:Code: https://github.com/jhermann/dependency-check-py#readme
:Docs: https://github.com/jeremylong/dependencycheck#readme
:CI: https://travis-ci.org/jhermann/dependency-check-py
:Issues: https://github.com/jhermann/dependency-check-py/issues
Overview
--------
``dependency-check`` scans application dependencies and checks whether they contain any published vulnerabilities
(based on the NIST `NVD`_).
It runs in the JVM, so you need some form of ``java`` available in your ``PATH``.
The script should work on Linux, Mac OSX and Windows, but right now is only tested on Linux.
Usage
-----
After installation, you'll have the ``dependency-check`` command available that, on first use,
will automatically download and install the OWASP release archive once for all projects.
It'll then redirect any calls to that installation, meaning the downloaded NVD data is shared
amongst projects.
.. code-block::
dependency-check --disableAssembly -s . -o build --project "$(python ./setup.py --name)" \
--exclude ".git/**" --exclude ".venv/**" --exclude "**/__pycache__/**" --exclude ".tox/**" \
&& xdg-open build/dependency-check-report.html
Please see the `DependencyCheck site`_ for more configuration and usage details.
To install from PyPI, add ``dependency-check`` to your ``dev-requirements.txt``
or a similar file. For more installation options, see the “Installation” section below.
|Installation Demo|
Customization
-------------
Using environment variables, you can change the version and download location of the release archive,
and the directory for the local installation.
=============================== ==============================================================================================
Variable Default
=============================== ==============================================================================================
``DEPENDENCY_CHECK_VERSION`` ``6.2.2``
``DEPENDENCY_CHECK_URL`` ``https://github.com/jeremylong/DependencyCheck/releases/download/v{version}/dependency-check-{version}-release.zip``
``DEPENDENCY_CHECK_HOME`` ``~/.local/dependency-check``
``DEPENDENCY_CHECK_NVD_URL`` *Use NIST NVD URLs*
=============================== ==============================================================================================
To update to a new version of the OWASP software,
delete ``~/.local/dependency-check/bin/``,
set ``DEPENDENCY_CHECK_VERSION`` to the new version number,
and call ``dependency-check``.
The variable ``DEPENDENCY_CHECK_NVD_URL`` can be used to point to a local copy of the various NVD feeds,
in a flat hierarchy with compressed JSON files.
.. code-block:: shell
export DEPENDENCY_CHECK_NVD_URL='https://repo.local/nvd/nvdcve-1.1-%d.json.gz'
If you set this, the options ``--cveUrlBase`` and ``--cveUrlModified`` will be added to each call.
Note that the ``%d`` representing the year is replaced by ``modified`` for the latter.
Remove the ``~/.local/dependency-check/data/`` directory to force a full data reload.
Installation
------------
To just get the ``dependency-check`` CLI tool installed into your home,
independent of any project, call ``python3 -m pip install --user dependency-check`` as usual,
see `releases`_ for an overview of available versions.
If you prefer an **isolated and easily removable venv installation**,
consider using `dephell jail install dependency-check`_ instead.
To get a bleeding-edge version from source, use these commands::
repo="jhermann/dependency-check-py"
python3 -m pip install -r "https://raw.githubusercontent.com/$repo/master/requirements.txt"
python3 -m pip install "https://github.com/$repo/archive/master.zip#egg=dependency-check"
As a developer, to create a working directory for this project, call these commands::
git clone "https://github.com/jhermann/dependency-check-py.git"
cd "dependency-check-py"
command . .env --yes --develop
invoke build --docs test check
You might also need to follow some
`setup procedures <https://py-generic-project.readthedocs.io/en/latest/installing.html#quick-setup>`_
to make the necessary basic commands available on *Linux*, *Mac OS X*, and *Windows*.
Other Python Security Tools
---------------------------
* `openstack/bandit`_ – Security linter designed to find common security issues in Python code, by static AST analysis.
* `pyupio/safety`_ – Safety checks your installed dependencies for known security vulnerabilities.
* `pyupio/safety-db`_ – A curated database of security vulnerabilities in Python packages.
* `eliasgranderubio/dagda`_ – Static analysis of known vulnerabilities, trojans, viruses, malware & other malicious threats in Docker images, and runtime monitoring of containers for anomalous activities.
* `anchore/anchore-engine`_ – A service for inspection, analysis and certification of container images, provided as a ready-to-deploy Docker container image.
* `vintasoftware/python-linters-and-code-analysis`_ – Curated list of Python linters and code analysis tools.
.. _`openstack/bandit`: https://github.com/openstack/bandit
.. _`pyupio/safety`: https://github.com/pyupio/safety
.. _`pyupio/safety-db`: https://github.com/pyupio/safety-db
.. _`eliasgranderubio/dagda`: https://github.com/eliasgranderubio/dagda
.. _`anchore/anchore-engine`: https://github.com/anchore/anchore-engine
.. _`vintasoftware/python-linters-and-code-analysis`: https://github.com/vintasoftware/python-linters-and-code-analysis
.. _`NVD`: https://nvd.nist.gov/
.. _`OWASP dependency-check-cli`: https://github.com/jeremylong/dependencycheck#readme
.. _`DependencyCheck site`: https://www.owasp.org/index.php/OWASP_Dependency_Check
.. _`pip script installer`: https://github.com/mitsuhiko/pipsi#pipsi
.. _`releases`: https://github.com/jhermann/dependency-check-py/releases
.. _`dephell jail install dependency-check`: https://dephell.readthedocs.io/cmd-jail-install.html
.. |Installation Demo| image:: https://raw.githubusercontent.com/jhermann/dependency-check-py/master/dependency_check.gif
.. |Travis CI| image:: https://api.travis-ci.org/jhermann/dependency-check-py.svg
:target: https://travis-ci.org/jhermann/dependency-check-py
.. |Coveralls| image:: https://img.shields.io/coveralls/jhermann/dependency-check-py.svg
:target: https://coveralls.io/r/jhermann/dependency-check-py
.. |GitHub Issues| image:: https://img.shields.io/github/issues/jhermann/dependency-check-py.svg
:target: https://github.com/jhermann/dependency-check-py/issues
.. |License| image:: https://img.shields.io/pypi/l/dependency-check.svg
:target: https://github.com/jhermann/dependency-check-py/blob/master/LICENSE
.. |Development Status| image:: https://img.shields.io/pypi/status/dependency-check.svg
:target: https://pypi.python.org/pypi/dependency-check/
.. |Latest Version| image:: https://img.shields.io/pypi/v/dependency-check.svg
:target: https://pypi.python.org/pypi/dependency-check/
.. |Download format| image:: https://img.shields.io/pypi/format/dependency-check.svg
:target: https://pypi.python.org/pypi/dependency-check/
.. |Downloads| image:: https://img.shields.io/pypi/dw/dependency-check.svg
:target: https://pypi.python.org/pypi/dependency-check/
Raw data
{
"_id": null,
"home_page": "https://github.com/jhermann/dependency-check-py",
"name": "dependency-check",
"maintainer": "",
"docs_url": null,
"requires_python": "",
"maintainer_email": "",
"keywords": "owasp,security,vulnerability,quality-assurance",
"author": "J\u00fcrgen Hermann",
"author_email": "jh@web.de",
"download_url": "https://files.pythonhosted.org/packages/1e/87/f52b894b93b1aec834c1d91ce3e818b880544af2de2c80f08780a1d73704/dependency-check-0.6.0.zip",
"platform": "",
"description": ":Code: https://github.com/jhermann/dependency-check-py#readme\n:Docs: https://github.com/jeremylong/dependencycheck#readme\n:CI: https://travis-ci.org/jhermann/dependency-check-py\n:Issues: https://github.com/jhermann/dependency-check-py/issues\n\n\nOverview\n--------\n\n``dependency-check`` scans application dependencies and checks whether they contain any published vulnerabilities\n(based on the NIST `NVD`_).\nIt runs in the JVM, so you need some form of ``java`` available in your ``PATH``.\nThe script should work on Linux, Mac OSX and Windows, but right now is only tested on Linux.\n\n\nUsage\n-----\n\nAfter installation, you'll have the ``dependency-check`` command available that, on first use,\nwill automatically download and install the OWASP release archive once for all projects.\nIt'll then redirect any calls to that installation, meaning the downloaded NVD data is shared\namongst projects.\n\n.. code-block::\n\n dependency-check --disableAssembly -s . -o build --project \"$(python ./setup.py --name)\" \\\n --exclude \".git/**\" --exclude \".venv/**\" --exclude \"**/__pycache__/**\" --exclude \".tox/**\" \\\n && xdg-open build/dependency-check-report.html\n\nPlease see the `DependencyCheck site`_ for more configuration and usage details.\n\nTo install from PyPI, add ``dependency-check`` to your ``dev-requirements.txt``\nor a similar file. For more installation options, see the \u201cInstallation\u201d section below.\n\n |Installation Demo|\n\n\nCustomization\n-------------\n\nUsing environment variables, you can change the version and download location of the release archive,\nand the directory for the local installation.\n\n=============================== ==============================================================================================\nVariable Default\n=============================== ==============================================================================================\n``DEPENDENCY_CHECK_VERSION`` ``6.2.2``\n``DEPENDENCY_CHECK_URL`` ``https://github.com/jeremylong/DependencyCheck/releases/download/v{version}/dependency-check-{version}-release.zip``\n``DEPENDENCY_CHECK_HOME`` ``~/.local/dependency-check``\n``DEPENDENCY_CHECK_NVD_URL`` *Use NIST NVD URLs*\n=============================== ==============================================================================================\n\nTo update to a new version of the OWASP software,\ndelete ``~/.local/dependency-check/bin/``,\nset ``DEPENDENCY_CHECK_VERSION`` to the new version number,\nand call ``dependency-check``.\n\nThe variable ``DEPENDENCY_CHECK_NVD_URL`` can be used to point to a local copy of the various NVD feeds,\nin a flat hierarchy with compressed JSON files.\n\n.. code-block:: shell\n\n export DEPENDENCY_CHECK_NVD_URL='https://repo.local/nvd/nvdcve-1.1-%d.json.gz'\n\nIf you set this, the options ``--cveUrlBase`` and ``--cveUrlModified`` will be added to each call.\nNote that the ``%d`` representing the year is replaced by ``modified`` for the latter.\n\nRemove the ``~/.local/dependency-check/data/`` directory to force a full data reload.\n\n\nInstallation\n------------\n\nTo just get the ``dependency-check`` CLI tool installed into your home,\nindependent of any project, call ``python3 -m pip install --user dependency-check`` as usual,\nsee `releases`_ for an overview of available versions.\n\nIf you prefer an **isolated and easily removable venv installation**,\nconsider using `dephell jail install dependency-check`_ instead.\n\nTo get a bleeding-edge version from source, use these commands::\n\n repo=\"jhermann/dependency-check-py\"\n python3 -m pip install -r \"https://raw.githubusercontent.com/$repo/master/requirements.txt\"\n python3 -m pip install \"https://github.com/$repo/archive/master.zip#egg=dependency-check\"\n\nAs a developer, to create a working directory for this project, call these commands::\n\n git clone \"https://github.com/jhermann/dependency-check-py.git\"\n cd \"dependency-check-py\"\n command . .env --yes --develop\n invoke build --docs test check\n\nYou might also need to follow some\n`setup procedures <https://py-generic-project.readthedocs.io/en/latest/installing.html#quick-setup>`_\nto make the necessary basic commands available on *Linux*, *Mac OS X*, and *Windows*.\n\n\nOther Python Security Tools\n---------------------------\n\n* `openstack/bandit`_ \u2013 Security linter designed to find common security issues in Python code, by static AST analysis.\n* `pyupio/safety`_ \u2013 Safety checks your installed dependencies for known security vulnerabilities.\n\n * `pyupio/safety-db`_ \u2013 A curated database of security vulnerabilities in Python packages.\n\n* `eliasgranderubio/dagda`_ \u2013 Static analysis of known vulnerabilities, trojans, viruses, malware & other malicious threats in Docker images, and runtime monitoring of containers for anomalous activities.\n* `anchore/anchore-engine`_ \u2013 A service for inspection, analysis and certification of container images, provided as a ready-to-deploy Docker container image.\n\n* `vintasoftware/python-linters-and-code-analysis`_ \u2013 Curated list of Python linters and code analysis tools.\n\n\n.. _`openstack/bandit`: https://github.com/openstack/bandit\n.. _`pyupio/safety`: https://github.com/pyupio/safety\n.. _`pyupio/safety-db`: https://github.com/pyupio/safety-db\n.. _`eliasgranderubio/dagda`: https://github.com/eliasgranderubio/dagda\n.. _`anchore/anchore-engine`: https://github.com/anchore/anchore-engine\n.. _`vintasoftware/python-linters-and-code-analysis`: https://github.com/vintasoftware/python-linters-and-code-analysis\n\n.. _`NVD`: https://nvd.nist.gov/\n.. _`OWASP dependency-check-cli`: https://github.com/jeremylong/dependencycheck#readme\n.. _`DependencyCheck site`: https://www.owasp.org/index.php/OWASP_Dependency_Check\n.. _`pip script installer`: https://github.com/mitsuhiko/pipsi#pipsi\n.. _`releases`: https://github.com/jhermann/dependency-check-py/releases\n.. _`dephell jail install dependency-check`: https://dephell.readthedocs.io/cmd-jail-install.html\n\n.. |Installation Demo| image:: https://raw.githubusercontent.com/jhermann/dependency-check-py/master/dependency_check.gif\n\n.. |Travis CI| image:: https://api.travis-ci.org/jhermann/dependency-check-py.svg\n :target: https://travis-ci.org/jhermann/dependency-check-py\n.. |Coveralls| image:: https://img.shields.io/coveralls/jhermann/dependency-check-py.svg\n :target: https://coveralls.io/r/jhermann/dependency-check-py\n.. |GitHub Issues| image:: https://img.shields.io/github/issues/jhermann/dependency-check-py.svg\n :target: https://github.com/jhermann/dependency-check-py/issues\n.. |License| image:: https://img.shields.io/pypi/l/dependency-check.svg\n :target: https://github.com/jhermann/dependency-check-py/blob/master/LICENSE\n.. |Development Status| image:: https://img.shields.io/pypi/status/dependency-check.svg\n :target: https://pypi.python.org/pypi/dependency-check/\n.. |Latest Version| image:: https://img.shields.io/pypi/v/dependency-check.svg\n :target: https://pypi.python.org/pypi/dependency-check/\n.. |Download format| image:: https://img.shields.io/pypi/format/dependency-check.svg\n :target: https://pypi.python.org/pypi/dependency-check/\n.. |Downloads| image:: https://img.shields.io/pypi/dw/dependency-check.svg\n :target: https://pypi.python.org/pypi/dependency-check/\n\n",
"bugtrack_url": null,
"license": "Apache 2.0",
"summary": "Shim to easily install OWASP dependency-check-cli into Python projects",
"version": "0.6.0",
"split_keywords": [
"owasp",
"security",
"vulnerability",
"quality-assurance"
],
"urls": [
{
"comment_text": "",
"digests": {
"md5": "760ad31bacf68f057c0d092c43b50e22",
"sha256": "e237d12d038463b0b85d6ef89e6ccda512aaffd1c638904f1f28c5745fa9a56d"
},
"downloads": -1,
"filename": "dependency_check-0.6.0-py2.py3-none-any.whl",
"has_sig": false,
"md5_digest": "760ad31bacf68f057c0d092c43b50e22",
"packagetype": "bdist_wheel",
"python_version": "py2.py3",
"requires_python": null,
"size": 10193,
"upload_time": "2021-06-21T14:08:06",
"upload_time_iso_8601": "2021-06-21T14:08:06.858922Z",
"url": "https://files.pythonhosted.org/packages/6d/1b/ce24ef6aff822fa8be8f424920ea04e0c4753320438aa0c6f82cc377de23/dependency_check-0.6.0-py2.py3-none-any.whl",
"yanked": false,
"yanked_reason": null
},
{
"comment_text": "",
"digests": {
"md5": "1be036cf738a41e1eba75ba72b332b9e",
"sha256": "6fa00b63fbdba57210825675956467ea67693a47b6ef192046f9a51732f22c7f"
},
"downloads": -1,
"filename": "dependency-check-0.6.0.zip",
"has_sig": false,
"md5_digest": "1be036cf738a41e1eba75ba72b332b9e",
"packagetype": "sdist",
"python_version": "source",
"requires_python": null,
"size": 138676,
"upload_time": "2021-06-21T14:08:08",
"upload_time_iso_8601": "2021-06-21T14:08:08.373937Z",
"url": "https://files.pythonhosted.org/packages/1e/87/f52b894b93b1aec834c1d91ce3e818b880544af2de2c80f08780a1d73704/dependency-check-0.6.0.zip",
"yanked": false,
"yanked_reason": null
}
],
"upload_time": "2021-06-21 14:08:08",
"github": true,
"gitlab": false,
"bitbucket": false,
"github_user": "jhermann",
"github_project": "dependency-check-py",
"travis_ci": true,
"coveralls": false,
"github_actions": false,
"requirements": [],
"lcname": "dependency-check"
}
JSON
