From 8c9ff42d11e1fbfb90143edabf45e4e684f217ee Mon Sep 17 00:00:00 2001 From: Andreas Maier Date: Sun, 5 Jan 2025 14:00:09 +0100 Subject: [PATCH] Migrated safety to use 'safety scan' Signed-off-by: Andreas Maier --- .safety-policy-develop.yml | 77 +++++++++++++++++++++++---------- .safety-policy-install.yml | 73 +++++++++++++++++++++---------- Makefile | 4 +- dev-requirements.txt | 15 +++---- minimum-constraints-develop.txt | 17 ++++---- 5 files changed, 121 insertions(+), 65 deletions(-) diff --git a/.safety-policy-develop.yml b/.safety-policy-develop.yml index 057304e9..5f42e2e2 100644 --- a/.safety-policy-develop.yml +++ b/.safety-policy-develop.yml @@ -1,33 +1,62 @@ # Safety policy file for packages needed for development. -# For documentation, see https://docs.pyup.io/docs/safety-20-policy-file +# For documentation, see https://docs.safetycli.com/safety-docs/administration/safety-policy-files # Note: This policy file is used against the versions in minimum-constraints-develop.txt. -# Configuration for the 'safety check' command -security: +version: '3.0' - # Ignore certain severities. - # A number between 0 and 10, with the following significant values: - # - 9: ignore all vulnerabilities except CRITICAL severity - # - 7: ignore all vulnerabilities except CRITICAL & HIGH severity - # - 4: ignore all vulnerabilities except CRITICAL, HIGH & MEDIUM severity - ignore-cvss-severity-below: 0 +scanning-settings: + max-depth: 6 + exclude: [] + include-files: [] + system: + targets: [] - # Ignore unknown severities. - # Should be set to False. - ignore-cvss-unknown-severity: False +report: + dependency-vulnerabilities: + enabled: true + auto-ignore-in-report: + python: + environment-results: true + unpinned-requirements: true + cvss-severity: [] + vulnerabilities: + # List of specific vulnerabilities to ignore. + # {id}: # vulnerability ID + # reason: {text} # optional: Reason for ignoring it + # expires: {date} # optional: Date when this ignore will expire + 70612: + reason: Disputed issue in jinja2 version 3.1.3 - No known fix - # Ignore unpinned requirements. - # Should be set to False. - ignore-unpinned-requirements: False +fail-scan-with-exit-code: + dependency-vulnerabilities: + enabled: true + fail-on-any-of: + cvss-severity: + - high + - medium + - critical + exploitability: + - high + - medium + - critical - # List of specific vulnerabilities to ignore. - # {id}: # vulnerability ID - # reason: {text} # optional: Reason for ignoring it. Will be reported in the Safety reports - # expires: {date} # optional: Date when this ignore will expire - ignore-vulnerabilities: - 70612: - reason: Disputed issue in jinja2 version 3.1.3 - No known fix +security-updates: + dependency-vulnerabilities: + auto-security-updates-limit: + - patch - # Continue with exit code 0 when vulnerabilities are found. - continue-on-vulnerability-error: False +installation: + default-action: allow + audit-logging: + enabled: true + allow: + packages: [] + vulnerabilities: {} + deny: + packages: {} + vulnerabilities: + warning-on-any-of: + cvss-severity: [] + block-on-any-of: + cvss-severity: [] diff --git a/.safety-policy-install.yml b/.safety-policy-install.yml index 91fc226c..38bd7395 100644 --- a/.safety-policy-install.yml +++ b/.safety-policy-install.yml @@ -1,31 +1,60 @@ # Safety policy file for packages needed for installation. -# For documentation, see https://docs.pyup.io/docs/safety-20-policy-file +# For documentation, see https://docs.safetycli.com/safety-docs/administration/safety-policy-files # Note: This policy file is used against the versions in minimum-constraints-install.txt. -# Configuration for the 'safety check' command -security: +version: '3.0' - # Ignore certain severities. - # A number between 0 and 10, with the following significant values: - # - 9: ignore all vulnerabilities except CRITICAL severity - # - 7: ignore all vulnerabilities except CRITICAL & HIGH severity - # - 4: ignore all vulnerabilities except CRITICAL, HIGH & MEDIUM severity - ignore-cvss-severity-below: 0 +scanning-settings: + max-depth: 6 + exclude: [] + include-files: [] + system: + targets: [] - # Ignore unknown severities. - # Should be set to False. - ignore-cvss-unknown-severity: False +report: + dependency-vulnerabilities: + enabled: true + auto-ignore-in-report: + python: + environment-results: true + unpinned-requirements: true + cvss-severity: [] + vulnerabilities: + # List of specific vulnerabilities to ignore. + # {id}: # vulnerability ID + # reason: {text} # optional: Reason for ignoring it + # expires: {date} # optional: Date when this ignore will expire - # Ignore unpinned requirements. - # Should be set to False. - ignore-unpinned-requirements: False +fail-scan-with-exit-code: + dependency-vulnerabilities: + enabled: true + fail-on-any-of: + cvss-severity: + - high + - medium + - critical + exploitability: + - high + - medium + - critical - # List of specific vulnerabilities to ignore. - # {id}: # vulnerability ID - # reason: {text} # optional: Reason for ignoring it. Will be reported in the Safety reports - # expires: {date} # optional: Date when this ignore will expire - ignore-vulnerabilities: +security-updates: + dependency-vulnerabilities: + auto-security-updates-limit: + - patch - # Continue with exit code 0 when vulnerabilities are found. - continue-on-vulnerability-error: False +installation: + default-action: allow + audit-logging: + enabled: true + allow: + packages: [] + vulnerabilities: {} + deny: + packages: {} + vulnerabilities: + warning-on-any-of: + cvss-severity: [] + block-on-any-of: + cvss-severity: [] diff --git a/Makefile b/Makefile index b8c8d124..d1da22be 100644 --- a/Makefile +++ b/Makefile @@ -596,14 +596,14 @@ $(done_dir)/pylint_$(pymn)_$(PACKAGE_LEVEL).done: $(done_dir)/develop_$(pymn)_$( $(done_dir)/safety_develop_$(pymn)_$(PACKAGE_LEVEL).done: $(done_dir)/develop_$(pymn)_$(PACKAGE_LEVEL).done $(safety_develop_policy_file) minimum-constraints-develop.txt minimum-constraints-install.txt @echo "Makefile: Running Safety for development packages (and tolerate safety issues when RUN_TYPE is normal or scheduled)" -$(call RM_FUNC,$@) - bash -c "safety check --policy-file $(safety_develop_policy_file) -r minimum-constraints-develop.txt --full-report || test '$(RUN_TYPE)' == 'normal' || test '$(RUN_TYPE)' == 'scheduled' || exit 1" + bash -c "safety scan --policy-file $(safety_develop_policy_file) -r minimum-constraints-develop.txt --full-report || test '$(RUN_TYPE)' == 'normal' || test '$(RUN_TYPE)' == 'scheduled' || exit 1" echo "done" >$@ @echo "Makefile: Done running Safety for development packages" $(done_dir)/safety_install_$(pymn)_$(PACKAGE_LEVEL).done: $(done_dir)/develop_$(pymn)_$(PACKAGE_LEVEL).done $(safety_install_policy_file) minimum-constraints-install.txt @echo "Makefile: Running Safety for install packages (and tolerate safety issues when RUN_TYPE is normal)" -$(call RM_FUNC,$@) - bash -c "safety check --policy-file $(safety_install_policy_file) -r minimum-constraints-install.txt --full-report || test '$(RUN_TYPE)' == 'normal' || exit 1" + bash -c "safety scan --policy-file $(safety_install_policy_file) -r minimum-constraints-install.txt --full-report || test '$(RUN_TYPE)' == 'normal' || exit 1" echo "done" >$@ @echo "Makefile: Done running Safety for install packages" diff --git a/dev-requirements.txt b/dev-requirements.txt index ad1e257b..a482b3d9 100644 --- a/dev-requirements.txt +++ b/dev-requirements.txt @@ -47,19 +47,18 @@ coveralls>=3.3.0 # Safety 3.0.0 requires exact versions of authlib==1.2.0 and jwt==1.3.1. # Safety 3.0.x pins pydantic to <2.0, preventing bug fixes. # pydantic 2.8.0 fixes an install issue on Python 3.13. -safety>=3.1.0 -safety-schemas>=0.0.2,!=0.0.7 -# TODO: Change to dparse 0.6.4 once released -dparse>=0.6.4b0 +safety>=3.2.14 +safety-schemas>=0.0.10 +dparse>=0.6.4 ruamel.yaml>=0.17.21 click>=8.0.2 Authlib>=1.2.0 marshmallow>=3.15.0 pydantic>=2.8.0 -typer>=0.12.0 -typer-cli>=0.12.0 -typer-slim>=0.12.0 -psutil>=6.0.0 +typer>=0.13.0 +typer-cli>=0.13.0 +typer-slim>=0.13.0 +psutil>=6.1.0 # Bandit checker bandit>=1.7.8 diff --git a/minimum-constraints-develop.txt b/minimum-constraints-develop.txt index 8b7953b6..5088782a 100644 --- a/minimum-constraints-develop.txt +++ b/minimum-constraints-develop.txt @@ -42,19 +42,18 @@ pytest-cov==2.7.0 coveralls==3.3.0 # Safety CI by pyup.io -safety==3.1.0 -safety-schemas==0.0.2 -# TODO: Change to dparse 0.6.4 once released -dparse==0.6.4b0 +safety==3.2.14 +safety-schemas==0.0.10 +dparse==0.6.4 ruamel.yaml==0.17.21 click==8.0.2 Authlib==1.3.1 marshmallow==3.15.0 pydantic==2.8.0 -typer==0.12.0 -typer-cli==0.12.0 -typer-slim==0.12.0 -psutil==6.0.0 +typer==0.13.0 +typer-cli==0.13.0 +typer-slim==0.13.0 +psutil==6.1.0 # Bandit checker bandit==1.7.8 @@ -168,7 +167,7 @@ configparser==4.0.2 dataclasses==0.8 defusedxml==0.7.1 distlib==0.3.7 -filelock==3.13.1 +filelock==3.16.1 gitdb==4.0.8 gitdb2==2.0.0 html5lib==1.1