coinbase / coinbase/salus

Complete requirements parsing/processing for Python

Open
#24 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
HTML
Stars
31
Forks
3
PR merge metrics
No merged PRs in 30d

Description

Per {[this](https://github.com/coinbase/salus/blob/98c51707e949cbd35f0cd1ffe8ca38b2face24b4/lib/salus/scanners/report_python_modules.rb#L8)}, it seems like the current story for python package information is reading the `requirements.txt` file. Often times, we find that when developers don't practice proper dependency management, this file is not really the source of truth for all packages that are pulled into the build artifact. With that being said, is there something on the roadmap to parse the contents of the `virtualenv` and the collection of system level installed python packages?

Contributor guide

Open the contributing guide

Research direction

Start with lib/salus/scanners/report_python_modules.rb at the referenced line and inspect how requirements.txt currently supplies Python package information. Determine the intended sources for virtualenv contents and system-level installed packages, then define what complete parsing should report and how it should be verified; the issue does not specify acceptance criteria or tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
python, ruby
Domain
security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.