Skip to content

Support hashes in requirements.txt #243

@MarcelBochtler

Description

@MarcelBochtler

When analyzing a requirements.txt file that defines hashes for secure installs

addict==2.4.0 \
    --hash=sha256:249bb56bbfd3cdc2a004ea0ff4c2b6ddc84d53bc2194761636eb314d5cfa5dfc \
    --hash=sha256:b3b2210e0e067a281f5646c8c5db92e99b7231ea8b0eb5f74dbdf9e259d4e494

The Python-Inspector fails with this error:

❯ ~/Projects/oss/python-inspector/venv/bin/python-inspector --python-version 313 --operating-system linux --json-pdt ./inspector-result.json --analyze-setup-py-insecurely --requirement ./requirements.txt --verbose
Resolving dependencies...
Using netrc file /Users/bom1wa3/.netrc
direct_dependencies:
 DependentPackage(purl='pkg:pypi/[email protected]', extracted_requirement='addict==2.4.0 \\\n    --hash=sha256:249bb56bbfd3cdc2a004ea0ff4c2b6ddc84d53bc2194761636eb314d5cfa5dfc \\\n    --hash=sha256:b3b2210e0e067a281f5646c8c5db92e99b7231ea8b0eb5f74dbdf9e259d4e494', scope='install')
environment: Environment(python_version='313', operating_system='linux')
repos:
 PypiSimpleRepository(index_url='https://pypi.org/simple', credentials=None)
Traceback (most recent call last):
  File "/Users/bom1wa3/Projects/oss/python-inspector/venv/lib/python3.11/site-packages/packvers/requirements.py", line 102, in __init__
    req = REQUIREMENT.parseString(requirement_string)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/bom1wa3/Projects/oss/python-inspector/venv/lib/python3.11/site-packages/pyparsing/core.py", line 1141, in parse_string
    raise exc.with_traceback(None)
pyparsing.exceptions.ParseException: Expected string_end, found '\'  (at char 14), (line:1, col:15)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/Users/bom1wa3/Projects/oss/python-inspector/src/python_inspector/resolve_cli.py", line 259, in resolve_dependencies
    resolution_result: Dict = resolver_api(
                              ^^^^^^^^^^^^^
  File "/Users/bom1wa3/Projects/oss/python-inspector/src/python_inspector/api.py", line 283, in resolve_dependencies
    resolution, purls = resolve(
                        ^^^^^^^^
  File "/Users/bom1wa3/Projects/oss/python-inspector/src/python_inspector/api.py", line 368, in resolve
    requirements = list(
                   ^^^^^
  File "/Users/bom1wa3/Projects/oss/python-inspector/src/python_inspector/api.py", line 484, in get_requirements_from_direct_dependencies
    req = Requirement(requirement_string=dependency.extracted_requirement)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/bom1wa3/Projects/oss/python-inspector/venv/lib/python3.11/site-packages/packvers/requirements.py", line 104, in __init__
    raise InvalidRequirement(
packvers.requirements.InvalidRequirement: Parse error at "'\\\n    --'": Expected string_end

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions