Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

_cli: Add warning when combining --require-hashes and -s osv #298

Merged
merged 2 commits into from
Jun 14, 2022
Merged

_cli: Add warning when combining --require-hashes and -s osv #298

merged 2 commits into from
Jun 14, 2022

Conversation

tetsuo-cpp
Copy link
Contributor

Closes #234

@tetsuo-cpp
Copy link
Contributor Author 

$ pip-audit --require-hashes -s osv -r requirements0.txt
WARNING:pip_audit._cli:The --require-hashes flag with --service osv only enforces hash presence NOT hash validity. Use --service pypi to enforce hash validity.

@tetsuo-cpp tetsuo-cpp requested a review from woodruffw June 14, 2022 16:09
@woodruffw
Copy link
Member

LGTM. Needs a CHANGELOG entry, but I can take care of that.

@woodruffw
CHANGELOG: record changes
96f93c5 
Signed-off-by: William Woodruff <[email protected]>
@woodruffw woodruffw merged commit 9296805 into main Jun 14, 2022
@woodruffw woodruffw deleted the alex/osv-hash-warning branch June 14, 2022 19:13
netbsd-srcmastr pushed a commit to NetBSD/pkgsrc that referenced this pull request Jul 3, 2022
@0-wiz-0
py-pip-audit: update to 2.3.4.
32fd15c 
## [2.3.4]

### Fixed

* Vulnerability fixing: the `--fix` flag now works for vulnerabilities found in
  requirement subdependencies. A new line is now added to the requirement file
  to explicitly pin the offending subdependency
  ([#297](pypa/pip-audit#297))

## [2.3.3]

### Changed

* CLI: `pip-audit` now warns on the combination of `-s osv` and
  `--require-hashes`, notifying users that only the PyPI service
  can fully verify hashes
  ([#298](pypa/pip-audit#298))

### Fixed

* CLI/Dependency sources: `--cache-dir=...` and other flags that affect
  dependency resolver behavior now work correctly when auditing a
  `pyproject.toml` dependency source
  ([#300](pypa/pip-audit#300))

## [2.3.2] - 2022-05-14

### Changed

* CLI: `pip-audit`'s progress spinner has been refactored to make it
  faster and more responsive
  ([#283](pypa/pip-audit#283))

* CLI, Vulnerability sources: the error message used to report
  connection failures to vulnerability sources was improved
  ([#287](pypa/pip-audit#287))

* Vulnerability sources: the OSV service is now more resilient
  to schema changes ([#288](pypa/pip-audit#288))

* Vulnerability sources: the PyPI service provides a better
  error message during some cases of service degradation
  ([#294](pypa/pip-audit#294))

### Fixed

* Vulnerability sources: a bug stemming from an incorrect assumption
  about OSV's schema guarantees was fixed
  ([#284](pypa/pip-audit#284))

* Caching: `pip-audit` now respects `pip`'s `PIP_NO_CACHE_DIR`
  and will not attempt to use the `pip` cache if present
  ([#290](pypa/pip-audit#290))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@woodruffw woodruffw woodruffw approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Verify hashes with PyPI when using OSV as a vulnerability service
2 participants
@tetsuo-cpp @woodruffw