Dependency Licensing and Vulnerability Tracking

[adamkrellenstein]

• DependaBot
• CodeQL analysis (complete? python only?)
• Other code scanning?

[ouziel-slama]

for the record: https://geekflare.com/find-python-security-vulnerabilities/
bandit looks good!

[ouziel-slama]

tested https://pypi.org/project/license-scanner/
works well like Bandit.

[adamkrellenstein]

[ouziel-slama]

see https://github.com/towercomputers/toweros/security/code-scanning?query=is%3Aopen+branch%3Adev

CodeQL, Bandit and Pylint are executed for the dev branch. All that is missing is the scanning of the licenses. @adamkrellenstein do we want a whitelist or a blacklist system for licenses ?

[adamkrellenstein]

Great! I think it should be a whitelist—we have relatively few dependencies.

[ouziel-slama]

done!
here the whitelists: https://github.com/towercomputers/toweros/blob/dev/tower-lib/pyproject.toml#L40-L58

and here is an example when neither the package nor its license are in one of the two whitelists.
https://github.com/towercomputers/toweros/security/code-scanning?query=is%3Aclosed+branch%3Adev

[adamkrellenstein]

Great!!!

[ouziel-slama]

There is just a small problem with CodeQL which does not take into account this line: https://github.com/towercomputers/toweros/blob/dev/tower-lib/towerlib/provision.py#L153

See github/codeql#11427

That's mean we need to close manually, in the Github UI, this one https://github.com/towercomputers/toweros/security/code-scanning?query=is%3Aopen+branch%3Adev

This should happen very rarely.. no point I think to use a hack to solve the problem.. @adamkrellenstein if ok for you I close this issue.

[adamkrellenstein]

yep!