ] init johnnydist                [johnnydep.lib] dist=google-api-python-client==2.111.0 parent=scilifelab-epps==1
2023-12-22 12:42:49 [info     ] init johnnydist                [johnnydep.lib] dist=httplib2==0.22.0 parent=scilifelab-epps==1
2023-12-22 12:42:50 [info     ] init johnnydist                [johnnydep.lib] dist=interop==1.3.1 parent=scilifelab-epps==1
2023-12-22 12:42:51 [info     ] init johnnydist                [johnnydep.lib] dist=oauth2client==4.1.3 parent=scilifelab-epps==1
2023-12-22 12:42:51 [info     ] init johnnydist                [johnnydep.lib] dist=pandas==2.1.4 parent=scilifelab-epps==1
2023-12-22 12:42:53 [info     ] init johnnydist                [johnnydep.lib] dist=protobuf==4.25.1 parent=scilifelab-epps==1
2023-12-22 12:42:54 [info     ] init johnnydist                [johnnydep.lib] dist=psycopg2==2.9.9 parent=scilifelab-epps==1
Docker not installed. Try `sudo apt install docker`.

Checking Docker

❯ docker info
Client:
 Version:    24.0.7
 Context:    desktop-linux
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.12.0-desktop.2
    Path:     /Users/alfred.kedhammar/.docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.23.3-desktop.2
    Path:     /Users/alfred.kedhammar/.docker/cli-plugins/docker-compose
  dev: Docker Dev Environments (Docker Inc.)
    Version:  v0.1.0
    Path:     /Users/alfred.kedhammar/.docker/cli-plugins/docker-dev
  extension: Manages Docker extensions (Docker Inc.)
    Version:  v0.2.21
    Path:     /Users/alfred.kedhammar/.docker/cli-plugins/docker-extension
  feedback: Provide feedback, right in your terminal! (Docker Inc.)
    Version:  0.1
    Path:     /Users/alfred.kedhammar/.docker/cli-plugins/docker-feedback
  init: Creates Docker-related starter files for your project (Docker Inc.)
    Version:  v0.1.0-beta.10
    Path:     /Users/alfred.kedhammar/.docker/cli-plugins/docker-init
  sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc.)
    Version:  0.6.0
    Path:     /Users/alfred.kedhammar/.docker/cli-plugins/docker-sbom
  scan: Docker Scan (Docker Inc.)
    Version:  v0.26.0
    Path:     /Users/alfred.kedhammar/.docker/cli-plugins/docker-scan
  scout: Docker Scout (Docker Inc.)
    Version:  v1.2.0
    Path:     /Users/alfred.kedhammar/.docker/cli-plugins/docker-scout

Server:
 Containers: 0
  Running: 0
  Paused: 0
  Stopped: 0
 Images: 1
 Server Version: 24.0.7
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Using metacopy: false
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: d8f198a4ed8892c764191ef7b3b06d8a2eeb5c7f
 runc version: v1.1.10-0-g18a0cb0
 init version: de40ad0
 Security Options:
  seccomp
   Profile: unconfined
  cgroupns
 Kernel Version: 6.5.11-linuxkit
 Operating System: Docker Desktop
 OSType: linux
 Architecture: aarch64
 CPUs: 8
 Total Memory: 3.836GiB
 Name: docker-desktop
 ID: 687058ce-ed68-4f7d-bc06-ac3e87331cda
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 HTTP Proxy: http.docker.internal:3128
 HTTPS Proxy: http.docker.internal:3128
 No Proxy: hubproxy.docker.internal
 Experimental: false
 Insecure Registries:
  hubproxy.docker.internal:5555
  127.0.0.0/8
 Live Restore Enabled: false

WARNING: daemon is not using the default seccomp profile

Versions

❯ docker --version
Docker version 24.0.7, build afdd53b
❯ it-depends --version
it-depends version 0.1.1

The "where"s

❯ which docker
/usr/local/bin/docker
❯ which it-depends
/Users/alfred.kedhammar/miniconda3/envs/epps/bin/it-depends

Support for Go

Add support for Go repositories.

Create an internal API for reporting security issues

Some package managers like npm are able to report on known security issues using its own vulnerability database. Provide an internal API for having package classifiers report these along side the results from cvedb. See #18.

Update README to differentiate from alternatives

How does it-depends differ from Dependabot and Renovate?

https://github.com/renovatebot/renovate

• Primarily CLI tool rather than CI bot
• Intended use case is for forensics, generating SBOMs, and comparing projects
• Support for C/C++
• Map to native libraries

FileNotFoundError: [Errno 2] No such file or directory: '/tmp/tmpy99_9n56/output'

resolving .: 0 dependencies [00:00, ? dependencies/s]2023-02-09 10:45:46 [info ] Getting dependencies for cmake repo .
Traceback (most recent call last):
File "/usr/bin/it-depends", line 33, in
sys.exit(load_entry_point('it-depends', 'console_scripts', 'it-depends')())
File "/root/it-depends/it_depends/cli.py", line 248, in main
max_workers=args.max_workers,
File "/root/it-depends/it_depends/dependencies.py", line 904, in resolve
source_package = resolver.resolve_from_source(repo_or_spec, cache=cache)
File "/root/it-depends/it_depends/cmake.py", line 396, in resolve_from_source
with open(output, "rt") as outfd:
FileNotFoundError: [Errno 2] No such file or directory: '/tmp/tmpy99_9n56/output'

Resolve native dependencies from the Ubuntu database

Initial means for comparing dependency trees

We don't necessarily need a metric at first, but our initial release should support something simple like exporting to a Graphviz .dot graph.

Match against `cvedb` for packages

Do a best effort to match against cvedb.

Autotool ignores Boost dependencies

Autotool plugin ignores Boost related dependencies

Docker support broken for podman users

If /usr/bin/docker is supplied via the podman docker CLI, building the Docker API client fails.

Podman apparently does implement a REST API at unix:///run/podman/podman.sock or (rootless) unix://$XDG_RUNTIME_DIR/podman/podman.sock. The Podman API supposedly works with docker-py, so I'd expect that Podman support is possible under the existing implementation.

Updates in ubuntu db will break CI

Pin ubuntu file-to-package database to a specific version.
Document properly where the file to package matching comes from

apt-file database will be eventually updated and could change the resolved dependencies.

Documentation

• Generate a minimum README.md
• Quickstart
• Language/packaging tool support
• Known issues
• License
• Feedback/contact info

Multiple "error: patch failed" on C++ project

I ran it-depends with the osquery repo:

> /Users/mmyers/Library/Python/3.9/bin/it-depends ~/Projects/Engineering/osquery/osquery/src/
2021-07-15 18:28:36 [info     ] Getting dependencies for cmake repo /Users/mmyers/Projects/Engineering/osquery/osquery/src
2021-07-15 18:29:01 [error    ] Error running cmake:
Running with trace output on.
Running with expanded trace output on.
Trace will be written to /var/folders/31/wdx_2hsx1ls13d1_sqfdrldh0000gn/T/tmp9sa11sma/output
HEAD is now at 3eacae5 Merge branch 'develop'
HEAD is now at 2fe3bd99 Merge pull request #1433 from dsacre/fix-clang-warnings
HEAD is now at cecee5030 Version 0.13.0
HEAD is now at 1595e53e Bump version to 4.0.2
-- Configuring done
error: patch failed: libyara/include/yara/compiler.h:273
error: libyara/include/yara/compiler.h: patch does not apply
error: patch failed: libyara/include/yara/strutils.h:74
error: libyara/include/yara/strutils.h: patch does not apply
error: patch failed: libyara/lexer.c:2160
error: libyara/lexer.c: patch does not apply
error: patch failed: libyara/modules/pe/pe.c:605
error: libyara/modules/pe/pe.c: patch does not apply
error: patch failed: libyara/strutils.c:31
error: libyara/strutils.c: patch does not apply
CMake Error at libraries/cmake/source/librdkafka/CMakeLists.txt:23 (add_library):
  Cannot find source file:
    /Users/mmyers/Projects/Engineering/osquery/osquery/src/libraries/cmake/source/librdkafka/src/src/rdkafka_ssl.c
  Tried extensions .c .C .c++ .cc .cpp .cxx .cu .mpp .m .M .mm .h .hh .h++
  .hm .hpp .hxx .in .txx .f .F .for .f77 .f90 .f95 .f03 .ispc
Call Stack (most recent call first):
  libraries/cmake/source/librdkafka/CMakeLists.txt:9 (generateLibrdkafka)
  libraries/cmake/source/librdkafka/CMakeLists.txt:219 (librdkafkaMain)
CMake Error at libraries/cmake/source/librdkafka/CMakeLists.txt:23 (add_library):
  No SOURCES given to target: thirdparty_librdkafka_c
Call Stack (most recent call first):
  libraries/cmake/source/librdkafka/CMakeLists.txt:9 (generateLibrdkafka)
  libraries/cmake/source/librdkafka/CMakeLists.txt:219 (librdkafkaMain)
CMake Generate step failed.  Build files cannot be regenerated correctly.

Support for running it-depends without a local source repo

We should be able to do something like it-depends -c pip manticore and it will return all of the dependencies for Manticore.

Support for output in ~CycloneDX~ SPDX

https://github.com/CycloneDX/specification

Be less strict about project name in CMake

If the CMakeList.txt does not provide a project(NAME) print a warning and/or use the repo folder name.

Optional max depth for dependency resolution

Something like it-depends --max-depth 0 . would only resolve the immediate dependencies of the local source repo and not try and resolve their sub-dependencies.

Move all our shell needs to a container

We need a way to run it-depends in OSX.

Set up PyPI repository secrets

This needs to be done before the first release.

Errors with and without npm when auditing `npm:astro`

Reported by @ran-dall on the OpenSSF Slack:

# it-depends npm:astro
Traceback (most recent call last):                             
  File "/usr/local/bin/it-depends", line 33, in <module>
    sys.exit(load_entry_point('it-depends', 'console_scripts', 'it-depends')())
  File "/it-depends/it_depends/cli.py", line 244, in main
    package_list = resolve(
  File "/it-depends/it_depends/dependencies.py", line 1045, in resolve
    result = finished.result()
  File "/usr/lib64/python3.10/concurrent/futures/_base.py", line 439, in result
    return self.__get_result()
  File "/usr/lib64/python3.10/concurrent/futures/_base.py", line 391, in __get_result
    raise self._exception
  File "/usr/lib64/python3.10/concurrent/futures/thread.py", line 58, in run
    result = self.fn(*self.args, **self.kwargs)
  File "/it-depends/it_depends/dependencies.py", line 826, in _process_dep
    return _DependencyResult(dep=dep, packages=list(dep.resolver.resolve(dep)), depth=depth)
  File "/it-depends/it_depends/npm.py", line 87, in resolve
    output = subprocess.check_output(
  File "/usr/lib64/python3.10/subprocess.py", line 420, in check_output
    return run(*popenargs, stdout=PIPE, timeout=timeout, check=True,
  File "/usr/lib64/python3.10/subprocess.py", line 501, in run
    with Popen(*popenargs, **kwargs) as process:
  File "/usr/lib64/python3.10/subprocess.py", line 969, in __init__
    self._execute_child(args, executable, preexec_fn, close_fds,
  File "/usr/lib64/python3.10/subprocess.py", line 1845, in _execute_child
    raise child_exception_type(errno_num, err_msg, err_filename)
FileNotFoundError: [Errno 2] No such file or directory: 'npm'

and then, with npm installed:

# it-depends npm:astro
resolving npm:astro@*: 0 dependencies [00:00, ? dependencies/s]npm notice 
npm notice New minor version of npm available! 8.3.1 -> 8.13.1
npm notice Changelog: https://github.com/npm/cli/releases/tag/v8.13.1
npm notice Run npm install -g [email protected] to update!
npm notice 
Version string lacks a numerical component: "l/generator': '^7.13.9'," 

I haven't root caused this yet; the former might be a documentation or discovery problem on our end and the latter is possibly a breakage in npm's contract.

Version string lacks a numerical component

I tried running it-depends on a few different nodejs packages and it didn't work on any of them. On a few it gave this error. Here's the output for two different projects I tried:

This is from https://github.com/timjrobinson/evolutionary-ai-battle:

> it-depends .                                                                                                 
Step 1/9 : FROM ubuntu:20.04

---> ba6acccedd29
Step 2/9 : RUN mkdir -p /workdir

---> Using cache
---> 9cf67c4f9f7a
Step 3/9 : RUN ln -fs /usr/share/zoneinfo/America/New_York /etc/localtime

---> Using cache
---> 5968dac56aef
Step 4/9 : RUN DEBIAN_FRONTEND=noninteractive apt-get update && apt-get install -y --no-install-recommends strace npm

---> Using cache
---> 81711f2c7866
Step 5/9 : WORKDIR /workdir

---> Using cache
---> efd9480ba3ad
Step 6/9 : COPY install.sh .

---> Using cache
---> 5c8e0c3e6cd2
Step 7/9 : COPY run.sh .

---> Using cache
---> aab0afbbdc27
Step 8/9 : COPY baseline.sh .

---> Using cache
---> 33764ca8b29f
Step 9/9 : RUN chmod +x *.sh

---> Using cache
---> 166127b08bf8
Successfully built 166127b08bf8
Successfully tagged trailofbits/it-depends-npm:0.1.1
Version string lacks a numerical component: "pts: '^1.3.5',"

Another one from https://github.com/timjrobinson/ssb-server:

# Docker output is same as above
Version string lacks a numerical component: "ts': '^1.0.4',"

It's unclear where this is coming from, these packages are in my package.json/package-lock.json but they are valid json files with normal semver versions.

Non-existing package causes traceback

Run: it-depends pip:[email protected]
Result:
File "/Users/hbrodin/projects/it-depends/venv/bin/it-depends", line 33, in
sys.exit(load_entry_point('it-depends', 'console_scripts', 'it-depends')())
File "/Users/hbrodin/projects/it-depends/it_depends/cli.py", line 138, in main
package_list = resolve(repo, cache=cache, depth_limit=args.depth_limit, max_workers=args.max_workers)
File "/Users/hbrodin/projects/it-depends/it_depends/dependencies.py", line 925, in resolve
result = finished.result()
File "/opt/homebrew/Cellar/[email protected]/3.9.7/Frameworks/Python.framework/Versions/3.9/lib/python3.9/concurrent/futures/_base.py", line 438, in result
return self.__get_result()
File "/opt/homebrew/Cellar/[email protected]/3.9.7/Frameworks/Python.framework/Versions/3.9/lib/python3.9/concurrent/futures/_base.py", line 390, in __get_result
raise self._exception
File "/opt/homebrew/Cellar/[email protected]/3.9.7/Frameworks/Python.framework/Versions/3.9/lib/python3.9/concurrent/futures/thread.py", line 52, in run
result = self.fn(*self.args, **self.kwargs)
File "/Users/hbrodin/projects/it-depends/it_depends/dependencies.py", line 732, in _process_dep
return _DependencyResult(dep=dep, packages=list(dep.resolver.resolve(dep)), depth=depth)
File "/Users/hbrodin/projects/it-depends/it_depends/pip.py", line 151, in resolve
JohnnyDist(f"{dependency.package}"), version=dependency.semantic_version,
File "/Users/hbrodin/projects/it-depends/venv/lib/python3.9/site-packages/johnnydep/lib.py", line 64, in init
self.import_names, self.metadata = _get_info(
File "/Users/hbrodin/projects/it-depends/venv/lib/python3.9/site-packages/cachetools/func.py", line 66, in wrapper
v = func(*args, **kwargs)
File "/Users/hbrodin/projects/it-depends/venv/lib/python3.9/site-packages/johnnydep/lib.py", line 392, in _get_info
data = pipper.get(
File "/Users/hbrodin/projects/it-depends/venv/lib/python3.9/site-packages/cachetools/decorators.py", line 26, in wrapper
v = func(*args, **kwargs)
File "/Users/hbrodin/projects/it-depends/venv/lib/python3.9/site-packages/johnnydep/pipper.py", line 143, in get
out = subprocess.check_output(args, stderr=subprocess.STDOUT, cwd=scratch_dir)
File "/opt/homebrew/Cellar/[email protected]/3.9.7/Frameworks/Python.framework/Versions/3.9/lib/python3.9/subprocess.py", line 424, in check_output
return run(*popenargs, stdout=PIPE, timeout=timeout, check=True,
File "/opt/homebrew/Cellar/[email protected]/3.9.7/Frameworks/Python.framework/Versions/3.9/lib/python3.9/subprocess.py", line 528, in run
raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '['/Users/hbrodin/projects/it-depends/venv/bin/python', '-m', 'pip', 'wheel', '-vvv', '--no-deps', '--no-cache-dir', '--disable-pip-version-check', '--progress-bar=off', '--use-deprecated=legacy-resolver', 'libc63']' returned non-zero exit status 1.

Emphasize that a Docker(-compatible) socket is required for container inputs

This is a small documentation/UX thing: users running Podman-in-Podman or Docker-in-Docker will probably encounter failures, since it-depends talks directly to the Docker (or Docker-compatible) socket.

We should document this as a limitation of the current implementation.

it-depends local_path not working in fully patched ubuntu 22.04 lts amd64 os

Dear Team,

firstly thank you for this cool idea.
While trying to run as per instruction in https://github.com/trailofbits/it-depends/blob/master/README.md#running-it-, I am unable to reproduce the steps for any local paths as per the error list as follows.

Any hints would be truly appreciated.

Many thanks again.

BR
infojg9

---

• error list

`

$ cat /etc/os-release
PRETTY_NAME="Ubuntu 22.04.2 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.2 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
...

$ python --version
Python 3.10.6

ubuntu-22.04 $ it-depends .

/usr/lib/python3/dist-packages/paramiko/transport.py:236: CryptographyDeprecationWarning: Blowfish has been deprecated
"class": algorithms.Blowfish,
Can not resolve .

ubuntu-22.04 $ it-depends /sdb1/app/dir1/src
/usr/lib/python3/dist-packages/paramiko/transport.py:236: CryptographyDeprecationWarning: Blowfish has been deprecated
"class": algorithms.Blowfish,
Can not resolve /sdb1/app/dir1/src

ubuntu-22.04 $ it-depends *
/usr/lib/python3/dist-packages/paramiko/transport.py:236: CryptographyDeprecationWarning: Blowfish has been deprecated
"class": algorithms.Blowfish,
usage: it-depends [-h] [--audit] [--list] [--database [DATABASE]] [--clear-cache] [--compare [COMPARE]] [--normalize]
[--output-format {json,dot,html}] [--output-file OUTPUT_FILE] [--force] [--all-versions] [--depth-limit DEPTH_LIMIT]
[--max-workers MAX_WORKERS] [--version]
[PATH_OR_NAME]
it-depends: error: unrecognized arguments: config doc LICENSE.md license_notice.md Makefile project README.md result setup src test

ubuntu-22.04 $ it-depends
/usr/lib/python3/dist-packages/paramiko/transport.py:236: CryptographyDeprecationWarning: Blowfish has been deprecated
"class": algorithms.Blowfish,
Can not resolve .

`

No dependencies for a CMake project

metadata

Installed via pip3 install it-depends on a Manjaro system

$ it-depends --version
it-depends version 0.1.1

Issue

I tried It-Depends for a large CMake project, to get to know the tool, but the resulting JSON data was essentially empty:

{
    "cmake:xournalpp": {
        "1.1.0+dev": {
            "dependencies": {},
            "vulnerabilities": [],
            "source": "cmake",
            "is_source_package": true
        }
    }
}

(This is for a large, publicly available project xournalpp)
It does give a lot of informational output, but starts with the suspicious info resolving .: 0 dependencies:

resolving .: 0 dependencies [00:00, ? dependencies/s]2022-02-10 09:07:53 [info     ] Getting dependencies for cmake repo .
2022-02-10 09:08:02 [info     ] Processing CMAKE command find_package ['Git']
2022-02-10 09:08:02 [info     ] Rebuilding global apt package list.
2022-02-10 09:08:02 [info     ] Processing CMAKE command find_package ['CXX17', 'REQUIRED', 'COMPONENTS', 'optional']
2022-02-10 09:08:02 [info     ] Processing CMAKE command check_include_file_cxx ['optional', 'CXX_OPTIONAL_FOUND']
2022-02-10 09:08:02 [info     ] Processing CMAKE command find_package ['Filesystem', 'REQUIRED', 'COMPONENTS', 'ghc', 'Final', 'Experimental']
2022-02-10 09:08:02 [info     ] Processing CMAKE command check_include_file_cxx ['filesystem', '_CXX_FILESYSTEM_HAVE_HEADER']
2022-02-10 09:08:02 [info     ] Processing CMAKE command find_package ['Backtrace']
2022-02-10 09:08:02 [info     ] Processing CMAKE command find_path ['Backtrace_INCLUDE_DIR', 'execinfo.h']
2022-02-10 09:08:02 [info     ] Processing CMAKE command pkg_check_modules ['ExternalModules', 'REQUIRED', 'IMPORTED_TARGET', 'glib-2.0', '>=', '2.32.0', 'gtk+-3.0', '>=', '3.18.9', 'poppler-glib', '>=', '0.41.0', 'gthread-2.0', '>=', '2.4.0', 'libxml-2.0', '>=', '2.0.0', 'libzip', '>=', '1.0.1', 'portaudiocpp', '>=', '12', 'sndfile', '>=', '1.0.25', 'librsvg-2.0', '>=', '2.40']
2022-02-10 09:08:03 [info     ] Processing CMAKE command _pkg_find_libs ['ExternalModules', '0', '0']
2022-02-10 09:08:03 [warning  ] Not handled _pkg_find_libs ['ExternalModules', '0', '0']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_gtk-3', 'NAMES', 'gtk-3', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_gtk-3', 'NAMES', 'gtk-3']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_gdk-3', 'NAMES', 'gdk-3', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_gdk-3', 'NAMES', 'gdk-3']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_z', 'NAMES', 'z', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_z', 'NAMES', 'z']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_pangocairo-1.0', 'NAMES', 'pangocairo-1.0', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_pangocairo-1.0', 'NAMES', 'pangocairo-1.0']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_pango-1.0', 'NAMES', 'pango-1.0', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_pango-1.0', 'NAMES', 'pango-1.0']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_harfbuzz', 'NAMES', 'harfbuzz', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_harfbuzz', 'NAMES', 'harfbuzz']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_atk-1.0', 'NAMES', 'atk-1.0', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_atk-1.0', 'NAMES', 'atk-1.0']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_cairo-gobject', 'NAMES', 'cairo-gobject', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_cairo-gobject', 'NAMES', 'cairo-gobject']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_poppler-glib', 'NAMES', 'poppler-glib', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_poppler-glib', 'NAMES', 'poppler-glib']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_gthread-2.0', 'NAMES', 'gthread-2.0', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_gthread-2.0', 'NAMES', 'gthread-2.0']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_glib-2.0', 'NAMES', 'glib-2.0', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_glib-2.0', 'NAMES', 'glib-2.0']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_xml2', 'NAMES', 'xml2', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_xml2', 'NAMES', 'xml2']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_zip', 'NAMES', 'zip', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_zip', 'NAMES', 'zip']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_portaudiocpp', 'NAMES', 'portaudiocpp', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_portaudiocpp', 'NAMES', 'portaudiocpp']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_portaudio', 'NAMES', 'portaudio', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_portaudio', 'NAMES', 'portaudio']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_asound', 'NAMES', 'asound', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_asound', 'NAMES', 'asound']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_pthread', 'NAMES', 'pthread', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_pthread', 'NAMES', 'pthread']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_sndfile', 'NAMES', 'sndfile', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_sndfile', 'NAMES', 'sndfile']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_rsvg-2', 'NAMES', 'rsvg-2', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_rsvg-2', 'NAMES', 'rsvg-2']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_m', 'NAMES', 'm', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_m', 'NAMES', 'm']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_gio-2.0', 'NAMES', 'gio-2.0', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_gio-2.0', 'NAMES', 'gio-2.0']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_gdk_pixbuf-2.0', 'NAMES', 'gdk_pixbuf-2.0', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_gdk_pixbuf-2.0', 'NAMES', 'gdk_pixbuf-2.0']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_gobject-2.0', 'NAMES', 'gobject-2.0', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_gobject-2.0', 'NAMES', 'gobject-2.0']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_glib-2.0', 'NAMES', 'glib-2.0', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_glib-2.0', 'NAMES', 'glib-2.0']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_cairo', 'NAMES', 'cairo', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_ExternalModules_cairo', 'NAMES', 'cairo']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_package ['ZLIB', 'REQUIRED']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_path ['ZLIB_INCLUDE_DIR', 'NAMES', 'zlib.h', 'PATHS', '[HKEY_LOCAL_MACHINE\\SOFTWARE\\GnuWin32\\Zlib', 'InstallPath]', '/zlib', '/zlib', 'PATH_SUFFIXES', 'include']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['ZLIB_LIBRARY_RELEASE', 'NAMES', 'z', 'zlib', 'zdll', 'zlib1', 'zlibstatic', 'NAMES_PER_DIR', 'PATHS', '[HKEY_LOCAL_MACHINE\\SOFTWARE\\GnuWin32\\Zlib', 'InstallPath]', '/zlib', '/zlib', 'PATH_SUFFIXES', 'lib']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_library ['ZLIB_LIBRARY_DEBUG', 'NAMES', 'zd', 'zlibd', 'zdlld', 'zlibd1', 'zlib1d', 'zlibstaticd', 'NAMES_PER_DIR', 'PATHS', '[HKEY_LOCAL_MACHINE\\SOFTWARE\\GnuWin32\\Zlib', 'InstallPath]', '/zlib', '/zlib', 'PATH_SUFFIXES', 'lib']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_package ['Threads', 'REQUIRED']
2022-02-10 09:08:03 [info     ] Processing CMAKE command check_include_file ['pthread.h', 'CMAKE_HAVE_PTHREAD_H']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_package ['X11']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_path ['X11_X11_INCLUDE_PATH', 'X11/X.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_path ['X11_Xlib_INCLUDE_PATH', 'X11/Xlib.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_path ['X11_ICE_INCLUDE_PATH', 'X11/ICE/ICE.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_path ['X11_SM_INCLUDE_PATH', 'X11/SM/SM.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_path ['X11_Xaccessrules_INCLUDE_PATH', 'X11/extensions/XKBrules.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_path ['X11_Xaccessstr_INCLUDE_PATH', 'X11/extensions/XKBstr.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_path ['X11_Xau_INCLUDE_PATH', 'X11/Xauth.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_path ['X11_Xaw_INCLUDE_PATH', 'X11/Xaw/Intrinsic.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:03 [info     ] Processing CMAKE command find_path ['X11_xcb_INCLUDE_PATH', 'xcb/xcb.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:04 [info     ] Processing CMAKE command find_path ['X11_X11_xcb_INCLUDE_PATH', 'X11/Xlib-xcb.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:04 [info     ] Processing CMAKE command find_path ['X11_xcb_icccm_INCLUDE_PATH', 'xcb/xcb_icccm.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:04 [info     ] Processing CMAKE command find_path ['X11_xcb_util_INCLUDE_PATH', 'xcb/xcb_aux.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:04 [info     ] Processing CMAKE command find_path ['X11_xcb_xfixes_INCLUDE_PATH', 'xcb/xfixes.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:04 [info     ] Processing CMAKE command find_path ['X11_Xcomposite_INCLUDE_PATH', 'X11/extensions/Xcomposite.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:04 [info     ] Processing CMAKE command find_path ['X11_Xcursor_INCLUDE_PATH', 'X11/Xcursor/Xcursor.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:04 [info     ] Processing CMAKE command find_path ['X11_Xdamage_INCLUDE_PATH', 'X11/extensions/Xdamage.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:04 [info     ] Processing CMAKE command find_path ['X11_Xdmcp_INCLUDE_PATH', 'X11/Xdmcp.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:04 [info     ] Processing CMAKE command find_path ['X11_Xext_INCLUDE_PATH', 'X11/extensions/Xext.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:04 [info     ] Processing CMAKE command find_path ['X11_dpms_INCLUDE_PATH', 'X11/extensions/dpms.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:04 [info     ] Processing CMAKE command find_path ['X11_Xxf86misc_INCLUDE_PATH', 'X11/extensions/xf86misc.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:04 [info     ] Processing CMAKE command find_path ['X11_Xxf86vm_INCLUDE_PATH', 'X11/extensions/xf86vmode.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:04 [info     ] Processing CMAKE command find_path ['X11_Xfixes_INCLUDE_PATH', 'X11/extensions/Xfixes.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:04 [info     ] Processing CMAKE command find_path ['X11_Xft_INCLUDE_PATH', 'X11/Xft/Xft.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:04 [info     ] Processing CMAKE command find_path ['X11_Xi_INCLUDE_PATH', 'X11/extensions/XInput.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:04 [info     ] Processing CMAKE command find_path ['X11_Xinerama_INCLUDE_PATH', 'X11/extensions/Xinerama.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:04 [info     ] Processing CMAKE command find_path ['X11_Xkb_INCLUDE_PATH', 'X11/extensions/XKB.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:04 [info     ] Processing CMAKE command find_path ['X11_xkbcommon_INCLUDE_PATH', 'xkbcommon/xkbcommon.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:04 [info     ] Processing CMAKE command find_path ['X11_xkbcommon_X11_INCLUDE_PATH', 'xkbcommon/xkbcommon-x11.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:04 [info     ] Processing CMAKE command find_path ['X11_Xkblib_INCLUDE_PATH', 'X11/XKBlib.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:04 [info     ] Processing CMAKE command find_path ['X11_xkbfile_INCLUDE_PATH', 'X11/extensions/XKBfile.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_path ['X11_Xmu_INCLUDE_PATH', 'X11/Xmu/Xmu.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_path ['X11_Xpm_INCLUDE_PATH', 'X11/xpm.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_path ['X11_Xtst_INCLUDE_PATH', 'X11/extensions/XTest.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_path ['X11_XShm_INCLUDE_PATH', 'X11/extensions/XShm.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_path ['X11_Xrandr_INCLUDE_PATH', 'X11/extensions/Xrandr.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_path ['X11_Xrender_INCLUDE_PATH', 'X11/extensions/Xrender.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_path ['X11_XRes_INCLUDE_PATH', 'X11/extensions/XRes.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_path ['X11_Xss_INCLUDE_PATH', 'X11/extensions/scrnsaver.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_path ['X11_Xshape_INCLUDE_PATH', 'X11/extensions/shape.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_path ['X11_Xutil_INCLUDE_PATH', 'X11/Xutil.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_path ['X11_Xt_INCLUDE_PATH', 'X11/Intrinsic.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_path ['X11_Xv_INCLUDE_PATH', 'X11/extensions/Xvlib.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_path ['X11_XSync_INCLUDE_PATH', 'X11/extensions/sync.h', '/usr/pkg/xorg/include', '/usr/X11R6/include', '/usr/X11R7/include', '/usr/include/X11', '/usr/openwin/include', '/usr/openwin/share/include', '/opt/graphics/OpenGL/include', '/opt/X11/include']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_X11_LIB', 'X11', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_ICE_LIB', 'ICE', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_SM_LIB', 'SM', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_Xau_LIB', 'Xau', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_Xaw_LIB', 'Xaw', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_xcb_LIB', 'xcb', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_X11_xcb_LIB', 'X11-xcb', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_xcb_icccm_LIB', 'xcb-icccm', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_xcb_util_LIB', 'xcb-util', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_xcb_xfixes_LIB', 'xcb-xfixes', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_xcb_xkb_LIB', 'xcb-xkb', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_Xcomposite_LIB', 'Xcomposite', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_Xcursor_LIB', 'Xcursor', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_Xdamage_LIB', 'Xdamage', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_Xdmcp_LIB', 'Xdmcp', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_Xext_LIB', 'Xext', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_Xfixes_LIB', 'Xfixes', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_Xft_LIB', 'Xft', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_Xi_LIB', 'Xi', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_Xinerama_LIB', 'Xinerama', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_xkbcommon_LIB', 'xkbcommon', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_xkbcommon_X11_LIB', 'xkbcommon-x11', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_xkbfile_LIB', 'xkbfile', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_Xmu_LIB', 'Xmu', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_Xpm_LIB', 'Xpm', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_Xrandr_LIB', 'Xrandr', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_Xrender_LIB', 'Xrender', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_XRes_LIB', 'XRes', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_Xss_LIB', 'Xss', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_Xt_LIB', 'Xt', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_Xtst_LIB', 'Xtst', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_Xv_LIB', 'Xv', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_Xxf86misc_LIB', 'Xxf86misc', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['X11_Xxf86vm_LIB', 'Xxf86vm', '/usr/pkg/xorg/lib', '/usr/X11R6/lib', '/usr/X11R7/lib', '/usr/openwin/lib', '/opt/X11/lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_package ['Freetype', 'QUIET']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_path ['FREETYPE_INCLUDE_DIR_ft2build', 'ft2build.h', 'HINTS', 'ENV', 'FREETYPE_DIR', 'PATHS', 'ENV', 'GTKMM_BASEPATH', '[HKEY_CURRENT_USER\\SOFTWARE\\gtkmm\\2.4', 'Path]', '[HKEY_LOCAL_MACHINE\\SOFTWARE\\gtkmm\\2.4', 'Path]', 'PATH_SUFFIXES', 'include/freetype2', 'include', 'freetype2']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_path ['FREETYPE_INCLUDE_DIR_freetype2', 'NAMES', 'freetype/config/ftheader.h', 'config/ftheader.h', 'HINTS', 'ENV', 'FREETYPE_DIR', 'PATHS', 'ENV', 'GTKMM_BASEPATH', '[HKEY_CURRENT_USER\\SOFTWARE\\gtkmm\\2.4', 'Path]', '[HKEY_LOCAL_MACHINE\\SOFTWARE\\gtkmm\\2.4', 'Path]', 'PATH_SUFFIXES', 'include/freetype2', 'include', 'freetype2']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['FREETYPE_LIBRARY_RELEASE', 'NAMES', 'freetype', 'libfreetype', 'freetype219', 'HINTS', 'ENV', 'FREETYPE_DIR', 'PATHS', 'ENV', 'GTKMM_BASEPATH', '[HKEY_CURRENT_USER\\SOFTWARE\\gtkmm\\2.4', 'Path]', '[HKEY_LOCAL_MACHINE\\SOFTWARE\\gtkmm\\2.4', 'Path]', 'PATH_SUFFIXES', 'lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['FREETYPE_LIBRARY_DEBUG', 'NAMES', 'freetyped', 'libfreetyped', 'freetype219d', 'HINTS', 'ENV', 'FREETYPE_DIR', 'PATHS', 'ENV', 'GTKMM_BASEPATH', '[HKEY_CURRENT_USER\\SOFTWARE\\gtkmm\\2.4', 'Path]', '[HKEY_LOCAL_MACHINE\\SOFTWARE\\gtkmm\\2.4', 'Path]', 'PATH_SUFFIXES', 'lib']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_package ['Fontconfig', 'QUIET']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_package ['PkgConfig', 'QUIET']
2022-02-10 09:08:05 [info     ] Processing CMAKE command pkg_check_modules ['PKG_FONTCONFIG', 'QUIET', 'fontconfig']
2022-02-10 09:08:05 [info     ] Processing CMAKE command _pkg_find_libs ['PKG_FONTCONFIG', '0', '0']
2022-02-10 09:08:05 [warning  ] Not handled _pkg_find_libs ['PKG_FONTCONFIG', '0', '0']
2022-02-10 09:08:05 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_PKG_FONTCONFIG_fontconfig', 'NAMES', 'fontconfig', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:06 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_PKG_FONTCONFIG_fontconfig', 'NAMES', 'fontconfig']
2022-02-10 09:08:06 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_PKG_FONTCONFIG_freetype', 'NAMES', 'freetype', 'HINTS', '/usr/lib', 'NO_DEFAULT_PATH']
2022-02-10 09:08:06 [info     ] Processing CMAKE command find_library ['pkgcfg_lib_PKG_FONTCONFIG_freetype', 'NAMES', 'freetype']
2022-02-10 09:08:06 [info     ] Processing CMAKE command find_path ['Fontconfig_INCLUDE_DIR', 'NAMES', 'fontconfig/fontconfig.h', 'HINTS', '/usr/include/freetype2', '/usr/include/libpng16', '/usr/include/harfbuzz', '/usr/include/glib-2.0', '/usr/lib/glib-2.0/include', '/usr/include/sysprof-4', '/usr/X11/include']
2022-02-10 09:08:06 [info     ] Processing CMAKE command find_library ['Fontconfig_LIBRARY', 'NAMES', 'fontconfig', 'PATHS', '/usr/lib']
2022-02-10 09:08:06 [info     ] Processing CMAKE command find_package ['Lua', '5.3']
2022-02-10 09:08:06 [info     ] Processing CMAKE command find_path ['LUA_INCLUDE_DIR', 'lua.h', 'HINTS', 'ENV', 'LUA_DIR', 'PATH_SUFFIXES', 'include']
2022-02-10 09:08:06 [info     ] Processing CMAKE command find_path ['LUA_INCLUDE_DIR', 'lua.h', 'HINTS', 'ENV', 'LUA_DIR', 'PATH_SUFFIXES', 'lua']
2022-02-10 09:08:06 [info     ] Processing CMAKE command find_path ['LUA_INCLUDE_DIR', 'lua.h', 'HINTS', 'ENV', 'LUA_DIR', 'PATH_SUFFIXES', 'include/lua']
2022-02-10 09:08:06 [info     ] Processing CMAKE command find_path ['LUA_INCLUDE_DIR', 'lua.h', 'HINTS', 'ENV', 'LUA_DIR', 'PATH_SUFFIXES', 'lua54']
2022-02-10 09:08:06 [info     ] Processing CMAKE command find_path ['LUA_INCLUDE_DIR', 'lua.h', 'HINTS', 'ENV', 'LUA_DIR', 'PATH_SUFFIXES', 'include/lua54']
2022-02-10 09:08:06 [info     ] Processing CMAKE command find_path ['LUA_INCLUDE_DIR', 'lua.h', 'HINTS', 'ENV', 'LUA_DIR', 'PATH_SUFFIXES', 'lua5.4']
2022-02-10 09:08:06 [info     ] Processing CMAKE command find_path ['LUA_INCLUDE_DIR', 'lua.h', 'HINTS', 'ENV', 'LUA_DIR', 'PATH_SUFFIXES', 'include/lua5.4']
2022-02-10 09:08:06 [info     ] Processing CMAKE command find_path ['LUA_INCLUDE_DIR', 'lua.h', 'HINTS', 'ENV', 'LUA_DIR', 'PATH_SUFFIXES', 'lua-5.4']
2022-02-10 09:08:06 [info     ] Processing CMAKE command find_path ['LUA_INCLUDE_DIR', 'lua.h', 'HINTS', 'ENV', 'LUA_DIR', 'PATH_SUFFIXES', 'include/lua-5.4']
2022-02-10 09:08:06 [info     ] Processing CMAKE command find_path ['LUA_INCLUDE_DIR', 'lua.h', 'HINTS', 'ENV', 'LUA_DIR', 'PATH_SUFFIXES', 'lua53']
2022-02-10 09:08:06 [info     ] Processing CMAKE command find_path ['LUA_INCLUDE_DIR', 'lua.h', 'HINTS', 'ENV', 'LUA_DIR', 'PATH_SUFFIXES', 'include/lua53']
2022-02-10 09:08:06 [info     ] Processing CMAKE command find_path ['LUA_INCLUDE_DIR', 'lua.h', 'HINTS', 'ENV', 'LUA_DIR', 'PATH_SUFFIXES', 'lua5.3']
2022-02-10 09:08:06 [info     ] Processing CMAKE command find_library ['LUA_LIBRARY', 'NAMES', 'lua53', 'lua5.3', 'lua-5.3', 'lua.5.3', 'lua', 'NAMES_PER_DIR', 'HINTS', 'ENV', 'LUA_DIR', 'PATH_SUFFIXES', 'lib']
2022-02-10 09:08:06 [info     ] Processing CMAKE command find_library ['LUA_MATH_LIBRARY', 'm']

• trying a Go project I got roughly the information I expected
• looking through the --help output I can't see any flags I've failed to set?
• but it looks like it handles the CMake config alright, so I'm confused why all the evident dependencies are omitted from the JSON output?

Am I misunderstanding the tool?

Map packages against Google OSV

• Extend the it-depends API to associate vulnerabilities with packages
• Use Google OSV as a data source to automatically assign vulnerabilities to packages
• Provide a command line option similar to npm audit that reports the known vulnerabilities for a project

NPM dependency resolution is not accurate

the NPM dependency resolution only uses package.json, while in reality package-lock.json is actually used (if available of course) to create and resolve dependency issues. Ignoring the changes made to peerDependencies for a moment the correct construction of node_modules is processed and generated during reification.

Note: The current version of npm used is 6.14.4, while latest is ^8.0.0

  diff: Diff | null;
  /**
   * During reification, the `idealTree` is diffed against the actual tree,
   * then the nodes from the ideal tree are extracted onto disk.
   *
   * At the end of `instance.reify()`, the ideal tree is copied to `instance.actualTree`,
   * since then it reflects the actual state of the `node_modules` folder.
   */
  async reify(options: ReifyMethodOptions = {}): Promise<Node>;

Also, without taking into account package-lock.json, it's not possible to correctly resolve packages that may be only available through private npm registries or dependencies that are susceptible to package dependency confusion attacks.

This also can not resolve alt. forms of specifying dependency location, e.g.:

"package-name": "npm:package-name@^1.0.0"
"package-name": "git+https://github.com/github_org/package-name/#COMMIT_REF"

Exception triggers when generating HTML output (for Go projects)

Using the --output-format html (with or without -o out.html) results in the following exception and creation of an empty report file. I have encountered this only while auditing a Go project.

it-depends ../project-code/ --depth-limit 3 --output-format html:

Traceback (most recent call last):
  File "/Users/user/.pyenv/versions/3.8.12/bin/it-depends", line 8, in <module>
    sys.exit(main())
  File "/Users/user/.pyenv/versions/3.8.12/lib/python3.8/site-packages/it_depends/cli.py", line 201, in main
    output_file.write(graph_to_html(package_list, collapse_versions=not args.all_versions))
  File "/Users/user/.pyenv/versions/3.8.12/lib/python3.8/site-packages/it_depends/html.py", line 94, in graph_to_html
    graph = graph.collapse_versions()
  File "/Users/user/.pyenv/versions/3.8.12/lib/python3.8/site-packages/it_depends/dependencies.py", line 325, in collapse_versions
    version = max(p.version for p in instances)
TypeError: '>' not supported between instances of 'GoVersion' and 'GoVersion'

JSON and Dot output formats work as expected.
Tested with it-depends version 0.1.1 installed via pip on Python 3.8.12.

it-depends returns an empty {} on C++ project

Is there a way to get more information about what's failing?

> git clone [email protected]:nodejs/node ~/Projects/Engineering/node
> /Users/mmyers/Library/Python/3.9/bin/it-depends ~/Projects/Engineering/node/
{}⏎
> /Users/mmyers/Library/Python/3.9/bin/it-depends ~/Projects/Engineering/node/src/
{}⏎                                                                                                                                 

Tested on macOS 11.4 and Ubuntu Linux 21.04.

Rust support breaks for non-crates.io dependency

Hi, this is very cool.

I was looking to run it on one of my rust projects after reading the It-depends blog post however it seems to crash if it can't find a dependency on crates.io. For my project, some of my dependencies are libraries that are stored locally in the same repository as the project. One of these is described in my Cargo.toml file as:

[dependencies.bril2json]
version      = "0.1.0"
path         = "../bril-rs/bril2json"

I believe the expected behavior would be to look up the crate at the following path as an alternative location(in fact it should probably be the first location searched if provided). I've included the output I received from running it-depends .

/opt/homebrew/Cellar/[email protected]/3.9.10/Frameworks/Python.framework/Versions/3.9/lib/python3.9/site-packages/_distutils_hack/__init__.py:30: UserWarning: Setuptools is replacing distutils.
  warnings.warn("Setuptools is replacing distutils.")
resolving .:  91%|████████████████████████████████████████████████████████▏     | 115/127 [00:00<00:00, 427.84 dependencies/s]     Created binary (application) package 
    Created binary (application) package
     Created binary (application) package
    Blocking waiting for file lock on package cache
    Blocking waiting for file lock on package cache
    Updating crates.io index
error: no matching package named `bril2json` found
location searched: registry `crates-io`
required by package `tmpfdsfp3rm v0.1.0 (/private/var/folders/_5/8cyj_28144g15vmx7gt8n41r0000gn/T/tmpfdsfp3rm)`
    Updating crates.io index
Traceback (most recent call last):                                                                                            
  File "/opt/homebrew/bin/it-depends", line 8, in <module>
    sys.exit(main())
  File "/opt/homebrew/lib/python3.9/site-packages/it_depends/cli.py", line 176, in main
    package_list = resolve(
  File "/opt/homebrew/lib/python3.9/site-packages/it_depends/dependencies.py", line 970, in resolve
    result = finished.result()
  File "/opt/homebrew/Cellar/[email protected]/3.9.10/Frameworks/Python.framework/Versions/3.9/lib/python3.9/concurrent/futures/_base.py", line 439, in result
    return self.__get_result()
  File "/opt/homebrew/Cellar/[email protected]/3.9.10/Frameworks/Python.framework/Versions/3.9/lib/python3.9/concurrent/futures/_base.py", line 391, in __get_result
    raise self._exception
  File "/opt/homebrew/Cellar/[email protected]/3.9.10/Frameworks/Python.framework/Versions/3.9/lib/python3.9/concurrent/futures/thread.py", line 58, in run
    result = self.fn(*self.args, **self.kwargs)
  File "/opt/homebrew/lib/python3.9/site-packages/it_depends/dependencies.py", line 777, in _process_dep
    return _DependencyResult(dep=dep, packages=list(dep.resolver.resolve(dep)), depth=depth)
  File "/opt/homebrew/lib/python3.9/site-packages/it_depends/cargo.py", line 150, in resolve
    self.resolve_from_source(SourceRepository(path=tmpdir), cache)
  File "/opt/homebrew/lib/python3.9/site-packages/it_depends/cargo.py", line 111, in resolve_from_source
    for package in get_dependencies(repo, check_for_cargo=False):
  File "/opt/homebrew/lib/python3.9/site-packages/it_depends/cargo.py", line 46, in get_dependencies
    metadata = json.loads(subprocess.check_output(["cargo", "metadata", "--format-version", "1"], cwd=repo.path))
  File "/opt/homebrew/Cellar/[email protected]/3.9.10/Frameworks/Python.framework/Versions/3.9/lib/python3.9/subprocess.py", line 424, in check_output
    return run(*popenargs, stdout=PIPE, timeout=timeout, check=True,
  File "/opt/homebrew/Cellar/[email protected]/3.9.10/Frameworks/Python.framework/Versions/3.9/lib/python3.9/subprocess.py", line 528, in run
    raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '['cargo', 'metadata', '--format-version', '1']' returned non-zero exit status 101.
    Blocking waiting for file lock on package cache
    Updating crates.io index
    Blocking waiting for file lock on package cache

Error on npm project

Installed with pip3 install it-depends

Go to /my/npm/project then:

❯ it-depends
Traceback (most recent call last):                   
  File "/home/seb/.local/bin/it-depends", line 8, in <module>
    sys.exit(main())
             ^^^^^^
  File "/home/seb/.local/lib/python3.11/site-packages/it_depends/cli.py", line 176, in main
    package_list = resolve(
                   ^^^^^^^^
  File "/home/seb/.local/lib/python3.11/site-packages/it_depends/dependencies.py", line 844, in resolve
    source_package = resolver.resolve_from_source(repo_or_spec, cache=cache)
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/seb/.local/lib/python3.11/site-packages/it_depends/npm.py", line 29, in resolve_from_source
    return NPMResolver.from_package_json(repo)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/seb/.local/lib/python3.11/site-packages/it_depends/npm.py", line 60, in from_package_json
    return SourcePackage(name, version, source_repo=source_repository,
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/seb/.local/lib/python3.11/site-packages/it_depends/dependencies.py", line 277, in __init__
    super().__init__(name=name, version=version, dependencies=dependencies,
  File "/home/seb/.local/lib/python3.11/site-packages/it_depends/dependencies.py", line 137, in __init__
    self.dependencies: FrozenSet[Dependency] = frozenset(dependencies)
                                               ^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/seb/.local/lib/python3.11/site-packages/it_depends/npm.py", line 62, in <genexpr>
    Dependency(package=dep_name, semantic_version=NPMResolver.parse_spec(dep_version), source="npm")
  File "/home/seb/.local/lib/python3.11/site-packages/it_depends/dependencies.py", line 63, in __init__
    assert(isinstance(semantic_version, SemanticVersion))
AssertionError

Examples of each type of project supported

• One example for each repo type supported
• Add tests for each one
• Run tests in CI

Document the platforms supported

If I recall, C/C++ dependency enumeration is only supported on Linux. Might want to indicate this on the README.