Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Enhance python cataloger to be image/directory aware. #205

Closed
wagoodman opened this issue Oct 7, 2020 · 0 comments · Fixed by #234
Closed

Enhance python cataloger to be image/directory aware. #205

wagoodman opened this issue Oct 7, 2020 · 0 comments · Fixed by #234
Assignees
Labels
enhancement New feature or request

Comments

@wagoodman
Copy link
Contributor

wagoodman commented Oct 7, 2020

In order to reduce the number of false positives when scanning images while also keeping the value of grype-vscode [directory] scans, it would be useful when scanning directories to key off of index-like files (e.g. requirements.txt) and installation metadata (e.g. egg, wheel, setup.py) when scanning images for the python cataloger.

AC

  • Dependencies described within requirements.txt-like files are not shown during image scans (but are shown during directory scans)
  • All other python catalog sources are reported for both image and directory scans.

Steps to Test

  • When scanning a directory:
    • ensure there are examples of a requirements.txt, setup.py, egg metadata installations, and wheel metadata installations in the directory being scanned.
    • ensure the scan finds all python examples.
  • When scanning an image:
    • ensure there are examples of a requirements.txt, setup.py, egg metadata installations, and wheel metadata installations in the image being scanned.
    • ensure the scan finds all python examples EXCEPT any requirements.txt references.

Notes for Developer
Should mirror the gemspec cataloger additions made in #203

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant