dependency-check / dependency-check/DependencyCheck

[Python] Analyze standalone PKG-INFO

Open
#896 1 comment 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

`PythonDistributionAnalyzer` analyzes `PKG_INFO` [only if](https://github.com/jeremylong/DependencyCheck/blob/master/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/PythonDistributionAnalyzer.java#L202) it's in `.egg-info/` or `EGG-INFO/`

Setuptools docs [says](http://setuptools.readthedocs.io/en/latest/formats.html#project-metadata) that: "Because it’s possible for this to be the only metadata file included, .egg-info format eggs are not required to be a directory; they can just be a .egg-info file that directly contains the PKG-INFO metadata."

PEP 314 [says](https://www.python.org/dev/peps/pep-0314/#including-metadata-in-packages) that: "This file will be named PKG-INFO and will be placed in the top directory of the source distribution (where the README, INSTALL, and other files usually go)."

And indeed many projects ship just `PKG-INFO` without any `.egg-info/`, for example:
https://pypi.python.org/pypi/moin
https://pypi.python.org/pypi/docutils
https://pypi.python.org/pypi/pycrypto
https://pypi.python.org/pypi/python-gnupg
https://pypi.python.org/pypi/salt

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.