Merge pull request #264751 from fabaff/checkov-bump

checkov: 2.5.15 -> 3.0.15

pkgs/development/python-modules/cyclonedx-python-lib/default.nix

@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "cyclonedx-python-lib";
-  version = "4.2.3";
+  version = "5.1.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "CycloneDX";
     repo = "cyclonedx-python-lib";
     rev = "refs/tags/v${version}";
-    hash = "sha256-I94YsfDJ+FGQBRWCRKum917tXJ5vFm/cWbbM+NpwA4M=";
+    hash = "sha256-M3aR3lCNtPIve1o16QLSnxrULhtXkuOXNYtOv2FmPMQ=";
   };
 
   nativeBuildInputs = [
@@ -78,9 +78,11 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
-    # These tests require network access.
+    # These tests require network access
     "test_bom_v1_3_with_metadata_component"
     "test_bom_v1_4_with_metadata_component"
+    # AssertionError: <ValidationError: "{'algorithm': 'ES256', ...
+    "TestJson"
   ];
 
   disabledTestPaths = [

pkgs/development/tools/analysis/checkov/default.nix

@@ -3,33 +3,16 @@
 , python3
 }:
 
-let
-  py = python3.override {
-    packageOverrides = self: super: {
-      cyclonedx-python-lib = super.cyclonedx-python-lib.overridePythonAttrs (oldAttrs: rec {
-        version = "2.7.1";
-        src = fetchFromGitHub {
-          owner = "CycloneDX";
-          repo = "cyclonedx-python-lib";
-          rev = "v${version}";
-          hash = "sha256-c/KhoJOa121/h0n0GUazjUFChnUo05ThD+fuZXc5/Pk=";
-        };
-      });
-    };
-  };
-in
-with py.pkgs;
-
-buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "2.5.15";
-  format = "setuptools";
+  version = "3.0.32";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
-    repo = pname;
+    repo = "checkov";
     rev = "refs/tags/${version}";
-    hash = "sha256-PVx66Ipvf+rISkuu9dw2ecFXXmuzITg2PogqRktFh5M=";
+    hash = "sha256-YOZ7F/bxbnBh3mhiFL3cMMAc3qeOMab48LcvYeJgfrg=";
   };
 
   patches = [
@@ -45,12 +28,12 @@ buildPythonApplication rec {
     "pycep-parser"
   ];
 
-  nativeBuildInputs = [
+  nativeBuildInputs = with python3.pkgs; [
     pythonRelaxDepsHook
     setuptools-scm
   ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3.pkgs; [
     aiodns
     aiohttp
     aiomultiprocess
@@ -82,6 +65,7 @@ buildPythonApplication rec {
     prettytable
     pycep-parser
     pyyaml
+    pydantic
     rustworkx
     semantic-version
     spdx-tools
@@ -92,7 +76,7 @@ buildPythonApplication rec {
     update_checker
   ];
 
-  nativeCheckInputs = [
+  nativeCheckInputs = with python3.pkgs; [
     aioresponses
     mock
     pytest-asyncio
@@ -119,12 +103,10 @@ buildPythonApplication rec {
     # Tests are comparing console output
     "cli"
     "console"
-    # Starting to fail after 2.3.205
-    "test_non_multiline_pair"
-    "test_secret_value_in_keyword"
-    "test_runner_verify_secrets_skip_invalid_suppressed"
-    "test_runner_verify_secrets_skip_all_no_effect"
+    # Assertion error
     "test_runner"
+    # AssertionError: assert ['<?xml versi...
+    "test_get_cyclonedx_report"
   ];
 
   disabledTestPaths = [
@@ -144,6 +126,8 @@ buildPythonApplication rec {
     "tests/kubernetes/"
     "tests/sca_package_2"
     "tests/terraform/"
+    "cdk_integration_tests/"
+    "sast_integration_tests"
     # Performance tests have no value for us
     "performance_tests/test_checkov_performance.py"
     # No Helm