rustworkx and alpine linux issues

[nvuillam]

Describe the issue

First, thanks for your great tool :)

Before the integration of rustworkx, it was possible to install checkov with just pip install checkov on an Alpine linux based image.

Now, if there is no rust compiler, the installation fails. (example here: https://github.com/oxsecurity/megalinter/actions/runs/6366681470/job/17284612081#step:7:2092 )

In the context of checkov MegaLinter integration, I add to add rust compiler in the base image before calling pip install checkov

Now if works but the build takes forever, as all rust dependencies are compiled, and the image is heavier (example here: https://github.com/oxsecurity/megalinter/actions/runs/6373827424/job/17297877649?pr=2976#step:12:2031 )

Do you know a trick that would allow pip install checkov to find pre-compiled rustworkx for alpine linux, so I wouldn't need to compile everything during the docker build ?

Many thanks !

[gruebel]

hey @nvuillam thanks for reaching out.

I recommend to raise this in the rustworkx project. I saw they especially excluded musl from their wheels creation flow.

[stevec1980]

+1

[nvuillam]

I posted on rustworkx repo, let's see what they reply :)

[nvuillam]

Not tested yet, but rustworkx made the update :)

Qiskit/rustworkx#992 (comment)

[gruebel]

nice and thanks for reaching out directly to rustworkx @nvuillam 🍻

[nvuillam]

@gruebel you're welcome :)

I'll close this issue once i'll have applied the update on MegaLinter (by removing rust compiler) and verified it's ok :)

[lqc]

@nvuillam Would you be willing to accept a PR that changes the rustworkx, igraph and similar to extra dependency? It seems that regardless of which one (or any) I want to use, they are all installed. This would solve issues like this one also.

[gruebel]

@lqc we are currently in the process of migrating from igraph to rustworkx, so it will be removed after all work is done. networkx is still kept as a fallback, but will also be removed over time.

@nvuillam I saw that one of the recent runs was successful, therefore closing this issue.

[nvuillam]

@gruebel I confirm it's ok, thanks for your assistance :)

[nvuillam]

@nvuillam Would you be willing to accept a PR that changes the rustworkx, igraph and similar to extra dependency? It seems that regardless of which one (or any) I want to use, they are all installed. This would solve issues like this one also.

I always love to receive PRs :)
But it seems it's not necessary anymore, thanks for your offer :)

[emilhdiaz]

@gruebel is a bump to rustworkx@0.14.0 possible? That's the version that added support for musl aarch64 wheels.

[antm-pp]

+1

I'm not full read in to the tech stack here, but I think the solution back in October was only a resolution for x86_64. checkov is still broken on arm (aarch64) on alpine. The rustworkx requirement 0.13.2 needs both rust and cargo adding to the image and gives a very very slow resolution as it re-compiles, significantly inflating the image too.

If I force install of rustworkx@0.14.1 (latest) which doesn't need to be re-compiled for aarch64 then the pip install of checkov falls back to 3.1.47 (presumably a version before there was a rustworkx dependency at all?)

Would be great if the rustworkx dependency can be bumped.