diff options
| author | Christophe Besson <cbesson@gmail.com> | 2026-10-15 14:56:35 +0200 |
|---|---|---|
| committer | Christophe Besson <cbesson@gmail.com> | 2026-10-15 14:56:35 +0200 |
| commit | 7fc2fa04d7d88a1cdf0d290ddd2de3815a7d52a5 (patch) | |
| tree | c2ca93040bb95f5bcb667846a2fa91ddf0dd99bb /packaging/README.md | |
| parent | 9dd6d1003cf92c0e4e7f23414565314691aa5516 (diff) | |
| download | meshbay-7fc2fa04d7d88a1cdf0d290ddd2de3815a7d52a5.tar.gz | |
build: audit the shipped Python dependencies with pip-audit
No lock file pins the dependencies, so each build installs the newest
releases and what ships is only known once it has. packaging/audit_deps.py
runs pip-audit then: build-common.sh on the venv before stripping it,
build-node-runtime.ps1 on the environment before PyInstaller freezes it.
A known vulnerability stops the build, unless its id is listed in
packaging/pip-audit-ignore.txt with why it does not apply. No network only
skips the audit with a warning, as does a pip-audit that cannot be installed
or writes no report. pip-audit runs from a venv of its own, never from the
one that ships. Our packages are not audited (not on PyPI), nor pip,
setuptools and wheel, which do not ship.
Checked with the real build-common.sh (79 packages, none known), with
PyJWT 2.14 (the build stops on its two advisories, and goes on once they are
listed) and offline (a warning, the build goes on). The PowerShell step was
not run here.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diffstat (limited to 'packaging/README.md')
| -rw-r--r-- | packaging/README.md | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/packaging/README.md b/packaging/README.md index 55cc39a..8156ca0 100644 --- a/packaging/README.md +++ b/packaging/README.md @@ -99,6 +99,18 @@ Its architecture is the machine's, not `all`: argon2-cffi's bindings are compiled code. Its licence notices are in `/opt/meshbay-cli/THIRD-PARTY-NOTICES.txt`. +### Known vulnerabilities + +No lock file pins the Python dependencies: every build installs the newest +releases, so what ships is only known once a build has installed it. That is +where [`audit_deps.py`](audit_deps.py) runs pip-audit — `build-common.sh` on the +venv before stripping it, `build-node-runtime.ps1` on the environment before +PyInstaller freezes it. A known vulnerability stops the build, unless its id is +in [`pip-audit-ignore.txt`](pip-audit-ignore.txt) with why it does not apply. +No network only skips the audit, with a warning. pip-audit itself runs from a +venv of its own (`<staging>/pip-audit`, `packages/meshbay-client/build/_pip-audit` +on Windows), never from the one that ships. + The man page, `meshbay-cli(1)`, is generated at build time from the client's own argument parser (`python -m meshbay_cli.manpage`), so it lists the options the program has; `tests/test_manpage.py` fails when an action or option misses |