first commit

local/dependency_audit.py

@@ -0,0 +1,24 @@
+"""Audit exact installed API packages, not a host-dependent re-resolution.
+
+Install pip-audit in an isolated environment; pass its executable as argv[1].
+Only package names/versions are sent to the public vulnerability database.
+"""
+import json
+from pathlib import Path
+import subprocess
+import sys
+
+if __name__=='__main__':
+    packages=json.loads(subprocess.check_output(['docker','compose','exec','-T','api','pip','list','--format=json'],text=True))
+    requirements='\n'.join(p['name']+'=='+p['version'] for p in packages)+'\n'
+    destination=Path('output/security');destination.mkdir(parents=True,exist_ok=True)
+    (destination/'runtime-requirements.txt').write_text(requirements)
+    result=subprocess.run([sys.argv[1] if len(sys.argv)>1 else 'pip-audit','--no-deps','--disable-pip',
+        '--progress-spinner','off','-r',str(destination/'runtime-requirements.txt'),
+        '-f','json','-o',str(destination/'python-audit.json')])
+    if (destination/'python-audit.json').exists():
+        data=json.loads((destination/'python-audit.json').read_text())
+        for package in data['dependencies']:
+            for vulnerability in package.get('vulns',[]):
+                print(package['name'],package['version'],vulnerability['id'],'fix:',','.join(vulnerability['fix_versions']))
+    sys.exit(result.returncode)