Skip to content

Commit

Permalink
feat(python): add support for poetry dev dependencies
Browse files Browse the repository at this point in the history 
Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io>
  • Loading branch information
@nikpivkin
nikpivkin committed Dec 23, 2024
1 parent e6d0ba5 commit 4ab4d2b
Show file tree
Hide file tree
Showing 5 changed files with 247 additions and 23 deletions.
2 changes: 1 addition & 1 deletion docs/docs/coverage/language/python.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ The following table provides an outline of the features Trivy offers.
|-----------------|------------------|:-----------------------:|:----------------:|:------------------------------------:|:--------:|:----------------------------------------:|
| pip | requirements.txt | - | Include | - | ✓ | ✓ |
| Pipenv | Pipfile.lock | ✓ | Include | - | ✓ | Not needed |
| Poetry | poetry.lock | ✓ | Exclude | ✓ | - | Not needed |
| Poetry | poetry.lock | ✓ | Include | ✓ | - | Not needed |
| uv | uv.lock | ✓ | Exclude | ✓ | - | Not needed |


Expand Down
37 changes: 19 additions & 18 deletions pkg/fanal/analyzer/language/python/poetry/poetry.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -103,46 +103,47 @@ func (a poetryAnalyzer) mergePyProject(fsys fs.FS, dir string, app *types.Applic
return xerrors.Errorf("unable to parse %s: %w", path, err)
}

// Identify the direct/transitive dependencies
prodRootDeps := project.Tool.Poetry.Dependencies
directDeps := lo.Assign(prodRootDeps, getDevDeps(project))
prodDeps := getProdPackages(app, prodRootDeps)

// Identify the direct/transitive/dev dependencies
for i, pkg := range app.Packages {
if _, ok := project.Tool.Poetry.Dependencies[pkg.Name]; ok {
_, isProd := prodDeps[pkg.ID]
app.Packages[i].Dev = !isProd
if _, ok := directDeps[pkg.Name]; ok {
app.Packages[i].Relationship = types.RelationshipDirect
} else {
app.Packages[i].Indirect = true
app.Packages[i].Relationship = types.RelationshipIndirect
}
}

filterProdPackages(project, app)
return nil
}

func filterProdPackages(project pyproject.PyProject, app *types.Application) {
func getDevDeps(project pyproject.PyProject) map[string]struct{} {
deps := make(map[string]struct{})
for _, groupDeps := range project.Tool.Poetry.Groups {
deps = lo.Assign(deps, groupDeps.Dependencies)
}
return deps
}

func getProdPackages(app *types.Application, prodRootDeps map[string]struct{}) map[string]struct{} {
packages := lo.SliceToMap(app.Packages, func(pkg types.Package) (string, types.Package) {
return pkg.ID, pkg
})

visited := make(map[string]struct{})
deps := project.Tool.Poetry.Dependencies

for group, groupDeps := range project.Tool.Poetry.Groups {
if group == "dev" {
continue
}
deps = lo.Assign(deps, groupDeps.Dependencies)
}

for _, pkg := range packages {
if _, prodDep := deps[pkg.Name]; !prodDep {
if _, directDep := prodRootDeps[pkg.Name]; !directDep {
continue
}
walkPackageDeps(pkg.ID, packages, visited)
}

app.Packages = lo.Filter(app.Packages, func(pkg types.Package, _ int) bool {
_, ok := visited[pkg.ID]
return ok
})
return visited
}

func walkPackageDeps(pkgID string, packages map[string]types.Package, visited map[string]struct{}) {
Expand Down
125 changes: 123 additions & 2 deletions pkg/fanal/analyzer/language/python/poetry/poetry_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -187,17 +187,31 @@ func Test_poetryLibraryAnalyzer_Analyze(t *testing.T) {
// export PATH="/root/.local/bin:$PATH"
// poetry new groups && cd groups
// poetry add requests@2.32.3
// poetry add httpx@0.28.1 --extras socks
// poetry add --optional typing-inspect@0.9.0
// poetry add --group dev pytest@8.3.4
// poetry add --group lint ruff@0.8.3
// poetry add --optional typing-inspect@0.9.0
name: "skip deps from groups",
name: "with groups",
dir: "testdata/with-groups",
want: &analyzer.AnalysisResult{
Applications: []types.Application{
{
Type: types.Poetry,
FilePath: "poetry.lock",
Packages: types.Packages{
{
ID: "anyio@4.7.0",
Name: "anyio",
Version: "4.7.0",
Indirect: true,
Relationship: types.RelationshipIndirect,
DependsOn: []string{
"exceptiongroup@1.2.2",
"idna@3.10",
"sniffio@1.3.1",
"typing-extensions@4.12.2",
},
},
{
ID: "certifi@2024.12.14",
Name: "certifi",
Expand All @@ -212,20 +226,105 @@ func Test_poetryLibraryAnalyzer_Analyze(t *testing.T) {
Indirect: true,
Relationship: types.RelationshipIndirect,
},
{
ID: "colorama@0.4.6",
Name: "colorama",
Version: "0.4.6",
Indirect: true,
Relationship: types.RelationshipIndirect,
Dev: true,
},
{
ID: "exceptiongroup@1.2.2",
Name: "exceptiongroup",
Version: "1.2.2",
Indirect: true,
Relationship: types.RelationshipIndirect,
},
{
ID: "h11@0.14.0",
Name: "h11",
Version: "0.14.0",
Indirect: true,
Relationship: types.RelationshipIndirect,
},
{
ID: "httpcore@1.0.7",
Name: "httpcore",
Version: "1.0.7",
Indirect: true,
Relationship: types.RelationshipIndirect,
DependsOn: []string{
"certifi@2024.12.14",
"h11@0.14.0",
},
},
{
ID: "httpx@0.28.1",
Name: "httpx",
Version: "0.28.1",
Relationship: types.RelationshipDirect,
DependsOn: []string{
"anyio@4.7.0",
"certifi@2024.12.14",
"httpcore@1.0.7",
"idna@3.10",
"socksio@1.0.0",
},
},
{
ID: "idna@3.10",
Name: "idna",
Version: "3.10",
Indirect: true,
Relationship: types.RelationshipIndirect,
},
{
ID: "iniconfig@2.0.0",
Name: "iniconfig",
Version: "2.0.0",
Indirect: true,
Relationship: types.RelationshipIndirect,
Dev: true,
},
{
ID: "mypy-extensions@1.0.0",
Name: "mypy-extensions",
Version: "1.0.0",
Indirect: true,
Relationship: types.RelationshipIndirect,
},
{
ID: "packaging@24.2",
Name: "packaging",
Version: "24.2",
Indirect: true,
Relationship: types.RelationshipIndirect,
Dev: true,
},
{
ID: "pluggy@1.5.0",
Name: "pluggy",
Version: "1.5.0",
Indirect: true,
Relationship: types.RelationshipIndirect,
Dev: true,
},
{
ID: "pytest@8.3.4",
Name: "pytest",
Version: "8.3.4",
Relationship: types.RelationshipDirect,
Dev: true,
DependsOn: []string{
"colorama@0.4.6",
"exceptiongroup@1.2.2",
"iniconfig@2.0.0",
"packaging@24.2",
"pluggy@1.5.0",
"tomli@2.2.1",
},
},
{
ID: "requests@2.32.3",
Name: "requests",
Expand All @@ -242,8 +341,30 @@ func Test_poetryLibraryAnalyzer_Analyze(t *testing.T) {
ID: "ruff@0.8.3",
Name: "ruff",
Version: "0.8.3",
Relationship: types.RelationshipDirect,
Dev: true,
},
{
ID: "sniffio@1.3.1",
Name: "sniffio",
Version: "1.3.1",
Indirect: true,
Relationship: types.RelationshipIndirect,
},
{
ID: "socksio@1.0.0",
Name: "socksio",
Version: "1.0.0",
Indirect: true,
Relationship: types.RelationshipIndirect,
},
{
ID: "tomli@2.2.1",
Name: "tomli",
Version: "2.2.1",
Indirect: true,
Relationship: types.RelationshipIndirect,
Dev: true,
},
{
ID: "typing-extensions@4.12.2",
Expand Down
105 changes: 103 additions & 2 deletions pkg/fanal/analyzer/language/python/poetry/testdata/with-groups/poetry.lock
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions pkg/fanal/analyzer/language/python/poetry/testdata/with-groups/pyproject.toml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ readme = "README.md"
python = "^3.9"
requests = "2.32.3"
typing-inspect = {version = "0.9.0", optional = true}
httpx = {version = "0.28.1", extras = ["socks"]}


[tool.poetry.group.dev.dependencies]
Expand Down

0 comments on commit 4ab4d2b

Please sign in to comment.