Adding auditing to pip [LWN.net]

Adding auditing to pip

Posted Aug 10, 2022 12:42 UTC (Wed) by LtWorf (subscriber, #124958)
Parent article: Adding auditing to pip

If i understand correctly it's basically doing the same thing as apt-listbugs, so calling "audit" is a bit of a confusing misnomer?

to post comments

Adding auditing to pip

Posted Aug 10, 2022 16:13 UTC (Wed) by adam820 (subscriber, #101353) [Link] (7 responses)

What else would you call it? If your environment is being audited (internally or externally), you typically want to see a listing of vulnerabilities in packages/libraries to know what your risk is and what can be (safely) patched.

Adding auditing to pip

Posted Aug 10, 2022 22:13 UTC (Wed) by iabervon (subscriber, #722) [Link] (2 responses)

I would tend to assume "audit" referred to tracking and recording code reviews and tests of the code, rather than only the problems that found. I'd also assume that auditing would include noticing that what you have that claims to be a particular version of Babel isn't what PyPI thinks is that version of Babel, which this clearly does not do. What it actually does is on the list of things I'd call "auditing", but it's like third.

Adding auditing to pip

Posted Aug 11, 2022 12:52 UTC (Thu) by Saphyel (guest, #160208) [Link] (1 responses)

I have to disagree that's your own term for it but elsewhere is called audit so make sense to call it audit
* https://php.watch/articles/composer-audit
* https://docs.npmjs.com/cli/v6/commands/npm-audit
* https://lib.rs/crates/cargo-audit

If you don't like standards you can always create your own alias so don't make it harder for the rest of the world.

Adding auditing to pip

Posted Aug 12, 2022 13:42 UTC (Fri) by patrakov (subscriber, #97174) [Link]

Also on Arch Linux, we have "arch-audit".

Adding auditing to pip

Posted Aug 11, 2022 9:52 UTC (Thu) by cortana (subscriber, #24596) [Link] (2 responses)

What other tools already exist doing this job in different spheres of package management?

* dnf updateinfo --list --security
* apt-listbugs

I'm not a fan of either of these...

Adding auditing to pip

Posted Aug 11, 2022 14:04 UTC (Thu) by dfc (subscriber, #87081) [Link]

I can't say enough about apt-listbugs. It has prevented me from running into problems that naturally come up running debian unstable. What distribution did you use apt-listbugs with?

Adding auditing to pip

Posted Aug 12, 2022 2:54 UTC (Fri) by pabs (subscriber, #43278) [Link]

apt-listbugs doesn't list available security updates, you want debsecan for that.

Naming is Hard: These Subpackages Have CVE's

Posted Aug 14, 2022 15:02 UTC (Sun) by k3ninho (subscriber, #50375) [Link]

First-up, naming is hard.

The action isn't an audit, like you say. It's "list CVE's in subpackages" so maybe we ask 'pip tell-me-CVEs'. Maybe it's "tell me the risk I'm exposed to" so we can call it 'pip risk-log'.

Other ecosystems don't describe (or prescribe) what you do with them information gleaned from their vulnerability databases. The workflow should be made plain for people new to vendoring-in huge codebases to make a system from other people's work: replace-and-upgrade, ignore-for-now, suggest mitigations, migrate-to-alternative and more. Reviewing some imported code is considered too time-consuming, but also the risk we all expose ourselves to makes it kinda 'too expensive to **not** review'.

K3n.