diff options
Diffstat (limited to 'packaging/README.md')
| -rw-r--r-- | packaging/README.md | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/packaging/README.md b/packaging/README.md index 55cc39a..8156ca0 100644 --- a/packaging/README.md +++ b/packaging/README.md @@ -99,6 +99,18 @@ Its architecture is the machine's, not `all`: argon2-cffi's bindings are compiled code. Its licence notices are in `/opt/meshbay-cli/THIRD-PARTY-NOTICES.txt`. +### Known vulnerabilities + +No lock file pins the Python dependencies: every build installs the newest +releases, so what ships is only known once a build has installed it. That is +where [`audit_deps.py`](audit_deps.py) runs pip-audit — `build-common.sh` on the +venv before stripping it, `build-node-runtime.ps1` on the environment before +PyInstaller freezes it. A known vulnerability stops the build, unless its id is +in [`pip-audit-ignore.txt`](pip-audit-ignore.txt) with why it does not apply. +No network only skips the audit, with a warning. pip-audit itself runs from a +venv of its own (`<staging>/pip-audit`, `packages/meshbay-client/build/_pip-audit` +on Windows), never from the one that ships. + The man page, `meshbay-cli(1)`, is generated at build time from the client's own argument parser (`python -m meshbay_cli.manpage`), so it lists the options the program has; `tests/test_manpage.py` fails when an action or option misses |