A tool for scanning Python environments for known vulnerabilities
Project description
pip-audit
pip-audit is a prototype tool for scanning Python environments for packages with known vulnerabilities. It uses the Python Packaging Advisory Database (https://github.com/pypa/advisory-db) as a source of vulnerability reports.
This project is developed by Trail of Bits with support from Google. This is not an official Google product.
Development steps
git clone https://github.com/trailofbits/pip-audit && cd pip-audit
make dev && source env/bin/activate
pip-audit --help
Release process
Releases of pip-audit are managed via bump
and GitHub Actions.
# default release (patch bump)
make release
# override the default
# vX.Y.Z -> vX.Y.Z-rc.0
make release BUMP_ARGS="--pre rc.0"
# vX.Y.Z -> vN.0.0
make release BUMP_ARGS="--major"
make release will fail if there are any untracked changes in the source tree.
If make release succeeds, you'll see an output like this:
RUN ME MANUALLY: git push origin main && git push origin vX.Y.Z
Run that last command sequence to complete the release.
Licensing
pip-audit is licensed under the Apache 2.0 License.
pip-audit reuses and modifies examples from
resolvelib, which is licensed under
the ISC license.
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for pip_audit-0.0.1-py3-none-any.whl
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | cd48e78fda4d8b29870e7f1b35472be8cf6a4ac453c91c7795ec1e8d26b51cb0 |
|
| MD5 | fcc1e31debe5c52094ce8ba64a823f3d |
|
| BLAKE2b-256 | 81edb29bebe5a4b99e14dcae34f963b7166db82bea0a4ab735f6af4f9d3f4c7c |
