53 lines
1.9 KiB
Markdown
53 lines
1.9 KiB
Markdown
# Dependency security
|
|
|
|
This project treats the locked test dependency set as the dependency-review
|
|
surface. Local bootstrap, pull-request CI, and the weekly scheduled audit all
|
|
check `constraints-test.txt` with `pip-audit`.
|
|
|
|
## What gets audited
|
|
|
|
- `constraints-test.txt` pins the `[test]` extras from `pyproject.toml` plus
|
|
their transitive dependencies.
|
|
- The bootstrap scripts install the test extras against that lock, then run
|
|
`pip-audit` on the installed environment.
|
|
- CI audits the committed lock with `pip-audit -r constraints-test.txt` on each
|
|
pull request and on a weekly schedule, so newly disclosed CVEs in old pins are
|
|
caught even when nobody has touched the dependency files.
|
|
- Bandit remains a separate first-party-code scan. A green Bandit job does not
|
|
mean the dependency lock is clean.
|
|
|
|
## Regenerating the lock
|
|
|
|
Regenerate the lock only as an intentional dependency-change PR:
|
|
|
|
```powershell
|
|
scripts\bootstrap_test_env.ps1 -Force -Relock
|
|
```
|
|
|
|
```bash
|
|
bash scripts/bootstrap_test_env.sh --force --relock
|
|
```
|
|
|
|
Review and commit the resulting `constraints-test.txt` diff. Do not hand-edit
|
|
individual pins unless you are immediately re-running the relock command to
|
|
prove the full resolved set.
|
|
|
|
## Responding to a CVE
|
|
|
|
1. Open or update a dependency-security issue with the vulnerable package,
|
|
affected version, fixed version, and audit output.
|
|
2. Relock with the commands above.
|
|
3. Confirm `pip-audit` reports no known vulnerabilities.
|
|
4. Run the focused bootstrap/CI contract tests:
|
|
|
|
```powershell
|
|
.\.venv\Scripts\python -m pytest tests\scripts\test_bootstrap_constraints.py -q
|
|
```
|
|
|
|
5. If the relock changes more than the vulnerable package and normal
|
|
transitive bumps, call that out in the PR description so reviewers know what
|
|
to inspect.
|
|
|
|
Use `-NoAudit` / `--no-audit` only for explicit offline troubleshooting. Do not
|
|
merge a dependency lock that has not passed the audit gate.
|