283dc0a632
`uv run --directory <project> pip-audit` runs the pip-audit BINARY
through uv, but pip-audit's binary lives at
~/.local/share/uv/tools/pip-audit/ with its own embedded Python. When
invoked without `PIPAPI_PYTHON_LOCATION`, pip-audit defaults to using
the python it shipped with for its dependency resolution — so it audits
ITS OWN venv (which has its own bundled pip + urllib3 versions, both
currently flagged with CVEs) instead of the project's venv.
pip-audit emits a stderr warning about this:
pip-audit will run pip against
~/.local/share/uv/tools/pip-audit/bin/python, but you have a virtual
environment loaded at <project>/.venv. This may result in unintuitive
audits, since your local environment will not be audited. You can
forcefully override this behavior by setting PIPAPI_PYTHON_LOCATION
to the location of your virtual environment's Python interpreter.
Reproduced as a false positive on every uv project on this host —
trellis-mcp and herbylab both got the identical 4 CVEs despite neither
having pip or urllib3 in its dep tree.
Fix: set PIPAPI_PYTHON_LOCATION to the project's .venv/bin/python when
it exists. When it doesn't exist, fall back to the old behavior with a
yellow warning that the audit may be inaccurate (avoids silently
running `uv sync` as a side effect of validation).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
86 lines
2.9 KiB
Bash
Executable File
86 lines
2.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[0;33m'
|
|
NC='\033[0m'
|
|
|
|
TARGET="${1:-.}"
|
|
errors=0
|
|
|
|
echo "=== Dependency Audit ==="
|
|
|
|
has_reqtxt=$(find "$TARGET" -maxdepth 2 -name "requirements*.txt" | head -1)
|
|
has_pyproject=$(find "$TARGET" -maxdepth 2 -name "pyproject.toml" | head -1)
|
|
has_uvlock=$(find "$TARGET" -maxdepth 2 -name "uv.lock" | head -1)
|
|
has_python="${has_reqtxt}${has_pyproject}"
|
|
has_gomod=$(find "$TARGET" -maxdepth 2 -name "go.mod" | head -1)
|
|
|
|
if [ -z "$has_python" ] && [ -z "$has_gomod" ]; then
|
|
printf "${YELLOW}!${NC} No dependency files found — skipping\n"
|
|
exit 0
|
|
fi
|
|
|
|
if [ -n "$has_python" ]; then
|
|
if ! command -v pip-audit &>/dev/null; then
|
|
printf "${RED}✗${NC} pip-audit not installed\n"
|
|
exit 2
|
|
fi
|
|
|
|
echo "-- Python (pip-audit) --"
|
|
if [ -n "$has_uvlock" ]; then
|
|
printf " source: %s (uv project)\n" "$has_uvlock"
|
|
pyproject_dir=$(dirname "$has_uvlock")
|
|
# Point pip-audit at the project's venv interpreter. Without this,
|
|
# `uv run pip-audit` ends up running the pip-audit binary from its
|
|
# own uv-tool install (~/.local/share/uv/tools/pip-audit/), and
|
|
# pip-audit then audits THAT environment instead of the project's
|
|
# — surfacing CVEs in pip-audit's own bundled pip/urllib3 as if
|
|
# they were the project's deps. See pip-audit's stderr warning
|
|
# ("you have a virtual environment loaded at <project>/.venv ...
|
|
# your local environment will not be audited") for context.
|
|
project_venv_python="$pyproject_dir/.venv/bin/python"
|
|
if [ -x "$project_venv_python" ]; then
|
|
audit_cmd="PIPAPI_PYTHON_LOCATION=$project_venv_python uv run --directory $pyproject_dir pip-audit"
|
|
else
|
|
printf "${YELLOW}!${NC} No project venv at %s — pip-audit may report on its own bundled deps; run \`uv sync\` and retry for an accurate audit.\n" "$project_venv_python"
|
|
audit_cmd="uv run --directory $pyproject_dir pip-audit"
|
|
fi
|
|
elif [ -n "$has_reqtxt" ]; then
|
|
printf " source: %s (requirements file)\n" "$has_reqtxt"
|
|
audit_cmd="pip-audit -r $has_reqtxt"
|
|
else
|
|
printf " source: %s (environment mode)\n" "$has_pyproject"
|
|
audit_cmd="pip-audit"
|
|
fi
|
|
|
|
if $audit_cmd 2>/dev/null; then
|
|
printf "${GREEN}✓${NC} No known vulnerabilities in Python dependencies\n"
|
|
else
|
|
printf "${RED}✗${NC} Vulnerable Python dependencies found\n"
|
|
errors=$((errors + 1))
|
|
fi
|
|
fi
|
|
|
|
if [ -n "$has_gomod" ]; then
|
|
if ! command -v govulncheck &>/dev/null; then
|
|
printf "${YELLOW}!${NC} govulncheck not installed — skipping Go audit\n"
|
|
else
|
|
echo "-- Go (govulncheck) --"
|
|
printf " source: %s\n" "$has_gomod"
|
|
gomod_dir=$(dirname "$has_gomod")
|
|
if (cd "$gomod_dir" && govulncheck ./... 2>/dev/null); then
|
|
printf "${GREEN}✓${NC} No known vulnerabilities in Go dependencies\n"
|
|
else
|
|
printf "${RED}✗${NC} Vulnerable Go dependencies found\n"
|
|
errors=$((errors + 1))
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
if [ "$errors" -gt 0 ]; then
|
|
exit 1
|
|
else
|
|
exit 0
|
|
fi |