xcmsSet - old version (rev: 15646e937936) - conda version resolving never finishes about tools-metabolomics

[lecorguille]

What is the issue with the solution without the version of both snow and batch?

[Lain-inrae]

There are no problem with this solution (I think, I have not tested the tool).
The problem is: when galaxy tries to install the tool, we don't have the choice to use other versions than the ones described in the abims_xcms_xcmsSet.xml

[Lain-inrae]

If I don't have the choice, I will install it myself - I will bypass galaxy's installation process.
But that makes the deployment of our galaxy (and it tools) non reproducible (unless I write a script for those tools).

[bgruening]

Those are very old conda packages, where conda still was not pinning R correctly. We either need to update those old R packages, upgrade the Galaxy tool to use more recent packages or you can use the BioContainer that hopefully exists for this tool.

[Lain-inrae]

Hello,
I come back after some investigation about r-batch.
This package has not not been maintained since 2018. It is - in a majority of cases - used for command line parsing.
The most simple usage of this package R -q -e "batch::parseCommandArgs()" is very dangerous as it is prone to RCE (I managed to deploy a simple backdoor in python).
There are three packages that may replace it for the command line parsing. These packages are well maintained and I suppose they are well tested against command injections:
https://stackoverflow.com/questions/3433603/parsing-command-line-arguments-in-r-scripts

There are three packages on CRAN:

getopt: C-like getopt behavior
optparse: a command line parser inspired by Python's optparse library
argparse: a command line optional and positional argument parser (inspired by Python's argparse library). This package requires that a Python interpreter be installed with the argparse and json (or simplejson)