gitea-mirror/trivy
1
0
Fork 0
mirror of https://github.com/aquasecurity/trivy.git synced 2025-12-12 07:40:48 -08:00
Code Issues Packages Projects Releases Wiki Activity

fix: supporting .egg-info/METADATA in python.Packaging analyzer (#9151)

Browse Source 
Co-authored-by: Amit <amit.bhardwaj@aquasec.com>
This commit is contained in:
amitbhardwaj
2025-07-11 16:47:47 +05:30
committed by GitHub
parent 85a156c995
commit e306e2dc52
3 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/docs/coverage/language/python.md
View File

@@ -145,7 +145,7 @@ Trivy parses the manifest files of installed packages in container image scannin
See [here](https://packaging.python.org/en/latest/discussions/package-formats/) for the detail.
### Egg
Trivy looks for `*.egg-info`, `*.egg-info/PKG-INFO`, `*.egg` and `EGG-INFO/PKG-INFO` to identify Python packages.
Trivy looks for `*.egg-info`, `*.egg-info/METADATA`, `*.egg-info/PKG-INFO`, `*.egg` and `EGG-INFO/PKG-INFO` to identify Python packages.
### Wheel
Trivy looks for `.dist-info/METADATA` to identify Python packages.

2
pkg/fanal/analyzer/language/python/packaging/packaging.go
View File

@@ -48,6 +48,8 @@ var (
// https://setuptools.readthedocs.io/en/latest/deprecated/python_eggs.html#eggs-and-their-formats
".egg-info",
".egg-info/PKG-INFO",
// https://github.com/aquasecurity/trivy/issues/9171
".egg-info/METADATA",
}
)

5
pkg/fanal/analyzer/language/python/packaging/packaging_test.go
View File

@@ -161,6 +161,11 @@ func Test_packagingAnalyzer_Required(t *testing.T) {
filePath: "python2.7/site-packages/cssutils-1.0-py2.7.egg/EGG-INFO/PKG-INFO",
want: true,
},
{
name: "egg-info/METADATA",
filePath: "Amazon/AWSCLIV2/cryptography-3.3.2-py3.8.egg-info/METADATA",
want: true,
},
{
name: "egg-info",
filePath: "python3.8/site-packages/wrapt-1.12.1.egg-info",