Skip to content

Commit c4a4a5f

Browse files
nikpivkinnikpivkin
authored
feat(python): add support for uv (#8080)
Signed-off-by: nikpivkin <[email protected]>
1 parent 49f3540 commit c4a4a5f

File tree

21 files changed

+1170
-2
lines changed

21 files changed

+1170
-2
lines changed

‎docs/docs/configuration/reporting.md

+2
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,7 @@ The following languages are currently supported:
5858
| | [yarn.lock][yarn-lock] |
5959
| .NET | [packages.lock.json][dotnet-packages-lock] |
6060
| Python | [poetry.lock][poetry-lock] |
61+
| | [uv.lock][uv-lock] |
6162
| Ruby | [Gemfile.lock][gemfile-lock] |
6263
| Rust | [cargo-auditable binaries][cargo-binaries] |
6364
| Go | [go.mod][go-mod] |
@@ -449,6 +450,7 @@ $ trivy convert --format table --severity CRITICAL result.json
449450
[yarn-lock]: ../coverage/language/nodejs.md#yarn
450451
[dotnet-packages-lock]: ../coverage/language/dotnet.md#packageslockjson
451452
[poetry-lock]: ../coverage/language/python.md#poetry
453+
[uv-lock]: ../coverage/language/python.md#uv
452454
[gemfile-lock]: ../coverage/language/ruby.md#bundler
453455
[go-mod]: ../coverage/language/golang.md#go-module
454456
[composer-lock]: ../coverage/language/php.md#composerlock

‎docs/docs/coverage/language/index.md

+1
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ On the other hand, when the target is a post-build artifact, like a container im
2222
| | gemspec | ✅ | ✅ | - | - |
2323
| [Python](python.md) | Pipfile.lock | - | - | ✅ | ✅ |
2424
| | poetry.lock | - | - | ✅ | ✅ |
25+
| | uv.lock | - | - | ✅ | ✅ |
2526
| | requirements.txt | - | - | ✅ | ✅ |
2627
| | egg package[^1] | ✅ | ✅ | - | - |
2728
| | wheel package[^2] | ✅ | ✅ | - | - |

‎docs/docs/coverage/language/python.md

+7
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ The following scanners are supported for package managers.
88
| pip | ✓ | ✓ | ✓ |
99
| Pipenv | ✓ | ✓ | - |
1010
| Poetry | ✓ | ✓ | - |
11+
| uv | ✓ | ✓ | - |
1112

1213
In addition, Trivy supports three formats of Python packages: `egg`, `wheel` and `conda`.
1314
The following scanners are supported for Python packages.
@@ -26,6 +27,7 @@ The following table provides an outline of the features Trivy offers.
2627
| pip | requirements.txt | - | Include | - | ✓ | ✓ |
2728
| Pipenv | Pipfile.lock | ✓ | Include | - | ✓ | Not needed |
2829
| Poetry | poetry.lock | ✓ | Exclude | ✓ | - | Not needed |
30+
| uv | uv.lock | ✓ | Exclude | ✓ | - | Not needed |
2931

3032

3133
| Packaging | Dependency graph |
@@ -126,6 +128,11 @@ To build the correct dependency graph, `pyproject.toml` also needs to be present
126128

127129
License detection is not supported for `Poetry`.
128130

131+
### uv
132+
Trivy uses `uv.lock` to identify dependencies and find vulnerabilities.
133+
134+
License detection is not supported for `uv`.
135+
129136
## Packaging
130137
Trivy parses the manifest files of installed packages in container image scanning and so on.
131138
See [here](https://packaging.python.org/en/latest/discussions/package-formats/) for the detail.

‎integration/repo_test.go

+9
Original file line numberDiff line numberDiff line change
@@ -159,6 +159,15 @@ func TestRepository(t *testing.T) {
159159
},
160160
golden: "testdata/poetry.json.golden",
161161
},
162+
{
163+
name: "uv",
164+
args: args{
165+
scanner: types.VulnerabilityScanner,
166+
listAllPkgs: true,
167+
input: "testdata/fixtures/repo/uv",
168+
},
169+
golden: "testdata/uv.json.golden",
170+
},
162171
{
163172
name: "pom",
164173
args: args{

‎integration/testdata/fixtures/repo/uv/uv.lock

+51
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎integration/testdata/uv.json.golden

+195
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,195 @@
1+
{
2+
"SchemaVersion": 2,
3+
"CreatedAt": "2021-08-25T12:20:30.000000005Z",
4+
"ArtifactName": "testdata/fixtures/repo/uv",
5+
"ArtifactType": "repository",
6+
"Metadata": {
7+
"ImageConfig": {
8+
"architecture": "",
9+
"created": "0001-01-01T00:00:00Z",
10+
"os": "",
11+
"rootfs": {
12+
"type": "",
13+
"diff_ids": null
14+
},
15+
"config": {}
16+
}
17+
},
18+
"Results": [
19+
{
20+
"Target": "uv.lock",
21+
"Class": "lang-pkgs",
22+
"Type": "uv",
23+
"Packages": [
24+
{
25+
"ID": "[email protected]",
26+
"Name": "uv-test",
27+
"Identifier": {
28+
"PURL": "pkg:pypi/[email protected]",
29+
"UID": "d8b4e0c0129124ef"
30+
},
31+
"Version": "0.1.0",
32+
"Relationship": "root",
33+
"DependsOn": [
34+
"[email protected]",
35+
"[email protected]"
36+
],
37+
"Layer": {}
38+
},
39+
{
40+
"ID": "[email protected]",
41+
"Name": "click",
42+
"Identifier": {
43+
"PURL": "pkg:pypi/[email protected]",
44+
"UID": "76baa5f52f0c32da"
45+
},
46+
"Version": "8.1.3",
47+
"Relationship": "direct",
48+
"DependsOn": [
49+
"[email protected]"
50+
],
51+
"Layer": {}
52+
},
53+
{
54+
"ID": "[email protected]",
55+
"Name": "werkzeug",
56+
"Identifier": {
57+
"PURL": "pkg:pypi/[email protected]",
58+
"UID": "de1411a7bb678535"
59+
},
60+
"Version": "0.11.1",
61+
"Relationship": "direct",
62+
"Layer": {}
63+
},
64+
{
65+
"ID": "[email protected]",
66+
"Name": "colorama",
67+
"Identifier": {
68+
"PURL": "pkg:pypi/[email protected]",
69+
"UID": "49acc401742db23d"
70+
},
71+
"Version": "0.4.6",
72+
"Indirect": true,
73+
"Relationship": "indirect",
74+
"Layer": {}
75+
}
76+
],
77+
"Vulnerabilities": [
78+
{
79+
"VulnerabilityID": "CVE-2019-14806",
80+
"PkgID": "[email protected]",
81+
"PkgName": "werkzeug",
82+
"PkgIdentifier": {
83+
"PURL": "pkg:pypi/[email protected]",
84+
"UID": "de1411a7bb678535"
85+
},
86+
"InstalledVersion": "0.11.1",
87+
"FixedVersion": "0.15.3",
88+
"Status": "fixed",
89+
"Layer": {},
90+
"SeveritySource": "ghsa",
91+
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2019-14806",
92+
"DataSource": {
93+
"ID": "ghsa",
94+
"Name": "GitHub Security Advisory Pip",
95+
"URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
96+
},
97+
"Title": "python-werkzeug: insufficient debugger PIN randomness vulnerability",
98+
"Description": "Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.",
99+
"Severity": "HIGH",
100+
"CweIDs": [
101+
"CWE-331"
102+
],
103+
"VendorSeverity": {
104+
"ghsa": 3,
105+
"nvd": 3,
106+
"redhat": 2,
107+
"ubuntu": 1
108+
},
109+
"CVSS": {
110+
"nvd": {
111+
"V2Vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
112+
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
113+
"V2Score": 5,
114+
"V3Score": 7.5
115+
},
116+
"redhat": {
117+
"V3Vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
118+
"V3Score": 7.5
119+
}
120+
},
121+
"References": [
122+
"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00034.html",
123+
"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00047.html",
124+
"https://access.redhat.com/security/cve/CVE-2019-14806",
125+
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14806",
126+
"https://github.com/advisories/GHSA-gq9m-qvpx-68hc",
127+
"https://github.com/pallets/werkzeug/blob/7fef41b120327d3912fbe12fb64f1951496fcf3e/src/werkzeug/debug/__init__.py#L168",
128+
"https://github.com/pallets/werkzeug/commit/00bc43b1672e662e5e3b8cecd79e67fc968fa246",
129+
"https://nvd.nist.gov/vuln/detail/CVE-2019-14806",
130+
"https://palletsprojects.com/blog/werkzeug-0-15-3-released/",
131+
"https://ubuntu.com/security/notices/USN-4655-1"
132+
],
133+
"PublishedDate": "2019-08-09T15:15:00Z",
134+
"LastModifiedDate": "2019-09-11T00:15:00Z"
135+
},
136+
{
137+
"VulnerabilityID": "CVE-2020-28724",
138+
"PkgID": "[email protected]",
139+
"PkgName": "werkzeug",
140+
"PkgIdentifier": {
141+
"PURL": "pkg:pypi/[email protected]",
142+
"UID": "de1411a7bb678535"
143+
},
144+
"InstalledVersion": "0.11.1",
145+
"FixedVersion": "0.11.6",
146+
"Status": "fixed",
147+
"Layer": {},
148+
"SeveritySource": "ghsa",
149+
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2020-28724",
150+
"DataSource": {
151+
"ID": "ghsa",
152+
"Name": "GitHub Security Advisory Pip",
153+
"URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
154+
},
155+
"Title": "python-werkzeug: open redirect via double slash in the URL",
156+
"Description": "Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.",
157+
"Severity": "MEDIUM",
158+
"CweIDs": [
159+
"CWE-601"
160+
],
161+
"VendorSeverity": {
162+
"ghsa": 2,
163+
"nvd": 2,
164+
"redhat": 2,
165+
"ubuntu": 2
166+
},
167+
"CVSS": {
168+
"nvd": {
169+
"V2Vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
170+
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
171+
"V2Score": 5.8,
172+
"V3Score": 6.1
173+
},
174+
"redhat": {
175+
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
176+
"V3Score": 5.4
177+
}
178+
},
179+
"References": [
180+
"https://access.redhat.com/security/cve/CVE-2020-28724",
181+
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28724",
182+
"https://github.com/advisories/GHSA-3p3h-qghp-hvh2",
183+
"https://github.com/pallets/flask/issues/1639",
184+
"https://github.com/pallets/werkzeug/issues/822",
185+
"https://github.com/pallets/werkzeug/pull/890/files",
186+
"https://nvd.nist.gov/vuln/detail/CVE-2020-28724",
187+
"https://ubuntu.com/security/notices/USN-4655-1"
188+
],
189+
"PublishedDate": "2020-11-18T15:15:00Z",
190+
"LastModifiedDate": "2020-12-01T16:05:00Z"
191+
}
192+
]
193+
}
194+
]
195+
}

0 commit comments

Comments
 (0)