Mailman 3 - code-quality

Inquiry: Country of Origin for Bandit
by Zhang, Cynthia X. (GSFC-710.0)[BOOZ ALLEN HAMILTON] 20 Mar '23

20 Mar '23

Hello, my name is Cynthia Zhang and I am a Supply Chain Risk Management Analyst at NASA. NASA is currently conducting a supply chain assessment of Bandit. We are interested in confirming the following information: 1. Is there an organization which sponsors/publishes the project, or a primary developer who audits the code for potential vulnerabilities, errors, or malicious code? Y/N 2. Please list the country or list of countries where most contributions originate from. Thank you, Cynthia Zhang

2 1

Can flake8 flag function calls that do not catch exceptions?
by Inigo Incer 05 Mar '23

05 Mar '23

Suppose we have a function my_function that throws exceptions. Can flake8 (or a plugin) tell whether this function was called without handling exceptions, i.e., outside a try block? I would like to verify that my code handles the exceptions that may be raised by any function it calls. If this feature is not available, I believe it would be useful to add. Many thanks, Inigo

2 1

Mypy alternatives
by Dan Stromberg 23 Feb '23

23 Feb '23

Hello people. I've used Mypy and liked it in combination with MonkeyType. I've heard there are alternatives to Mypy that are faster, and I'm looking at using something like this on a 457,000 line project. Are there equivalents to MonkeyType that will work with these alternatives to Mypy? And has Mypy become the defacto standard for how type annotations should look? That is, are there other tools that assume Mypy's format too, and does most doc about type annotations assume Mypy's style? Thanks! PS: I sent this to python-list first five days ago, but didn't get a single reply.

3 2

Interested in discussing autoflake?
by Abraham Esguerra 08 Feb '23

08 Feb '23

How’s it going? I’m Abe from CodeSee. We help open source projects get the visibility it deserves by promoting them to our ever-growing community of open-source enthusiasts and also help them get people onboard faster. I was scrolling through the projects that took part in Hacktoberfest and autoflake really caught my attention. If you can spare 15 minutes of your time for us to get in touch and talk more about it, we would be really grateful. We can have a cozy conversation here <https://calendly.com/anamogul/osscommunity>! Looking forward to talk to you! Kind regards. -- *Abraham Esguerra* | CodeSee's Open Source Hub | Community Developer Relations | opensourcehub.io / discord.gg/opensource

1 0

Declaration of Vulnerabilities - Pylint
by Bird, Kurt 08 Jan '23

08 Jan '23

Dear Pylint Maintainers, GDMS-C is preparing a response to a Government of Canada solicitation and is considering identifying the following products in the work environment for the proposed solution; - Pylint v2.* As a requirement of the solicitation, GDMS-C is required to submit a list of the five (5) latest vulnerabilities for the products listed above. Please consider this request and complete the attached form for the products listed. The proposal response is due shortly and as such GDMS-C would appreciate your response by no later than Close of Business (COB) on January 13, 2023. Thank you in advance for your assistance, please advise if you require any further assistance or do not foresee meeting the requested due date. Best regards, Kurt Bird Scrum Master, LCSS DevOps General Dynamics Mission Systems-Canada (403)-730-1206 "This message and/or attachments may include information subject to GD Corporate Policies and is intended to be accessed only by authorized recipients. Use, storage and transmission are governed by General Dynamics and its policies. Contractual restrictions apply to third parties. Recipients should refer to the policies or contract to determine proper handling. Unauthorized review, use, disclosure or distribution is prohibited. If you are not an intended recipient, please contact the sender and destroy all copies of the original message."

3 2

Export status for astroid (2.12.13)
by RIGAL Romain 21 Dec '22

21 Dec '22

Hi Thanks for maintaining astroid. Do you know whether it is Not controlled, or if it has an Export control classification number (ECCN) in compliance with US export control laws ? (Bureau of Industry and Security website : http://www.bis.doc.gov/) Thanks for your time. Best regards. THALES Group

3 2

What uses that callable?
by Dan Stromberg 26 Oct '22

26 Oct '22

Hello people. Assume you have a software system that is self-contained: you do not need to concern yourself with client code that is outside that tree (because there is none, or you arbitrarily declare it unimportant as a simplifying assumption). Is there a tool for Python that can assess whether a given function (or list of functions, method or list of methods) is used or not, within that source tree? grep, which is what I've been using, only goes so far. It finds comments, and it finds methods by name independent of what class they are associated with. I have a feeling there are IDE's that do this. These I'm interested in, but I'm a bit more interested in standalone tools apart from a GUI. Thanks.

3 2

Inquiry: Country of Origin for Bandit
by Zhang, Cynthia X. (GSFC-710.0)[BOOZ ALLEN HAMILTON] 17 Aug '22

17 Aug '22

Hello, my name is Cynthia and I am a Supply Chain Risk Management Analyst at NASA. NASA is currently conducting a supply chain assessment of Bandit. As stated in Sections 208 and 514 of the Consolidated Appropriations Act, 2022, Public Law 117-103, enacted March 15, 2022, a required step of our process is to verify the Country of Origin (CoO) information for the product (i.e., the country where the products were developed, manufactured, and assembled.) As Bandit is open source, we understand that this inquiry is not directly applicable, as contributions may be made from individuals from around the world. In this case, NASA is interested in confirming the following information: 1. Is there an organization which sponsors/publishes the project, or a primary developer who audits the code for potential vulnerabilities, errors, or malicious code? Y/N 2. Does Bandit have an overseeing organization or individual along these lines? Y/N 1. If so, please provide the name of the organization and country they are established in. If the information above is unknown or cannot be provided, we request that you provide the country or list of countries where the majority of contributions originate from to satisfy Sections 208 and 514 of the Consolidated Appropriations Act, 2022, Public Law 117-103, enacted March 15, 2022. Thank you, Cynthia

1 0

Black and MonkeyType
by Dan Stromberg 31 Jul '22

31 Jul '22

Hello folks. If you have a project you want to eventually run through both Black and MonkeyType, is there any advantage to running Black first? IOW, is MonkeyType less likely to get confused by Black-formatted code than by inconsistently multiple-humans-formatted code? Also, I'm hearing that Black does before-and-after AST's to make sure no bugs are introduced. Does MonkeyType do anything like this? Thanks.

4 3

python3 -b?
by Dan Stromberg 20 Jul '22

20 Jul '22

Hi folks. I've been porting things from Python2 to Python3 for a while, but I just found out today about python3's -b option, which emits a warning when comparing str to bytes (or vice versa), or when converting bytes to str using the str initializer. I noticed that it also seems to even help with dictionary keys - nice. My question is: if -b is no longer detecting things to warn about, how much does that say about how far along your str-vs-bytes-correctness is? Thanks.

6 5