Complete requirements parsing/processing for Python
- Dominant language
- HTML
- Stars
- 31
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
Per {[this](https://github.com/coinbase/salus/blob/98c51707e949cbd35f0cd1ffe8ca38b2face24b4/lib/salus/scanners/report_python_modules.rb#L8)}, it seems like the current story for python package information is reading the `requirements.txt` file. Often times, we find that when developers don't practice proper dependency management, this file is not really the source of truth for all packages that are pulled into the build artifact. With that being said, is there something on the roadmap to parse the contents of the `virtualenv` and the collection of system level installed python packages?
Contributor guide
Research direction
Start with lib/salus/scanners/report_python_modules.rb at the referenced line and inspect how requirements.txt currently supplies Python package information. Determine the intended sources for virtualenv contents and system-level installed packages, then define what complete parsing should report and how it should be verified; the issue does not specify acceptance criteria or tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python, ruby
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100