Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

README, _cli: Add a -S, --strict mode #146

Merged
merged 10 commits into from
Dec 1, 2021
Merged

README, _cli: Add a -S, --strict mode #146

merged 10 commits into from
Dec 1, 2021

Conversation

woodruffw
Copy link
Member

Closes #142.

@woodruffw woodruffw added the component:cli CLI components label Nov 30, 2021
@woodruffw woodruffw requested review from di and tetsuo-cpp November 30, 2021 20:08
@woodruffw woodruffw self-assigned this Nov 30, 2021
@woodruffw
Copy link
Member Author

This doesn't play completely nicely with the context manager we use for the spinner:

root@1aa0ddda304c:/tmp/pip-audit# pip-audit -S
WARNING:pip_audit._service.pypi:Warning: pip 20.0.2 doesn't support the `cache dir` subcommand, unable to reuse the `pip` HTTP cache and using "/root/.pip-audit-cache" instead
/ Auditing pyparsing (3.0.6)            Fatal: python-apt: Dependency not found on PyPI and could not be audited: python-apt (2.0.0+ubuntu0.20.4.6)

WARNING:pip_audit._service.pypi:Warning: Dependency not found on PyPI and could not be audited: python-apt (2.0.0+ubuntu0.20.4.6)

(Note that the spinner and the Fatal: share a line.)

Working on that now.

@woodruffw
Copy link
Member Author

woodruffw commented Nov 30, 2021

Reusing our log buffering work does the trick:

root@1aa0ddda304c:/tmp/pip-audit# pip-audit -S
WARNING:pip_audit._service.pypi:Warning: pip 20.0.2 doesn't support the `cache dir` subcommand, unable to reuse the `pip` HTTP cache and using "/root/.pip-audit-cache" instead
/ Auditing pyparsing (3.0.6)
WARNING:pip_audit._service.pypi:Warning: Dependency not found on PyPI and could not be audited: python-apt (2.0.0+ubuntu0.20.4.6)
ERROR:pip_audit._cli:Fatal: python-apt: Dependency not found on PyPI and could not be audited: python-apt (2.0.0+ubuntu0.20.4.6)
root@1aa0ddda304c:/tmp/pip-audit# exit

The warning and error are dupes, but that's mostly cosmetic. We could convert the warning into a debug-level message, so that it doesn't show up at the default loglevel.

Edit: Done.

Copy link
Contributor

@tetsuo-cpp tetsuo-cpp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@tetsuo-cpp tetsuo-cpp merged commit c01f4d5 into main Dec 1, 2021
@tetsuo-cpp tetsuo-cpp deleted the ww/strict branch December 1, 2021 00:39
netbsd-srcmastr pushed a commit to NetBSD/pkgsrc that referenced this pull request Dec 7, 2021
## [1.1.0]

### Added

* CLI: The `--path <PATH>` flag has been added, allowing users to limit
  dependency discovery to one or more paths (specified separately)
  when `pip-audit` is invoked in environment mode
  ([#148](pypa/pip-audit#148))

* CLI: The `pip-audit` CLI can now be accessed through `python -m pip_audit`.
  All functionality is identical to the functionality provided by the
  `pip-audit` entrypoint
  ([#173](pypa/pip-audit#173))

* CLI: The `--verbose` flag has been added, allowing users to receive more
  more verbose output from `pip-audit`. Supplying the `--verbose` flag
  overrides the `PIP_AUDIT_LOGLEVEL` environment variable and is equivalent to
  setting it to `debug`
  ([#185](pypa/pip-audit#185))

### Changed

* CLI: `pip-audit` now clears its spinner bar from the terminal upon
  completion, preventing visual confusion
  ([#174](pypa/pip-audit#174))

### Fixed

* Dependency sources: a crash caused by `platform.python_version` returning
  an version string that couldn't be parsed as a PEP-440 version was fixed
  ([#175](pypa/pip-audit#175))

* Dependency sources: a crash caused by incorrect assumptions about
  the structure of source distributions was fixed
  ([#166](pypa/pip-audit#166))

* Vulnerability sources: a performance issue on Windows caused by cache failures
  was fixed ([#178](pypa/pip-audit#178))

## [1.0.1] - 2021-12-02

### Fixed

* CLI: The `--desc` flag no longer requires a following argument. If passed
  as a bare option, `--desc` is equivalent to `--desc on`
  ([#153](pypa/pip-audit#153))

* Dependency resolution: The PyPI-based dependency resolver no longer throws
  an uncaught exception on package resolution errors; instead, the package
  is marked as skipped and an appropriate warning or fatal error (in
  `--strict` mode) is produced
  ([#162](pypa/pip-audit#162))

* CLI: When providing the `--cache-dir` flag, the command to read the pip cache
  directory is no longer executed. Previously this was always executed and
  could result into failure when the command fails. In CI environments, the
  default `~/.cache` directory is typically not writable by the build user and
  this meant that the `python -m pip cache dir` would fail before this fix,
  even if the `--cache-dir` flag was provided.
  ([#161](pypa/pip-audit#161))

## [1.0.0] - 2021-12-01

### Added

* This is the first stable release of `pip-audit`! The CLI is considered
  stable from this point on, and all changes will comply with
  [Semantic Versioning](https://semver.org/)

## [0.0.9] - 2021-12-01

### Added

* CLI: Skipped dependencies are now listed in the output of `pip-audit`,
  for supporting output formats
  ([#145](pypa/pip-audit#145))
* CLI: `pip-audit` now supports a "strict" mode (enabled with `-S` or
  `--strict`) that fails if the audit if any individual dependency cannot be
  resolved or audited. The default behavior is still to skip any individual
  dependency errors ([#146](pypa/pip-audit#146))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
component:cli CLI components
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add option to fail an audit if a dependency can't be audited
2 participants