25 lines
1.3 KiB
Python
25 lines
1.3 KiB
Python
"""Audit exact installed API packages, not a host-dependent re-resolution.
|
|
|
|
Install pip-audit in an isolated environment; pass its executable as argv[1].
|
|
Only package names/versions are sent to the public vulnerability database.
|
|
"""
|
|
import json
|
|
from pathlib import Path
|
|
import subprocess
|
|
import sys
|
|
|
|
if __name__=='__main__':
|
|
packages=json.loads(subprocess.check_output(['docker','compose','exec','-T','api','pip','list','--format=json'],text=True))
|
|
requirements='\n'.join(p['name']+'=='+p['version'] for p in packages)+'\n'
|
|
destination=Path('output/security');destination.mkdir(parents=True,exist_ok=True)
|
|
(destination/'runtime-requirements.txt').write_text(requirements)
|
|
result=subprocess.run([sys.argv[1] if len(sys.argv)>1 else 'pip-audit','--no-deps','--disable-pip',
|
|
'--progress-spinner','off','-r',str(destination/'runtime-requirements.txt'),
|
|
'-f','json','-o',str(destination/'python-audit.json')])
|
|
if (destination/'python-audit.json').exists():
|
|
data=json.loads((destination/'python-audit.json').read_text())
|
|
for package in data['dependencies']:
|
|
for vulnerability in package.get('vulns',[]):
|
|
print(package['name'],package['version'],vulnerability['id'],'fix:',','.join(vulnerability['fix_versions']))
|
|
sys.exit(result.returncode)
|