pysentry-rs 0.1.3__cp310-cp310-macosx_11_0_arm64.whl → 0.1.5__cp310-cp310-macosx_11_0_arm64.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.

This version of pysentry-rs might be problematic. Click here for more details.

Files changed (10) hide show
  1. pysentry/__init__.py +130 -23
  2. pysentry/__main__.py +1 -1
  3. pysentry/_internal.cpython-310-darwin.so +0 -0
  4. pysentry_rs-0.1.5.dist-info/METADATA +546 -0
  5. pysentry_rs-0.1.5.dist-info/RECORD +8 -0
  6. pysentry_rs-0.1.3.dist-info/METADATA +0 -297
  7. pysentry_rs-0.1.3.dist-info/RECORD +0 -8
  8. {pysentry_rs-0.1.3.dist-info → pysentry_rs-0.1.5.dist-info}/WHEEL +0 -0
  9. {pysentry_rs-0.1.3.dist-info → pysentry_rs-0.1.5.dist-info}/entry_points.txt +0 -0
  10. {pysentry_rs-0.1.3.dist-info → pysentry_rs-0.1.5.dist-info}/licenses/LICENSE +0 -0
pysentry/__init__.py CHANGED
@@ -1,9 +1,15 @@
1
1
  """pysentry: Security vulnerability auditing tool for Python packages."""
2
2
 
3
- from ._internal import audit_python, audit_with_options
3
+ from ._internal import audit_python, audit_with_options, check_resolvers, check_version
4
4
 
5
- __version__ = "0.1.3"
6
- __all__ = ["audit_python", "audit_with_options", "main"]
5
+ __version__ = "0.1.5"
6
+ __all__ = [
7
+ "audit_python",
8
+ "audit_with_options",
9
+ "check_resolvers",
10
+ "check_version",
11
+ "main",
12
+ ]
7
13
 
8
14
 
9
15
  def main():
@@ -11,46 +17,147 @@ def main():
11
17
  import sys
12
18
  import argparse
13
19
 
20
+ # Handle the case where first argument is 'resolvers'
21
+ if len(sys.argv) > 1 and sys.argv[1] == "resolvers":
22
+ # Parse resolvers subcommand
23
+ parser = argparse.ArgumentParser(
24
+ prog="pysentry-rs resolvers",
25
+ description="Check available dependency resolvers",
26
+ )
27
+ parser.add_argument(
28
+ "--verbose", "-v", action="store_true", help="Enable verbose output"
29
+ )
30
+
31
+ # Remove 'resolvers' from args and parse the rest
32
+ args = parser.parse_args(sys.argv[2:])
33
+
34
+ try:
35
+ result = check_resolvers(args.verbose)
36
+ print(result)
37
+ except Exception as e:
38
+ print(f"Error: {e}", file=sys.stderr)
39
+ sys.exit(1)
40
+ return
41
+
42
+ # Handle the case where first argument is 'check-version'
43
+ if len(sys.argv) > 1 and sys.argv[1] == "check-version":
44
+ # Parse check-version subcommand
45
+ parser = argparse.ArgumentParser(
46
+ prog="pysentry-rs check-version",
47
+ description="Check if a newer version is available",
48
+ )
49
+ parser.add_argument(
50
+ "--verbose", "-v", action="store_true", help="Enable verbose output"
51
+ )
52
+
53
+ # Remove 'check-version' from args and parse the rest
54
+ args = parser.parse_args(sys.argv[2:])
55
+
56
+ try:
57
+ result = check_version(args.verbose)
58
+ print(result)
59
+ except Exception as e:
60
+ print(f"Error: {e}", file=sys.stderr)
61
+ sys.exit(1)
62
+ return
63
+
64
+ # Default audit command parser
14
65
  parser = argparse.ArgumentParser(
15
- prog="pysentry-rs", description="Audit Python packages for vulnerabilities"
66
+ prog="pysentry-rs",
67
+ description="Security vulnerability auditing for Python packages",
68
+ )
69
+
70
+ parser.add_argument(
71
+ "path",
72
+ nargs="?",
73
+ default=".",
74
+ help="Path to the project directory to audit (default: current directory)",
16
75
  )
17
- parser.add_argument("path", help="Path to Python project")
18
76
  parser.add_argument(
19
77
  "--format",
20
78
  choices=["human", "json", "sarif"],
21
79
  default="human",
22
- help="Output format",
80
+ help="Output format (default: human)",
23
81
  )
24
82
  parser.add_argument(
25
- "--source",
26
- choices=["pypa", "pypi", "osv"],
27
- default="pypa",
28
- help="Vulnerability data source",
29
- )
30
- parser.add_argument(
31
- "--min-severity",
83
+ "--severity",
32
84
  choices=["low", "medium", "high", "critical"],
33
85
  default="low",
34
- help="Minimum severity level",
86
+ help="Minimum severity level to report (default: low)",
35
87
  )
36
88
  parser.add_argument(
37
89
  "--ignore",
38
90
  action="append",
39
91
  dest="ignore_ids",
40
- help="Vulnerability IDs to ignore (can be used multiple times)",
92
+ metavar="ID",
93
+ help="Vulnerability IDs to ignore (can be specified multiple times)",
94
+ )
95
+ parser.add_argument(
96
+ "--output", "-o", metavar="FILE", help="Output file path (defaults to stdout)"
97
+ )
98
+ parser.add_argument(
99
+ "--dev", action="store_true", help="Include development dependencies"
100
+ )
101
+ parser.add_argument(
102
+ "--optional", action="store_true", help="Include optional dependencies"
103
+ )
104
+ parser.add_argument(
105
+ "--direct-only",
106
+ action="store_true",
107
+ help="Only check direct dependencies (exclude transitive)",
108
+ )
109
+ parser.add_argument("--no-cache", action="store_true", help="Disable caching")
110
+ parser.add_argument("--cache-dir", metavar="DIR", help="Custom cache directory")
111
+ parser.add_argument(
112
+ "--source",
113
+ choices=["pypa", "pypi", "osv"],
114
+ default="pypa",
115
+ help="Vulnerability data source (default: pypa)",
116
+ )
117
+ parser.add_argument(
118
+ "--resolver",
119
+ choices=["uv", "pip-tools"],
120
+ default="uv",
121
+ help="Dependency resolver for requirements.txt files (default: uv)",
122
+ )
123
+ parser.add_argument(
124
+ "--requirements-files",
125
+ nargs="+",
126
+ metavar="FILE",
127
+ help="Specific requirements files to audit (disables auto-discovery)",
128
+ )
129
+ parser.add_argument(
130
+ "--verbose", "-v", action="store_true", help="Enable verbose output"
131
+ )
132
+ parser.add_argument(
133
+ "--quiet", "-q", action="store_true", help="Suppress non-error output"
41
134
  )
42
135
 
43
136
  args = parser.parse_args()
44
137
 
45
138
  try:
46
- if args.source != "pypa" or args.min_severity != "low" or args.ignore_ids:
47
- result = audit_with_options(
48
- args.path, args.format, args.source, args.min_severity, args.ignore_ids
49
- )
50
- else:
51
- result = audit_python(args.path, args.format)
52
-
53
- print(result)
139
+ # Main audit functionality
140
+ result = audit_with_options(
141
+ path=args.path,
142
+ format=args.format,
143
+ source=args.source,
144
+ min_severity=args.severity,
145
+ ignore_ids=args.ignore_ids,
146
+ output=args.output,
147
+ dev=args.dev,
148
+ optional=args.optional,
149
+ direct_only=args.direct_only,
150
+ no_cache=args.no_cache,
151
+ cache_dir=args.cache_dir,
152
+ resolver=args.resolver,
153
+ requirements_files=args.requirements_files,
154
+ verbose=args.verbose,
155
+ quiet=args.quiet,
156
+ )
157
+
158
+ if not args.output:
159
+ print(result)
160
+
54
161
  except Exception as e:
55
162
  print(f"Error: {e}", file=sys.stderr)
56
163
  sys.exit(1)
pysentry/__main__.py CHANGED
@@ -3,4 +3,4 @@
3
3
  from . import main
4
4
 
5
5
  if __name__ == "__main__":
6
- main()
6
+ main()
pysentry/_internal.cpython-310-darwin.so CHANGED
Binary file
pysentry_rs-0.1.5.dist-info/METADATA ADDED
@@ -0,0 +1,546 @@
1
+ Metadata-Version: 2.4
2
+ Name: pysentry-rs
3
+ Version: 0.1.5
4
+ Classifier: Development Status :: 4 - Beta
5
+ Classifier: Intended Audience :: Developers
6
+ Classifier: License :: OSI Approved :: GNU General Public License v3 (GPLv3)
7
+ Classifier: Programming Language :: Rust
8
+ Classifier: Programming Language :: Python :: Implementation :: CPython
9
+ Classifier: Programming Language :: Python :: 3.8
10
+ Classifier: Programming Language :: Python :: 3.9
11
+ Classifier: Programming Language :: Python :: 3.10
12
+ Classifier: Programming Language :: Python :: 3.11
13
+ Classifier: Programming Language :: Python :: 3.12
14
+ Classifier: Programming Language :: Python :: 3.13
15
+ Classifier: Topic :: Security
16
+ Classifier: Topic :: Software Development :: Libraries :: Python Modules
17
+ License-File: LICENSE
18
+ Summary: Security vulnerability auditing tool for Python packages
19
+ Author-email: nyudenkov <nyudenkov@pm.me>
20
+ License: GPL-3.0
21
+ Requires-Python: >=3.8
22
+ Description-Content-Type: text/markdown; charset=UTF-8; variant=GFM
23
+ Project-URL: Homepage, https://github.com/nyudenkov/pysentry
24
+ Project-URL: Repository, https://github.com/nyudenkov/pysentry
25
+ Project-URL: Issues, https://github.com/nyudenkov/pysentry/issues
26
+
27
+ # 🐍 PySentry
28
+
29
+ [Help to test and improve](https://github.com/nyudenkov/pysentry/issues/12)
30
+
31
+ A fast, reliable security vulnerability scanner for Python projects, written in Rust.
32
+
33
+ ## Overview
34
+
35
+ PySentry audits Python projects for known security vulnerabilities by analyzing dependency files (`uv.lock`, `pyproject.toml`, `requirements.txt`) and cross-referencing them against multiple vulnerability databases. It provides comprehensive reporting with support for various output formats and filtering options.
36
+
37
+ ## Key Features
38
+
39
+ - **Multiple Project Formats**: Supports `uv.lock`, `pyproject.toml`, and `requirements.txt` files
40
+ - **External Resolver Integration**: Leverages `uv` and `pip-tools` for accurate requirements.txt constraint solving
41
+ - **Multiple Data Sources**:
42
+ - PyPA Advisory Database (default)
43
+ - PyPI JSON API
44
+ - OSV.dev (Open Source Vulnerabilities)
45
+ - **Flexible Output**: Human-readable, JSON, and SARIF formats
46
+ - **Performance Focused**:
47
+ - Written in Rust for speed
48
+ - Async/concurrent processing
49
+ - Intelligent caching system
50
+ - **Comprehensive Filtering**:
51
+ - Severity levels (low, medium, high, critical)
52
+ - Dependency types (production, development, optional)
53
+ - Direct vs. transitive dependencies
54
+ - **Enterprise Ready**: SARIF output for IDE/CI integration
55
+
56
+ ## Installation
57
+
58
+ Choose the installation method that works best for you:
59
+
60
+ ### ⚡ Via uvx (Recommended for occasional use)
61
+
62
+ Run directly without installing (requires [uv](https://docs.astral.sh/uv/)):
63
+
64
+ ```bash
65
+ uvx pysentry-rs /path/to/project
66
+ ```
67
+
68
+ This method:
69
+
70
+ - Runs the latest version without installation
71
+ - Automatically manages Python environment
72
+ - Perfect for CI/CD or occasional security audits
73
+ - No need to manage package versions or updates
74
+
75
+ ### 📦 From PyPI (Python Package)
76
+
77
+ For Python 3.8+ on Linux and macOS:
78
+
79
+ ```bash
80
+ pip install pysentry-rs
81
+ ```
82
+
83
+ Then use it with Python:
84
+
85
+ ```bash
86
+ python -m pysentry /path/to/project
87
+ # or directly if scripts are in PATH
88
+ pysentry-rs /path/to/project
89
+ ```
90
+
91
+ ### ⚡ From Crates.io (Rust Package)
92
+
93
+ If you have Rust installed:
94
+
95
+ ```bash
96
+ cargo install pysentry
97
+ ```
98
+
99
+ ### 💾 From GitHub Releases (Pre-built Binaries)
100
+
101
+ Download the latest release for your platform:
102
+
103
+ - **Linux x64**: `pysentry-linux-x64.tar.gz`
104
+ - **Linux x64 (musl)**: `pysentry-linux-x64-musl.tar.gz`
105
+ - **Linux ARM64**: `pysentry-linux-arm64.tar.gz`
106
+ - **macOS x64**: `pysentry-macos-x64.tar.gz`
107
+ - **macOS ARM64**: `pysentry-macos-arm64.tar.gz`
108
+ - **Windows x64**: `pysentry-windows-x64.zip`
109
+
110
+ ```bash
111
+ # Example for Linux x64
112
+ curl -L https://github.com/nyudenkov/pysentry/releases/latest/download/pysentry-linux-x64.tar.gz | tar -xz
113
+ ./pysentry-linux-x64/pysentry --help
114
+ ```
115
+
116
+ ### 🔧 From Source
117
+
118
+ ```bash
119
+ git clone https://github.com/nyudenkov/pysentry
120
+ cd pysentry
121
+ cargo build --release
122
+ ```
123
+
124
+ The binary will be available at `target/release/pysentry`.
125
+
126
+ ### Requirements
127
+
128
+ - **For uvx**: Python 3.8+ and [uv](https://docs.astral.sh/uv/) installed (Linux/macOS only)
129
+ - **For binaries**: No additional dependencies
130
+ - **For Python package**: Python 3.8+ (Linux/macOS only)
131
+ - **For Rust package and source**: Rust 1.79+
132
+
133
+ ### Platform Support
134
+
135
+ | Installation Method | Linux | macOS | Windows |
136
+ | ------------------- | ----- | ----- | ------- |
137
+ | uvx | ✅ | ✅ | ❌ |
138
+ | PyPI (pip) | ✅ | ✅ | ❌ |
139
+ | Crates.io (cargo) | ✅ | ✅ | ✅ |
140
+ | GitHub Releases | ✅ | ✅ | ✅ |
141
+ | From Source | ✅ | ✅ | ✅ |
142
+
143
+ **Note**: Windows Python wheels are not available due to compilation complexity. Windows users should use the pre-built binary from GitHub releases, install via cargo and build from source.
144
+
145
+ ### CLI Command Names
146
+
147
+ - **Rust binary**: `pysentry` (when installed via cargo or binary releases)
148
+ - **Python package**: `pysentry-rs` (when installed via pip or uvx)
149
+
150
+ Both variants support identical functionality. The resolver tools (`uv`, `pip-tools`) must be available in your current environment regardless of which PySentry variant you use.
151
+
152
+ ### Requirements.txt Support Prerequisites
153
+
154
+ To scan `requirements.txt` files, PySentry requires an external dependency resolver to convert version constraints (e.g., `flask>=2.0,<3.0`) into exact versions for vulnerability scanning.
155
+
156
+ **Install a supported resolver:**
157
+
158
+ ```bash
159
+ # uv (recommended - fastest, Rust-based)
160
+ pip install uv
161
+
162
+ # pip-tools (widely compatible, Python-based)
163
+ pip install pip-tools
164
+ ```
165
+
166
+ **Environment Requirements:**
167
+
168
+ - Resolvers must be available in your current environment
169
+ - If using virtual environments, activate your venv before running PySentry:
170
+ ```bash
171
+ source venv/bin/activate # Linux/macOS
172
+ venv\Scripts\activate # Windows
173
+ pysentry /path/to/project
174
+ ```
175
+ - Alternatively, install resolvers globally for system-wide availability
176
+
177
+ **Auto-detection:** PySentry automatically detects and prefers: `uv` > `pip-tools`. Without a resolver, only `uv.lock` and `pyproject.toml` files can be scanned.
178
+
179
+ ## Quick Start
180
+
181
+ ### Basic Usage
182
+
183
+ ```bash
184
+ # Using uvx (recommended for occasional use)
185
+ uvx pysentry-rs
186
+ uvx pysentry-rs /path/to/python/project
187
+
188
+ # Using installed binary
189
+ pysentry
190
+ pysentry /path/to/python/project
191
+
192
+ # Scan requirements.txt (auto-detects resolver)
193
+ pysentry /path/to/project
194
+
195
+ # Force specific resolver
196
+ pysentry --resolver uv /path/to/project
197
+ pysentry --resolver pip-tools /path/to/project
198
+
199
+ # Include development dependencies
200
+ pysentry --dev
201
+
202
+ # Filter by severity (only show high and critical)
203
+ pysentry --severity high
204
+
205
+ # Output to JSON file
206
+ pysentry --format json --output audit-results.json
207
+ ```
208
+
209
+ ### Advanced Usage
210
+
211
+ ```bash
212
+ # Using uvx for comprehensive audit
213
+ uvx pysentry-rs --dev --optional --format sarif --output security-report.sarif
214
+
215
+ # Check only direct dependencies using OSV database
216
+ uvx pysentry-rs --direct-only --source osv
217
+
218
+ # Or with installed binary
219
+ pysentry --dev --optional --format sarif --output security-report.sarif
220
+ pysentry --direct-only --source osv
221
+
222
+ # Ignore specific vulnerabilities
223
+ pysentry --ignore CVE-2023-12345 --ignore GHSA-xxxx-yyyy-zzzz
224
+
225
+ # Disable caching for CI environments
226
+ pysentry --no-cache
227
+
228
+ # Verbose output for debugging
229
+ pysentry --verbose
230
+ ```
231
+
232
+ ### Advanced Requirements.txt Usage
233
+
234
+ ```bash
235
+ # Scan multiple requirements files
236
+ pysentry --requirements requirements.txt --requirements requirements-dev.txt
237
+
238
+ # Check only direct dependencies from requirements.txt
239
+ pysentry --direct-only --resolver uv
240
+
241
+ # Ensure resolver is available in your environment
242
+ source venv/bin/activate # Activate your virtual environment first
243
+ pysentry /path/to/project
244
+
245
+ # Debug requirements.txt resolution
246
+ pysentry --verbose --resolver uv /path/to/project
247
+ ```
248
+
249
+ ## Configuration
250
+
251
+ ### Command Line Options
252
+
253
+ | Option | Description | Default |
254
+ | ---------------- | ----------------------------------------------------- | ------------------- |
255
+ | `--format` | Output format: `human`, `json`, `sarif` | `human` |
256
+ | `--severity` | Minimum severity: `low`, `medium`, `high`, `critical` | `low` |
257
+ | `--source` | Vulnerability source: `pypa`, `pypi`, `osv` | `pypa` |
258
+ | `--dev` | Include development dependencies | `false` |
259
+ | `--optional` | Include optional dependencies | `false` |
260
+ | `--direct-only` | Check only direct dependencies | `false` |
261
+ | `--ignore` | Vulnerability IDs to ignore (repeatable) | `[]` |
262
+ | `--output` | Output file path | `stdout` |
263
+ | `--no-cache` | Disable caching | `false` |
264
+ | `--cache-dir` | Custom cache directory | `~/.cache/pysentry` |
265
+ | `--verbose` | Enable verbose output | `false` |
266
+ | `--quiet` | Suppress non-error output | `false` |
267
+ | `--resolver` | Dependency resolver: `auto`, `uv`, `pip-tools` | `auto` |
268
+ | `--requirements` | Additional requirements files (repeatable) | `[]` |
269
+
270
+ ### Cache Management
271
+
272
+ PySentry uses an intelligent caching system to avoid redundant API calls:
273
+
274
+ - **Default Location**: `~/.cache/pysentry/` (or system temp directory)
275
+ - **TTL-based Expiration**: Separate expiration for each vulnerability source
276
+ - **Atomic Updates**: Prevents cache corruption during concurrent access
277
+ - **Custom Location**: Use `--cache-dir` to specify alternative location
278
+
279
+ To clear the cache:
280
+
281
+ ```bash
282
+ rm -rf ~/.cache/pysentry/
283
+ ```
284
+
285
+ ## Supported Project Formats
286
+
287
+ ### uv.lock Files (Recommended)
288
+
289
+ PySentry has support for `uv.lock` files:
290
+
291
+ - Exact version resolution
292
+ - Complete dependency graph analysis
293
+ - Source tracking
294
+ - Dependency classification (main, dev, optional) including transitive dependencies
295
+
296
+ ### requirements.txt Files (External Resolution)
297
+
298
+ Advanced support for `requirements.txt` files using external dependency resolvers:
299
+
300
+ **Key Features:**
301
+
302
+ - **Dependencies Resolution**: Converts version constraints (e.g., `flask>=2.0,<3.0`) to exact versions using mature external tools
303
+ - **Multiple Resolver Support**:
304
+ - **uv**: Rust-based resolver, extremely fast and reliable (recommended)
305
+ - **pip-tools**: Python-based resolver using `pip-compile`, widely compatible
306
+ - **Auto-detection**: Automatically detects and uses the best available resolver in your environment
307
+ - **Multiple File Support**: Combines `requirements.txt`, `requirements-dev.txt`, `requirements-test.txt`, etc.
308
+ - **Dependency Classification**: Distinguishes between direct and transitive dependencies
309
+ - **Isolated Execution**: Resolvers run in temporary directories to prevent project pollution
310
+ - **Complex Constraint Handling**: Supports version ranges, extras, environment markers, and conflict resolution
311
+
312
+ **Resolution Workflow:**
313
+
314
+ 1. Detects `requirements.txt` files in your project
315
+ 2. Auto-detects available resolver (`uv` or `pip-tools`) in current environment
316
+ 3. Resolves version constraints to exact dependency versions
317
+ 4. Scans resolved dependencies for vulnerabilities
318
+ 5. Reports findings with direct vs. transitive classification
319
+
320
+ **Environment Setup:**
321
+
322
+ ```bash
323
+ # Ensure resolver is available in your environment
324
+ source venv/bin/activate # Activate virtual environment
325
+ pip install uv # Install preferred resolver
326
+ pysentry /path/to/project # Run security scan
327
+ ```
328
+
329
+ ### pyproject.toml Files (External Resolution)
330
+
331
+ Support for projects without lock files:
332
+
333
+ - Parses version constraints from `pyproject.toml`
334
+ - **Resolver Required**: Like requirements.txt, needs external resolvers (`uv` or `pip-tools`) to convert version constraints to exact versions for accurate vulnerability scanning
335
+ - Limited dependency graph information compared to lock files
336
+ - Works with both Poetry and PEP 621 formats
337
+
338
+ ## Vulnerability Data Sources
339
+
340
+ ### PyPA Advisory Database (Default)
341
+
342
+ - Comprehensive coverage of Python ecosystem
343
+ - Community-maintained vulnerability database
344
+ - Regular updates from security researchers
345
+
346
+ ### PyPI JSON API
347
+
348
+ - Official PyPI vulnerability data
349
+ - Real-time information
350
+ - Limited to packages hosted on PyPI
351
+
352
+ ### OSV.dev
353
+
354
+ - Cross-ecosystem vulnerability database
355
+ - Google-maintained infrastructure
356
+
357
+ ## Output Formats
358
+
359
+ ### Human-Readable (Default)
360
+
361
+ Most comfortable to read.
362
+
363
+ ### JSON
364
+
365
+ ```json
366
+ {
367
+ "summary": {
368
+ "total_dependencies": 245,
369
+ "vulnerable_packages": 2,
370
+ "total_vulnerabilities": 3,
371
+ "by_severity": {
372
+ "critical": 1,
373
+ "high": 1,
374
+ "medium": 1,
375
+ "low": 0
376
+ }
377
+ },
378
+ "vulnerabilities": [...]
379
+ }
380
+ ```
381
+
382
+ ### SARIF (Static Analysis Results Interchange Format)
383
+
384
+ Compatible with GitHub Security tab, VS Code, and other security tools.
385
+
386
+ ## Performance
387
+
388
+ PySentry is designed for speed and efficiency:
389
+
390
+ - **Concurrent Processing**: Vulnerability data fetched in parallel
391
+ - **Smart Caching**: Reduces API calls and parsing overhead
392
+ - **Efficient Matching**: In-memory indexing for fast vulnerability lookups
393
+ - **Streaming**: Large databases processed without excessive memory usage
394
+
395
+ ### Requirements.txt Resolution Performance
396
+
397
+ PySentry leverages external resolvers for optimal performance:
398
+
399
+ - **uv resolver**: 2-10x faster than pip-tools, handles large dependency trees efficiently
400
+ - **pip-tools resolver**: Reliable fallback, slower but widely compatible
401
+ - **Isolated execution**: Prevents project pollution while maintaining security
402
+
403
+ ### Benchmarks
404
+
405
+ Typical performance on a project with 100+ dependencies:
406
+
407
+ - **Cold cache**: 15-30 seconds
408
+ - **Warm cache**: 2-5 seconds
409
+ - **Memory usage**: ~50MB peak
410
+
411
+ ## Development
412
+
413
+ ### Building from Source
414
+
415
+ ```bash
416
+ git clone https://github.com/nyudenkov/pysentry
417
+ cd pysentry
418
+ cargo build --release
419
+ ```
420
+
421
+ ### Running Tests
422
+
423
+ ```bash
424
+ cargo test
425
+ ```
426
+
427
+ ### Project Structure
428
+
429
+ ```
430
+ src/
431
+ ├── main.rs # CLI interface
432
+ ├── lib.rs # Library API
433
+ ├── cache/ # Caching system
434
+ ├── dependency/ # Dependency scanning
435
+ ├── output/ # Report generation
436
+ ├── parsers/ # Project file parsers
437
+ ├── providers/ # Vulnerability data sources
438
+ ├── types.rs # Core type definitions
439
+ └── vulnerability/ # Vulnerability matching
440
+ ```
441
+
442
+ ## Troubleshooting
443
+
444
+ ### Common Issues
445
+
446
+ **Error: "No lock file or pyproject.toml found"**
447
+
448
+ ```bash
449
+ # Ensure you're in a Python project directory
450
+ ls pyproject.toml uv.lock requirements.txt
451
+
452
+ # Or specify the path explicitly
453
+ pysentry /path/to/python/project
454
+ ```
455
+
456
+ **Error: "No dependency resolver found" or "uv resolver not available"**
457
+
458
+ ```bash
459
+ # Install a supported resolver in your environment
460
+ pip install uv # Recommended - fastest
461
+ pip install pip-tools # Alternative
462
+
463
+ # Verify resolver is available
464
+ uv --version
465
+ pip-compile --version
466
+
467
+ # If using virtual environments, ensure resolver is installed there
468
+ source venv/bin/activate
469
+ pip install uv
470
+ pysentry /path/to/project
471
+ ```
472
+
473
+ **Error: "Failed to resolve requirements"**
474
+
475
+ ```bash
476
+ # Check your requirements.txt syntax
477
+ cat requirements.txt
478
+
479
+ # Try different resolver
480
+ pysentry --resolver pip-tools # if uv fails
481
+ pysentry --resolver uv # if pip-tools fails
482
+
483
+ # Ensure you're in correct environment
484
+ which python
485
+ which uv # or which pip-compile
486
+
487
+ # Debug with verbose output
488
+ pysentry --verbose /path/to/project
489
+ ```
490
+
491
+ **Error: "Failed to fetch vulnerability data"**
492
+
493
+ ```bash
494
+ # Check network connectivity
495
+ curl -I https://osv-vulnerabilities.storage.googleapis.com/
496
+
497
+ # Try with different source
498
+ pysentry --source pypi
499
+ ```
500
+
501
+ **Slow requirements.txt resolution**
502
+
503
+ ```bash
504
+ # Use faster uv resolver instead of pip-tools
505
+ pysentry --resolver uv
506
+
507
+ # Install uv for better performance (2-10x faster)
508
+ pip install uv
509
+
510
+ # Or use uvx for isolated execution
511
+ uvx pysentry-rs --resolver uv /path/to/project
512
+ ```
513
+
514
+ **Requirements.txt files not being detected**
515
+
516
+ ```bash
517
+ # Ensure requirements.txt exists
518
+ ls requirements.txt
519
+
520
+ # Specify path explicitly
521
+ pysentry /path/to/python/project
522
+
523
+ # Include additional requirements files
524
+ pysentry --requirements requirements-dev.txt --requirements requirements-test.txt
525
+
526
+ # Check if higher-priority files exist (they take precedence)
527
+ ls uv.lock pyproject.toml
528
+ ```
529
+
530
+ **Performance Issues**
531
+
532
+ ```bash
533
+ # Clear cache and retry
534
+ rm -rf ~/.cache/pysentry
535
+ pysentry
536
+
537
+ # Use verbose mode to identify bottlenecks
538
+ pysentry --verbose
539
+ ```
540
+
541
+ ## Acknowledgments
542
+
543
+ - Inspired by [pip-audit](https://github.com/pypa/pip-audit) and [uv #9189 issue](https://github.com/astral-sh/uv/issues/9189)
544
+ - Originally was a command for [uv](https://github.com/astral-sh/uv)
545
+ - Vulnerability data from [PyPA](https://github.com/pypa/advisory-database), [PyPI](https://pypi.org/), and [OSV.dev](https://osv.dev/)
546
+
pysentry_rs-0.1.5.dist-info/RECORD ADDED
@@ -0,0 +1,8 @@
1
+ pysentry/__init__.py,sha256=t1lvpozrRrRipRHMSTK28BcMgkCXJNhpGVwi0GkjY8c,5089
2
+ pysentry/__main__.py,sha256=FJdFFQuSE8TYsZtY_vb00oCE2nvq9hB6MhMLBxnn7Ns,117
3
+ pysentry/_internal.cpython-310-darwin.so,sha256=0ncph8C-n84AU6NhDR6bQ-ebdyrJDJGnXsSJ2wfc4rQ,6155776
4
+ pysentry_rs-0.1.5.dist-info/METADATA,sha256=VVt36MRhL3evoIIFKxL0Cw-TVNwyLQO_QMx0URpGGJc,17030
5
+ pysentry_rs-0.1.5.dist-info/WHEEL,sha256=XiGjjeJC2k7oCSYs1QNLi9iFDhofhstbUV6w7vMmp_k,104
6
+ pysentry_rs-0.1.5.dist-info/entry_points.txt,sha256=3bJguekVEbXTn-ceDCWJaSIZScquPPP1Ux9TPVHHanE,44
7
+ pysentry_rs-0.1.5.dist-info/licenses/LICENSE,sha256=TAMtDCoJuavXz7pCEklrzjH55sdvsy5gKsXY9NsImwY,34878
8
+ pysentry_rs-0.1.5.dist-info/RECORD,,
pysentry_rs-0.1.3.dist-info/METADATA DELETED
@@ -1,297 +0,0 @@
1
- Metadata-Version: 2.4
2
- Name: pysentry-rs
3
- Version: 0.1.3
4
- Classifier: Development Status :: 4 - Beta
5
- Classifier: Intended Audience :: Developers
6
- Classifier: License :: OSI Approved :: GNU General Public License v3 (GPLv3)
7
- Classifier: Programming Language :: Rust
8
- Classifier: Programming Language :: Python :: Implementation :: CPython
9
- Classifier: Programming Language :: Python :: 3.8
10
- Classifier: Programming Language :: Python :: 3.9
11
- Classifier: Programming Language :: Python :: 3.10
12
- Classifier: Programming Language :: Python :: 3.11
13
- Classifier: Programming Language :: Python :: 3.12
14
- Classifier: Topic :: Security
15
- Classifier: Topic :: Software Development :: Libraries :: Python Modules
16
- License-File: LICENSE
17
- Summary: Security vulnerability auditing tool for Python packages
18
- Author-email: nyudenkov <nyudenkov@pm.me>
19
- License: GPL-3.0
20
- Requires-Python: >=3.8
21
- Description-Content-Type: text/markdown; charset=UTF-8; variant=GFM
22
- Project-URL: Homepage, https://github.com/nyudenkov/pysentry
23
- Project-URL: Repository, https://github.com/nyudenkov/pysentry
24
- Project-URL: Issues, https://github.com/nyudenkov/pysentry/issues
25
-
26
- # 🐍 PySentry
27
-
28
- A fast, reliable security vulnerability scanner for Python projects, written in Rust.
29
-
30
- ## Overview
31
-
32
- PySentry audits Python projects for known security vulnerabilities by analyzing dependency files (`uv.lock`, `pyproject.toml`) and cross-referencing them against multiple vulnerability databases. It provides comprehensive reporting with support for various output formats and filtering options.
33
-
34
- ## Key Features
35
-
36
- - **Multiple Project Formats**: Supports both `uv.lock` files (with exact versions) and `pyproject.toml` files
37
- - **Multiple Data Sources**:
38
- - PyPA Advisory Database (default)
39
- - PyPI JSON API
40
- - OSV.dev (Open Source Vulnerabilities)
41
- - **Flexible Output**: Human-readable, JSON, and SARIF formats
42
- - **Performance Focused**:
43
- - Written in Rust for speed
44
- - Async/concurrent processing
45
- - Intelligent caching system
46
- - **Comprehensive Filtering**:
47
- - Severity levels (low, medium, high, critical)
48
- - Dependency types (production, development, optional)
49
- - Direct vs. transitive dependencies
50
- - **Enterprise Ready**: SARIF output for IDE/CI integration
51
-
52
- ## Installation
53
-
54
- ### From Source
55
-
56
- ```bash
57
- git clone https://github.com/nyudenkov/pysentry
58
- cd pysentry
59
- cargo build --release
60
- ```
61
-
62
- The binary will be available at `target/release/pysentry`.
63
-
64
- ### System Requirements
65
-
66
- - Rust 1.70+ (for building from source)
67
- - Internet connection (for vulnerability database updates)
68
-
69
- ## Quick Start
70
-
71
- ### Basic Usage
72
-
73
- ```bash
74
- # Audit current directory
75
- pysentry
76
-
77
- # Audit specific project
78
- pysentry /path/to/python/project
79
-
80
- # Include development dependencies
81
- pysentry --dev
82
-
83
- # Filter by severity (only show high and critical)
84
- pysentry --severity high
85
-
86
- # Output to JSON file
87
- pysentry --format json --output audit-results.json
88
- ```
89
-
90
- ### Advanced Usage
91
-
92
- ```bash
93
- # Comprehensive audit with all dependency types
94
- pysentry --dev --optional --format sarif --output security-report.sarif
95
-
96
- # Check only direct dependencies using OSV database
97
- pysentry --direct-only --source osv
98
-
99
- # Ignore specific vulnerabilities
100
- pysentry --ignore CVE-2023-12345 --ignore GHSA-xxxx-yyyy-zzzz
101
-
102
- # Disable caching for CI environments
103
- pysentry --no-cache
104
-
105
- # Verbose output for debugging
106
- pysentry --verbose
107
- ```
108
-
109
- ## Configuration
110
-
111
- ### Command Line Options
112
-
113
- | Option | Description | Default |
114
- | --------------- | ----------------------------------------------------- | ------------------- |
115
- | `--format` | Output format: `human`, `json`, `sarif` | `human` |
116
- | `--severity` | Minimum severity: `low`, `medium`, `high`, `critical` | `low` |
117
- | `--source` | Vulnerability source: `pypa`, `pypi`, `osv` | `pypa` |
118
- | `--dev` | Include development dependencies | `false` |
119
- | `--optional` | Include optional dependencies | `false` |
120
- | `--direct-only` | Check only direct dependencies | `false` |
121
- | `--ignore` | Vulnerability IDs to ignore (repeatable) | `[]` |
122
- | `--output` | Output file path | `stdout` |
123
- | `--no-cache` | Disable caching | `false` |
124
- | `--cache-dir` | Custom cache directory | `~/.cache/pysentry` |
125
- | `--verbose` | Enable verbose output | `false` |
126
- | `--quiet` | Suppress non-error output | `false` |
127
-
128
- ### Cache Management
129
-
130
- PySentry uses an intelligent caching system to avoid redundant API calls:
131
-
132
- - **Default Location**: `~/.cache/pysentry/` (or system temp directory)
133
- - **TTL-based Expiration**: Separate expiration for each vulnerability source
134
- - **Atomic Updates**: Prevents cache corruption during concurrent access
135
- - **Custom Location**: Use `--cache-dir` to specify alternative location
136
-
137
- To clear the cache:
138
-
139
- ```bash
140
- rm -rf ~/.cache/pysentry/
141
- ```
142
-
143
- ## Supported Project Formats
144
-
145
- ### uv.lock Files (Recommended)
146
-
147
- PySentry has support for `uv.lock` files, providing:
148
-
149
- - Exact version resolution
150
- - Complete dependency graph analysis
151
- - Source tracking
152
- - Dependency classification (main, dev, optional) including transitioning dependencies
153
-
154
- ### pyproject.toml Files
155
-
156
- Fallback support for projects without lock files:
157
-
158
- - Parses version constraints from `pyproject.toml`
159
- - Limited dependency graph information
160
-
161
- ## Vulnerability Data Sources
162
-
163
- ### PyPA Advisory Database (Default)
164
-
165
- - Comprehensive coverage of Python ecosystem
166
- - Community-maintained vulnerability database
167
- - Regular updates from security researchers
168
-
169
- ### PyPI JSON API
170
-
171
- - Official PyPI vulnerability data
172
- - Real-time information
173
- - Limited to packages hosted on PyPI
174
-
175
- ### OSV.dev
176
-
177
- - Cross-ecosystem vulnerability database
178
- - Google-maintained infrastructure
179
-
180
- ## Output Formats
181
-
182
- ### Human-Readable (Default)
183
-
184
- Most comfortable to read.
185
-
186
- ### JSON
187
-
188
- ```json
189
- {
190
- "summary": {
191
- "total_dependencies": 245,
192
- "vulnerable_packages": 2,
193
- "total_vulnerabilities": 3,
194
- "by_severity": {
195
- "critical": 1,
196
- "high": 1,
197
- "medium": 1,
198
- "low": 0
199
- }
200
- },
201
- "vulnerabilities": [...]
202
- }
203
- ```
204
-
205
- ### SARIF (Static Analysis Results Interchange Format)
206
-
207
- Compatible with GitHub Security tab, VS Code, and other security tools.
208
-
209
- ## Performance
210
-
211
- PySentry is designed for speed and efficiency:
212
-
213
- - **Concurrent Processing**: Vulnerability data fetched in parallel
214
- - **Smart Caching**: Reduces API calls and parsing overhead
215
- - **Efficient Matching**: In-memory indexing for fast vulnerability lookups
216
- - **Streaming**: Large databases processed without excessive memory usage
217
-
218
- ### Benchmarks
219
-
220
- Typical performance on a project with 100+ dependencies:
221
-
222
- - **Cold cache**: 15-30 seconds
223
- - **Warm cache**: 2-5 seconds
224
- - **Memory usage**: ~50MB peak
225
-
226
- ## Development
227
-
228
- ### Building from Source
229
-
230
- ```bash
231
- git clone https://github.com/nyudenkov/pysentry
232
- cd pysentry
233
- cargo build --release
234
- ```
235
-
236
- ### Running Tests
237
-
238
- ```bash
239
- cargo test
240
- ```
241
-
242
- ### Project Structure
243
-
244
- ```
245
- src/
246
- ├── main.rs # CLI interface
247
- ├── lib.rs # Library API
248
- ├── cache/ # Caching system
249
- ├── dependency/ # Dependency scanning
250
- ├── output/ # Report generation
251
- ├── parsers/ # Project file parsers
252
- ├── providers/ # Vulnerability data sources
253
- ├── types.rs # Core type definitions
254
- └── vulnerability/ # Vulnerability matching
255
- ```
256
-
257
- ## Troubleshooting
258
-
259
- ### Common Issues
260
-
261
- **Error: "No lock file or pyproject.toml found"**
262
-
263
- ```bash
264
- # Ensure you're in a Python project directory
265
- ls pyproject.toml uv.lock
266
-
267
- # Or specify the path explicitly
268
- pysentry /path/to/python/project
269
- ```
270
-
271
- **Error: "Failed to fetch vulnerability data"**
272
-
273
- ```bash
274
- # Check network connectivity
275
- curl -I https://osv-vulnerabilities.storage.googleapis.com/
276
-
277
- # Try with different source
278
- pysentry --source pypi
279
- ```
280
-
281
- **Performance Issues**
282
-
283
- ```bash
284
- # Clear cache and retry
285
- rm -rf ~/.cache/pysentry
286
- pysentry
287
-
288
- # Use verbose mode to identify bottlenecks
289
- pysentry --verbose
290
- ```
291
-
292
- ## Acknowledgments
293
-
294
- - Inspired by [pip-audit](https://github.com/pypa/pip-audit) and [uv #9189 issue](https://github.com/astral-sh/uv/issues/9189)
295
- - Originally was a command for [uv](https://github.com/astral-sh/uv)
296
- - Vulnerability data from [PyPA](https://github.com/pypa/advisory-database), [PyPI](https://pypi.org/), and [OSV.dev](https://osv.dev/)
297
-
pysentry_rs-0.1.3.dist-info/RECORD DELETED
@@ -1,8 +0,0 @@
1
- pysentry/__init__.py,sha256=XweE7o45pHx2rmO523WkjFJFEjGDwwESMQtXQFZ2d6k,1633
2
- pysentry/__main__.py,sha256=yzx36hW8FIWKDCOkP409c8wIXnK-A5tIRMw86eueJ_Q,116
3
- pysentry/_internal.cpython-310-darwin.so,sha256=rRXuTQizg_0CTMKtZQovhOIUEMyW_J3oC1Re7-xdxhk,5695376
4
- pysentry_rs-0.1.3.dist-info/METADATA,sha256=Wpgd9n5P8ZJa8jO_0Ry9O1eiUF1-pJDplZndnc5SHg4,8644
5
- pysentry_rs-0.1.3.dist-info/WHEEL,sha256=XiGjjeJC2k7oCSYs1QNLi9iFDhofhstbUV6w7vMmp_k,104
6
- pysentry_rs-0.1.3.dist-info/entry_points.txt,sha256=3bJguekVEbXTn-ceDCWJaSIZScquPPP1Ux9TPVHHanE,44
7
- pysentry_rs-0.1.3.dist-info/licenses/LICENSE,sha256=TAMtDCoJuavXz7pCEklrzjH55sdvsy5gKsXY9NsImwY,34878
8
- pysentry_rs-0.1.3.dist-info/RECORD,,