Implements the vulnerability report by git-hyagi · Pull Request #1013 · pulp/pulp_python

git-hyagi · 2025-11-12T20:06:58Z

closes: #1012

gerrod3 · 2025-11-12T20:37:05Z

docs/user/guides/vulnerability_report.md

+REPO=$(pulp python repository show --name security-scan-repo)
+VERSION_HREF=$(echo $REPO | jq -r '.latest_version_href')
+
+# 5. Scan for vulnerabilities
+curl -XPOST -u <user>:<password> ${BASE_ADDR}${VERSION_HREF}scan/


Let's get this into the cli. Do you need help with adding the command?

hmm... I have never worked on the pulp-cli code. Let me study it a little :D

pulp/pulp-cli#1273

pulp_python/app/viewsets.py

gerrod3 · 2025-11-12T20:42:28Z

pulp_python/app/viewsets.py

+    repo_version = await sync_to_async(RepositoryVersion.objects.get)(pk=repo_version_pk)
+    content_units = python_models.PythonPackageContent.objects.filter(pk__in=repo_version.content)


Suggested change

repo_version = await sync_to_async(RepositoryVersion.objects.get)(pk=repo_version_pk)

content_units = python_models.PythonPackageContent.objects.filter(pk__in=repo_version.content)

repo_version = await RepositoryVersion.objects.aget(pk=repo_version_pk)

content_units = python_models.PythonPackageContent.objects.filter(pk__in=repo_version.content).values("name", "version")

For the

content_units = python_models.PythonPackageContent.objects.filter(pk__in=repo_version.content).values("name", "version")

I think this will not work because we also need the content objects found:
https://github.com/pulp/pulp_python/pull/1013/files#diff-38cc3b67ebd1f8ea44002fc7897552b1674435d85771f6ab27a0c86e383d00aeR666
https://github.com/pulp/pulpcore/blob/d9651981e20ac5b2dc1997f181204924f5c36cce/pulpcore/app/tasks/vulnerability_report.py#L133-L134

gerrod3 · 2025-11-12T20:43:14Z

pulp_python/app/viewsets.py

+    content_units = python_models.PythonPackageContent.objects.filter(pk__in=repo_version.content)
+    ecosystem = "PyPI"
+    async for content in sync_to_async_iterable(content_units):
+        repo_content_osv_data = _build_osv_data(content.name, ecosystem, content.version)


Do we know if the osv requires the package name to be normalize? e.g. Django->django, pulp_python->pulp-python

it seems like we don't need it: https://github.com/google/osv.dev/pull/3088/files#diff-f0076c6d3c021f2596f325ce199b2781bfc3ef236eb3b854bab96d5641aa1087R193-R195

gerrod3

This is looking good, two small changes and I think we can LGTM.

gerrod3 · 2025-11-17T16:15:28Z

pulp_python/app/tasks/vulnerability_report.py

+    Retrieve Python package content from a repository version for vulnerability scanning.
+    """
+    repo_version = await RepositoryVersion.objects.aget(pk=repo_version_pk)
+    content_units = PythonPackageContent.objects.filter(pk__in=repo_version.content)


Suggested change

content_units = PythonPackageContent.objects.filter(pk__in=repo_version.content)

content_units = PythonPackageContent.objects.filter(pk__in=repo_version.content).only("name", "version")

There's a lot of metadata on the Package object, but we only need these two fields. Also, this one is different from values as it creates the model instance rather than just a dictionary, but it only populates the specified fields and pk so it should work.

awesome!! it worked!

gerrod3 · 2025-11-17T16:20:18Z

pulp_python/tests/functional/api/test_vulnerability_report.py

+    repo_version = python_bindings.RepositoriesPythonVersionsApi.read(
+        python_python_repository_version_href=latest_version_href
+    )


Suggested change

repo_version = python_bindings.RepositoriesPythonVersionsApi.read(

python_python_repository_version_href=latest_version_href

)

repo_version = python_bindings.RepositoriesPythonVersionsApi.read(latest_version_href)

jobselko · 2025-11-18T13:53:33Z

pyproject.toml

 requires-python = ">=3.11"
 dependencies = [
-  "pulpcore>=3.81.0,<3.100",
+  "pulpcore>=3.85.0,<3.100",


The bugfix we need for vuln reports will be in 3.85.3

good catch!

closes: pulp#1012

git-hyagi requested review from gerrod3 and jobselko November 12, 2025 20:06

git-hyagi force-pushed the add-vuln-report branch from 099575e to 8928a17 Compare November 12, 2025 20:08

gerrod3 requested changes Nov 12, 2025

View reviewed changes

git-hyagi force-pushed the add-vuln-report branch from 8928a17 to 3819f38 Compare November 13, 2025 17:41

git-hyagi mentioned this pull request Nov 14, 2025

Add support to pulp_python vulnerability report pulp/pulp-cli#1272

Closed

git-hyagi requested a review from gerrod3 November 14, 2025 19:37

git-hyagi force-pushed the add-vuln-report branch from 3819f38 to be0622e Compare November 14, 2025 19:52

gerrod3 requested changes Nov 17, 2025

View reviewed changes

git-hyagi force-pushed the add-vuln-report branch from be0622e to 8db7f9a Compare November 17, 2025 17:36

jobselko reviewed Nov 18, 2025

View reviewed changes

git-hyagi force-pushed the add-vuln-report branch from 8db7f9a to a48b9fe Compare November 18, 2025 14:05

Implements the vulnerability report

4f6c33f

closes: pulp#1012

git-hyagi force-pushed the add-vuln-report branch from a48b9fe to 4f6c33f Compare November 18, 2025 14:25

jobselko approved these changes Nov 18, 2025

View reviewed changes

gerrod3 approved these changes Nov 18, 2025

View reviewed changes

gerrod3 merged commit f6e6f00 into pulp:main Nov 18, 2025
23 of 25 checks passed

git-hyagi deleted the add-vuln-report branch November 18, 2025 15:48

		repo_version = await sync_to_async(RepositoryVersion.objects.get)(pk=repo_version_pk)
		content_units = python_models.PythonPackageContent.objects.filter(pk__in=repo_version.content)

	content_units = PythonPackageContent.objects.filter(pk__in=repo_version.content)
	content_units = PythonPackageContent.objects.filter(pk__in=repo_version.content).only("name", "version")

Conversation

git-hyagi commented Nov 12, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gerrod3 left a comment

Choose a reason for hiding this comment

Uh oh!

gerrod3 Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

gerrod3 Nov 17, 2025 •

edited

Loading