From fbc0d2857bc44a00351bb22bea91efab99137b04 Mon Sep 17 00:00:00 2001 From: Ethan Carter Edwards Date: Wed, 30 Jul 2025 19:39:20 -0400 Subject: [PATCH 1/5] python3Packages.ds-xbom-lib: init at 6.0.0b3 Signed-off-by: Ethan Carter Edwards --- .../python-modules/ds-xbom-lib/default.nix | 34 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 ++ 2 files changed, 36 insertions(+) create mode 100644 pkgs/development/python-modules/ds-xbom-lib/default.nix diff --git a/pkgs/development/python-modules/ds-xbom-lib/default.nix b/pkgs/development/python-modules/ds-xbom-lib/default.nix new file mode 100644 index 000000000000..20464510118e --- /dev/null +++ b/pkgs/development/python-modules/ds-xbom-lib/default.nix @@ -0,0 +1,34 @@ +{ + lib, + buildPythonPackage, + fetchPypi, + setuptools, +}: + +buildPythonPackage rec { + pname = "ds-xbom-lib"; + version = "6.0.0b3"; + pyproject = true; + + # pypi because library is embedded into another project's repo + src = fetchPypi { + inherit version; + pname = "ds_xbom_lib"; + hash = "sha256-/L0AFAuIDzbyXwpg0bigy2AR4GT0RSdXrjPAEbEO7cI="; + }; + + build-system = [ setuptools ]; + + pythonImportsCheck = [ "xbom_lib" ]; + + # no tests + doCheck = false; + + meta = { + description = "xBOM library for owasp depscan"; + homepage = "https://pypi.org/project/ds-xbom-lib/"; + maintainers = with lib.maintainers; [ ethancedwards8 ]; + teams = [ lib.teams.ngi ]; + license = with lib.licenses; [ mit ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 23323d8d82ea..e19afd3ed358 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -4354,6 +4354,8 @@ self: super: with self; { ds-store = callPackage ../development/python-modules/ds-store { }; + ds-xbom-lib = callPackage ../development/python-modules/ds-xbom-lib { }; + ds4drv = callPackage ../development/python-modules/ds4drv { }; dscribe = callPackage ../development/python-modules/dscribe { }; From 809f7dd59eec2454057c83e42a69fe754fb295dd Mon Sep 17 00:00:00 2001 From: Ethan Carter Edwards Date: Wed, 30 Jul 2025 19:43:12 -0400 Subject: [PATCH 2/5] python3Packages.ds-reporting-lib: init at 6.0.0b3 Signed-off-by: Ethan Carter Edwards --- .../ds-reporting-lib/default.nix | 34 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 2 ++ 2 files changed, 36 insertions(+) create mode 100644 pkgs/development/python-modules/ds-reporting-lib/default.nix diff --git a/pkgs/development/python-modules/ds-reporting-lib/default.nix b/pkgs/development/python-modules/ds-reporting-lib/default.nix new file mode 100644 index 000000000000..26697a6033ae --- /dev/null +++ b/pkgs/development/python-modules/ds-reporting-lib/default.nix @@ -0,0 +1,34 @@ +{ + lib, + buildPythonPackage, + fetchPypi, + setuptools, +}: + +buildPythonPackage rec { + pname = "ds-reporting-lib"; + version = "6.0.0b3"; + pyproject = true; + + # pypi because library is embedded into another project's repo + src = fetchPypi { + inherit version; + pname = "ds_reporting_lib"; + hash = "sha256-0C/UgAM7VIWEjuRq1ZCTL5CjJ6OK+0/Yw+AN4j7jj6E="; + }; + + build-system = [ setuptools ]; + + pythonImportsCheck = [ "reporting_lib" ]; + + # no tests + doCheck = false; + + meta = { + description = "Reporting library for owasp depscan"; + homepage = "https://pypi.org/project/ds-reporting-lib/"; + maintainers = with lib.maintainers; [ ethancedwards8 ]; + teams = [ lib.teams.ngi ]; + license = with lib.licenses; [ mit ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index e19afd3ed358..12af7ed30324 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -4354,6 +4354,8 @@ self: super: with self; { ds-store = callPackage ../development/python-modules/ds-store { }; + ds-reporting-lib = callPackage ../development/python-modules/ds-reporting-lib { }; + ds-xbom-lib = callPackage ../development/python-modules/ds-xbom-lib { }; ds4drv = callPackage ../development/python-modules/ds4drv { }; From 2d696e88de69ae02638358bd0d16ec1fececb160 Mon Sep 17 00:00:00 2001 From: Ethan Carter Edwards Date: Wed, 30 Jul 2025 19:52:32 -0400 Subject: [PATCH 3/5] python3Packages.ds-analysis-lib: init at 6.0.0b3 Signed-off-by: Ethan Carter Edwards --- .../ds-analysis-lib/default.nix | 59 +++++++++++++++++++ pkgs/top-level/python-packages.nix | 4 +- 2 files changed, 62 insertions(+), 1 deletion(-) create mode 100644 pkgs/development/python-modules/ds-analysis-lib/default.nix diff --git a/pkgs/development/python-modules/ds-analysis-lib/default.nix b/pkgs/development/python-modules/ds-analysis-lib/default.nix new file mode 100644 index 000000000000..66df91b9d28e --- /dev/null +++ b/pkgs/development/python-modules/ds-analysis-lib/default.nix @@ -0,0 +1,59 @@ +{ + lib, + buildPythonPackage, + fetchPypi, + setuptools, + appthreat-vulnerability-db, + custom-json-diff, + cvss, + rich, + toml, + writableTmpDirAsHomeHook, + pytestCheckHook, + pytest-cov-stub, +}: + +buildPythonPackage rec { + pname = "ds-analysis-lib"; + version = "6.0.0b3"; + pyproject = true; + + # pypi because library is embedded into another project's repo + src = fetchPypi { + inherit version; + pname = "ds_analysis_lib"; + hash = "sha256-XZZzAxQJk65Xoq6z2OadlHUN0REYTjKmSvwz17tvVqc="; + }; + + build-system = [ setuptools ]; + + dependencies = [ + appthreat-vulnerability-db + custom-json-diff + cvss + rich + toml + ]; + + pythonImportsCheck = [ "analysis_lib" ]; + + # relies on data files that pypi doesn't include + disabledTestPaths = [ + "tests/test_analysis.py" + "tests/test_csaf.py" + ]; + + nativeCheckInputs = [ + writableTmpDirAsHomeHook + pytestCheckHook + pytest-cov-stub + ]; + + meta = { + description = "Analysis library for owasp depscan"; + homepage = "https://pypi.org/project/ds-analysis-lib/"; + maintainers = with lib.maintainers; [ ethancedwards8 ]; + teams = [ lib.teams.ngi ]; + license = with lib.licenses; [ mit ]; + }; +} diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix index 12af7ed30324..6a6e094c536a 100644 --- a/pkgs/top-level/python-packages.nix +++ b/pkgs/top-level/python-packages.nix @@ -4352,10 +4352,12 @@ self: super: with self; { dropmqttapi = callPackage ../development/python-modules/dropmqttapi { }; - ds-store = callPackage ../development/python-modules/ds-store { }; + ds-analysis-lib = callPackage ../development/python-modules/ds-analysis-lib { }; ds-reporting-lib = callPackage ../development/python-modules/ds-reporting-lib { }; + ds-store = callPackage ../development/python-modules/ds-store { }; + ds-xbom-lib = callPackage ../development/python-modules/ds-xbom-lib { }; ds4drv = callPackage ../development/python-modules/ds4drv { }; From 46879c2cf0132afbad1b5ba6eac2153345b3d199 Mon Sep 17 00:00:00 2001 From: Ethan Carter Edwards Date: Wed, 30 Jul 2025 19:56:27 -0400 Subject: [PATCH 4/5] dep-scan: add ngi team dep-scan is an ngi project. We would like to know about it :) Signed-off-by: Ethan Carter Edwards --- pkgs/by-name/de/dep-scan/package.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/by-name/de/dep-scan/package.nix b/pkgs/by-name/de/dep-scan/package.nix index 10bcae2eea10..bd5eb2b73298 100644 --- a/pkgs/by-name/de/dep-scan/package.nix +++ b/pkgs/by-name/de/dep-scan/package.nix @@ -70,6 +70,7 @@ python3.pkgs.buildPythonApplication rec { changelog = "https://github.com/owasp-dep-scan/dep-scan/releases/tag/v${version}"; license = lib.licenses.mit; maintainers = with lib.maintainers; [ fab ]; + teams = [ lib.teams.ngi ]; mainProgram = "dep-scan"; }; } From f18a3a22ff1ac351863a167d424a576b7c0c2aa4 Mon Sep 17 00:00:00 2001 From: Ethan Carter Edwards Date: Mon, 28 Jul 2025 21:14:57 -0400 Subject: [PATCH 5/5] dep-scan: bump, fix error when scanning projects This version is required in order to can use manifest v6 of vdb. It also requires access to the cdxgen binary. Signed-off-by: Ethan Carter Edwards --- pkgs/by-name/de/dep-scan/package.nix | 54 +++++++++++++++------------- 1 file changed, 29 insertions(+), 25 deletions(-) diff --git a/pkgs/by-name/de/dep-scan/package.nix b/pkgs/by-name/de/dep-scan/package.nix index bd5eb2b73298..58fa53c24581 100644 --- a/pkgs/by-name/de/dep-scan/package.nix +++ b/pkgs/by-name/de/dep-scan/package.nix @@ -1,41 +1,34 @@ { lib, fetchFromGitHub, - python3, + python3Packages, + writableTmpDirAsHomeHook, + makeWrapper, + cdxgen, }: -let - appthreat-vulnerability-db = ( - python3.pkgs.appthreat-vulnerability-db.overrideAttrs (oldAttrs: rec { - version = "5.8.1"; - src = oldAttrs.src.override { - tag = "v${version}"; - hash = "sha256-/Yo0yyDp2vd9KJhy3LGRml55eqTiaHSSuSoe2h2bSw0="; - }; - }) - ); - -in -python3.pkgs.buildPythonApplication rec { +python3Packages.buildPythonApplication rec { pname = "dep-scan"; - version = "5.5.0"; + version = "6.0.0b3"; pyproject = true; src = fetchFromGitHub { owner = "owasp-dep-scan"; repo = "dep-scan"; tag = "v${version}"; - hash = "sha256-lgqS8GY5JuHL3strNcb0B3mGieFkQTzGuRyV4dBp5e4="; + hash = "sha256-GdrFsECcBZ2J47ojM33flqOtrY3avchGpsZk6pt8Aks="; }; - pythonRelaxDeps = [ "oras" ]; + build-system = with python3Packages; [ setuptools ]; - build-system = with python3.pkgs; [ setuptools ]; - - dependencies = with python3.pkgs; [ + dependencies = with python3Packages; [ appthreat-vulnerability-db + custom-json-diff cvss defusedxml + ds-analysis-lib + ds-reporting-lib + ds-xbom-lib jinja2 oras packageurl-python @@ -47,23 +40,34 @@ python3.pkgs.buildPythonApplication rec { toml ]; - nativeCheckInputs = with python3.pkgs; [ + nativeCheckInputs = with python3Packages; [ httpretty pytest-cov-stub pytestCheckHook + writableTmpDirAsHomeHook ]; pythonImportsCheck = [ "depscan" ]; - preCheck = '' - export HOME=$(mktemp -d) - ''; - disabledTests = [ # Test is not present "test_query_metadata2" ]; + # depscan --src shiftleft/scan-slim -o containertests -t docker + # + # WARNING [2025-07-28 20:17:35,654] cdxgen command not found. Please install using npm install @cyclonedx/cdxgen or set PATH variable + # WARNING [2025-07-28 20:17:35,654] /nix/store/56bxjw4rgdqa82f61w70z92qq6b14ass-dep-scan-5.5.0/lib/python3.13/site-packages/depscan/lib/local_bin/cdxgen command not found. Please install using npm install @cyclonedx/cdxgen or set PATH variable + # INFO [2025-07-28 20:17:35,654] Generating Software Bill-of-Materials for container image shiftleft/scan-slim. This might take a few mins ... + # WARNING [2025-07-28 20:17:35,654] Unable to locate cdxgen command. + makeWrapperArgs = [ + "--prefix PATH : ${ + lib.makeBinPath [ + cdxgen + ] + }" + ]; + meta = { description = "Security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies"; homepage = "https://github.com/owasp-dep-scan/dep-scan";