1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
|
"""
packaging/audit_deps.py, the pip-audit step of the builds.
What can be checked without the network: a build with no network goes on
(the audit is skipped with a warning, never a failure), what is audited is
what ships, and the ignore list is read as ids. Whether pip-audit stops a
build on a real advisory needs the network and was checked by hand.
"""
import importlib.util
import os
import subprocess
import sys
from pathlib import Path
import pytest
ROOT = Path(__file__).resolve().parents[3]
SCRIPT = ROOT / "packaging" / "audit_deps.py"
pytestmark = pytest.mark.skipif(not SCRIPT.exists(), reason="packaging not present")
def _module():
spec = importlib.util.spec_from_file_location("audit_deps", SCRIPT)
mod = importlib.util.module_from_spec(spec)
spec.loader.exec_module(mod)
return mod
def test_no_network_skips_the_audit_without_failing_the_build(tmp_path):
# A proxy nobody listens on: every request is refused at once.
dead = "http://127.0.0.1:9"
env = {**os.environ, "HTTPS_PROXY": dead, "https_proxy": dead,
"HTTP_PROXY": dead, "http_proxy": dead}
run = subprocess.run([sys.executable, str(SCRIPT), "--tool-dir", str(tmp_path / "t")],
capture_output=True, text=True, env=env, timeout=60)
assert run.returncode == 0, run.stderr
assert "pip-audit skipped: no network" in run.stderr
assert not (tmp_path / "t").exists(), "nothing is installed when it cannot run"
def test_what_is_audited_is_what_ships():
names = {line.split("==")[0].lower() for line in _module().shipped()}
assert "pytest" in names, "the environment's packages are listed"
assert not {n for n in names if n.startswith("meshbay")}, "ours are not on PyPI"
assert not names & {"pip", "setuptools", "wheel"}, "build tools do not ship"
def test_the_ignore_list_is_read_as_ids(tmp_path, monkeypatch):
mod = _module()
f = tmp_path / "ignore.txt"
f.write_text("# a comment\n\nPYSEC-2026-1 # not reached: no JWK import\n"
"GHSA-xxxx-yyyy-zzzz\n", encoding="utf-8")
monkeypatch.setattr(mod, "IGNORE_FILE", f)
assert mod.ignored() == ["PYSEC-2026-1", "GHSA-xxxx-yyyy-zzzz"]
def test_the_shipped_ignore_list_lets_nothing_through_unexplained():
"""Every id in the real file carries its reason."""
mod = _module()
for line in mod.IGNORE_FILE.read_text(encoding="utf-8").splitlines():
if line.strip() and not line.lstrip().startswith("#"):
assert "#" in line, f"no reason given: {line!r}"
|