fetchdep
Overview
The fetchdep utility provides an easy way for developers to fetch dependencies
for software projects that work under a container path. If a project contains
a fetchdep configuration at its root, a user can invoke fetchdep to
automatically download sources alongside the working path of a project. This
can be useful for projects which may not have package management capabilities.
The following version control systems are supported: CVS, Git, Mercurial, SVN.
Requirements
Installation
This tool can be installed using pip:
pip install fetchdep
(or)
python -m pip install fetchdep
Usage
This tool can be invoked from a command line using:
fetchdep --help
(or)
python -m fetchdep --help
Examples
Consider a project that is cloned in the following path:
└── ~/workdir
└── my-awesome-project/
└── fetchdep.yml
If a user is working inside the project directory and invokes fetchdep:
$ cd workdir/my-awesome-project
$ fetchdep
This can automatically clone dependencies alongside the project as follows:
└── ~/workdir
├── my-awesome-library-a/
| └── ...
├── my-awesome-library-b/
| └── ...
├── my-awesome-library-c/
| └── ...
└── my-awesome-project/
└── fetchdep.yml
Configuration
A fetchdep configuration file can be named either one of the following:
fetchdep.yml.fetchdep.yml.fetchdep
Configuration files are YAML defined configurations. Each configuration is
expected to have a root fetchdep list, which holds one or more dependencies
to be fetched. For example:
fetchdep:
# cvs
- name: my-module-a
site: :pserver:anonymous@cvs.example.org:/cvsroot/my-module-a my-module-a
# git
- name: my-module-b
site: https://example.com/myteam/my-module-b.git
# hg
- name: my-module-c
site: hg+https://www.example.org/repo/my-module-c
# svn
- name: my-module-d
site: svn+https://svn.code.example.com/c/myteam/my-module-d/trunk
- Each entry must have a
name, which will be used for the folder name to checkout sources to. - Each entry must also have a
site, defining what type of source will be fetched. Accepted site prefixes includecvs+,git+,hg+andsvn+. Although, some sites may omit the prefix if this utility can determine what type of sources are being fetched.
Capabilities
Tags
This utility supports tagged dependencies. A project can define one or more tags for a project. For example:
fetchdep:
- name: my-test-module
site: https://example.com/myteam/my-test-module.git
tags:
- test
By default, if a user invokes fetchdep with no other arguments, the
my-test-module module above will not be fetched. To include sources which
have a tag assigned, the tag must be added to the command line:
fetchdep --tag test
Multiple tags can be added by repeating the --tag argument. Users can also
use the --all-tags argument to fetch every dependency.
Recursive
The fetchdep utility will fetch only the current project's defined dependencies. If a project dependency defines their own fetchdep configuration, additional dependencies will not be fetched by default.
To support downloading a project's dependency's dependencies, the --recursive
option can be used:
fetchdep --recursive
Fetching too many projects may cause fetchdep to prompt to continue. This can
be overridden using the -y argument.
Dry-run
Users can always invoke with the --dry-run argument to inspect which
dependencies will be fetched without invoking a fetch operation.
Metadata
Release files for fetchdep 1.0.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| fetchdep-1.0.0.tar.gz | 38.1 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| fetchdep-1.0.0-py2.py3-none-any.whl | Python 3, Python 2 | none | any | Details |
Total release size: 72.7 kB
Release files / fetchdep-1.0.0.tar.gz
| Download URL | fetchdep-1.0.0.tar.gz |
|---|---|
| Size | 38.1 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
f8fd62fc0ee148bc3c828b54df23c857b9208fd9e9860f47c8929b5054da020c
|
|
BLAKE2b-256 checksum How to use checksums |
04b39530176e69276922dc5d0409bd00885da1c9705a78ddeb957ffd663bd1fc
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.12.8
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Feb 8, 2025.
Transparency logRelease files / fetchdep-1.0.0-py2.py3-none-any.whl
| Download URL | fetchdep-1.0.0-py2.py3-none-any.whl |
|---|---|
| Size | 34.6 kB |
| Tags | Python 2 Python 3 |
|
SHA-256 checksum How to use checksums |
bb63fc9d76cf90e3e7464dbb85ccaa8d203912596a5b4bcffb1002ee6606d393
|
|
BLAKE2b-256 checksum How to use checksums |
36c41061faf480dad90bc3ca06153af4a9e037cb100859550b3d0701e539c208
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.12.8
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Feb 8, 2025.
Transparency logSecurity for fetchdep 1.0.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for fetchdep-1.0.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Feb 8, 2025.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.