This OSSIndex module for Python provides a common interface to querying the OSS Index.
This module is not designed for standalone use. If you're looking for a tool that can detect your application's dependencies and assess them for vulnerabilities against the OSS Index, perhaps you should check out Jake.
You can of course use this library in your own applications.
Install from pypi.org as you would any other Python module:
pip install ossindex-lib
First create an instance of OssIndex, optionally enabling local caching
o = OssIndex()
Then supply a List of PackageURL objects that you want to ask
OSS Index about. If you don't want to care about generating this list yourself, perhaps look to a tool like Jake
(which uses this library) and will do all the hard work for you!
As a quick test, you could run:
from ossindex.ossindex import OssIndex, PackageURL
from ossindex.model import OssIndexComponent, Vulnerability
o = OssIndex()
results: List[OssIndexComponent] = o.get_component_report(packages=[
PackageURL.from_string(purl='pkg:pypi/[email protected]')
])
for r in results:
print("{}: {} known vulnerabilities".format(r.coordinates, len(r.vulnerabilities)))
v: Vulnerability
for v in r.vulnerabilities:
print(' - {}'.format(str(v)))
... which would output something like ...
pkg:pypi/[email protected]: 1 known vulnerabilities
- <Vulnerability id=CVE-2018-20225, name=CVE-2018-20225, cvss_score=7.8>
This library send log events to a standard Python logger named ossindex. You can configure the logger to output as
required through the standard Python logging configuration.
- Support authentication against OSS Index
We endeavour to support all functionality for all current actively supported Python versions. However, some features may not be possible/present in older Python versions due to their lack of support.
See our CHANGELOG.
Remember:
It is worth noting that this is NOT SUPPORTED by Sonatype, and is a contribution of ours to the open source community (read: you!)
- Use this contribution at the risk tolerance that you have
- Do NOT file Sonatype support tickets related to
ossindex-lib - DO file issues here on GitHub, so that the community can pitch in
Phew, that was easier than I thought. Last but not least of all - have fun!