desholmes/python-vulnerability-checker repository overview

⁠Python Dependency Vulnerability Checker

This repo uses the Skjold⁠ package to check the dependencies for a project against the following advisory sources:

• GitHub Advisory Database⁠
• PyUP.io safety-db⁠
• GitLab gemnasium-db⁠

⁠Docker Image Details

hub.docker.com/repository/docker/desholmes/python-vulnerability-checker⁠.

• Registry: desholmes
• Repository name: python-vulnerability-checker
• Current version: 1.0.1

⁠Usage

1. Run make setup: to copy .env into place (.env-dist > .env)
2. Generate a GitHub personal access token⁠ and replace <GITHUB_TOKEN> in .env
3. Replace the paths below:
   1. <requirements path>: Path to the requirements file
   2. <reports path>: Path to the where the skjold-report.json report file should be saved

docker run --rm -it \
    -e GITHUB_TOKEN=$(GITHUB_TOKEN) \
    -v <requirements path>/requirements.txt:/usr/src/app/requirements.txt \
    -v <reports path>/skjold-report.json:/usr/src/app/skjold-report.json \
    desholmes/python-vulnerability-checker:1.0.0

⁠Getting Started

⁠Prerequisites

1. Installation of Docker CE⁠
2. A working knowledge of git SCM⁠
3. Installation of Python 3.7.3⁠

⁠Docker

⁠Building

1. Complete the 'Getting Started > Prerequisites' section
2. Run make setup: to copy .env into place (.env-dist > .env)
3. Generate a GitHub personal access token⁠ with public access permissions and replace <GITHUB_TOKEN> in .env
4. Run make build to create the docker image based on the details of the Docker Image Details section above

⁠Running

1. Complete the 'Docker > Building' section
2. Run make run-pass to the docker container using the contents of the ./test_pass_project
3. Note: The output from the above commands shows a No vulnerable packages found! message and exits with a 0
4. Run make run-fail to the docker container using the contents of the ./test_fail_project
5. Note: The output from the above commands shows a Found 2 vulnerable packages! message and exits with a 1
6. Note: The ./test_fail_project/skjold-report.json⁠ has been updated

⁠Version History

1. 1.0.1: Added docker hub link to docs
2. 1.0.0: Base repo