Planned fix for security vulnerability for setuptools-65.5.0 lib - #809
Planned fix for security vulnerability for setuptools-65.5.0 lib#809bhupendra-vaishnav wants to merge 3 commits into
Conversation
…HSA-r9hx-vwmv-q579 Added or modified files are : src/python/install.sh test/python/install_python_setuptools_vulnerability.sh test/python/scenarios.json
| "image": "debian:bookworm", | ||
| "features": { | ||
| "python": { | ||
| "version": "3.10", | ||
| "installTools": true | ||
| } |
There was a problem hiding this comment.
| "image": "debian:bookworm", | |
| "features": { | |
| "python": { | |
| "version": "3.10", | |
| "installTools": true | |
| } | |
| "image": "python:3:10", | |
| "features": { | |
| "python": { | |
| "version": "none", | |
| "installTools": true | |
| } |
Can we update the scenario to reflect the python image build?
There was a problem hiding this comment.
These are the points that I wanted to discuss with you. The moment we move to version as "none" the code in install.sh will not work.
There was a problem hiding this comment.
the code in install.sh will not work.
Can you help specify the code are you referring at? Can you paste some links?
| @@ -1,4 +1,13 @@ | |||
| { | |||
| "install_python_setuptools_vulnerability": { | |||
| "image": "debian:bookworm", | |||
There was a problem hiding this comment.
Once you address previous comment, can you also add a new test scenario with image python:3:11 ?
|
|
||
| if [ "${PYTHON_VERSION}" == "${vv}" ]; then | ||
| rm -rf ${PIPX_HOME}/shared/lib/"python${vv}"/site-packages/setuptools-65.5.0.dist-info | ||
| #rm -rf ${PYTHON_INSTALL_PATH}/"${VERSION}"/lib/python${vv}/site-packages/setuptools-65.5.0.dist-info |
There was a problem hiding this comment.
Can you remove this comment?
There was a problem hiding this comment.
I will remove that but I would like to highlight that sometime another directory will get created for setuptools-65.5.0 do so you want us to remove that or not?
The other option is to the check the version for dynamically which I can further look into that.
There was a problem hiding this comment.
highlight that sometime another directory will get created for setuptools-65.5.0
Do you have a scenario or reproduction for this? Are you aware of the drawbacks of removing that directory?
We shouldn't add code or comments if it's not 💯 needed. However, if the scanners complain about it, then we can definitely add it back.
There was a problem hiding this comment.
I have implemented a way to dynamically fetch the python version so now no issue.
| source dev-container-features-test-lib | ||
|
|
||
| #check "setuptools version 65.5.0 not installed" bash -c "ls -lrt /usr/local/py-utils/shared/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" | ||
| #checkPythonPackageVersion "setuptools" "65.5.1" |
There was a problem hiding this comment.
Can you add this check?
| checkVulnerableDir "/usr/local/py-utils/shared/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" "3.11" | ||
| checkVulnerableDir "/usr/local/python/3.11.7/lib/python3.11/site-packages/setuptools-65.5.0.dist-info" "3.11" | ||
|
|
||
| # Report result |
There was a problem hiding this comment.
Can you also add the following command? this way we can see the status of the files.
find . -name "*setuptools*"
|
@samruddhikhandale As we have another PR # 814 to address the same issue so should we close/delete this? |
|
As we have another PR # 814 to address the same issue so closing this PR. |
2 participants
Planned fix for security vulnerability GHSA-r9hx-vwmv-q579 for setuptools-65.5.0 lib
Added or modified files are :
src/python/install.sh
test/python/install_python_setuptools_vulnerability.sh
test/python/scenarios.json