Does the OSSF Scorecard recognise poetry lock files?

[ff137]

Good day,

I can't find any references to poetry lock files in the existing issues or discussions.

Our project is not automatically picking up pinned dependencies in the poetry.lock file, and we're wondering how to remediate this.

GPT recommends exporting a requirements.txt file:

poetry export -f requirements.txt --output requirements.txt

Poetry is so widely adopted, I struggle to think that this is an idiomatic solution.

Any input or feedback will be appreciated.

[ff137]

Pinging last repo committer :-) @spencerschrock
Any insight will be appreciated 🙏

[spencerschrock]

The closest that we currently have for pip installs. And it's based on the detection of pip in scripts/shell blocks not requirements.txt .

scorecard/checks/raw/shell_download_validate.go

Lines 938 to 952 in b0143fc

	// Pip install.
	if isPipDownload(c) {
	r.Dependencies = append(r.Dependencies,
	checker.Dependency{
	Location: &checker.File{
	Path: pathfn,
	Type: finding.FileTypeSource,
	Offset: startLine,
	EndOffset: endLine,
	Snippet: cmd,
	},
	Pinned: asBoolPointer(!isPipUnpinnedDownload(c)),
	Type: checker.DependencyUseTypePipCommand,
	},
	)

Specifically looking for --require-hashes:

scorecard/checks/raw/shell_download_validate.go

Lines 552 to 639 in b0143fc

	func isUnpinnedPipInstall(cmd []string) bool {
	hasNoDeps := false
	isEditableInstall := false
	isPinnedEditableInstall := true
	hasRequireHashes := false
	hasAdditionalArgs := false
	hasWheel := false
	for i := 2; i < len(cmd); i++ {
	// Require --no-deps to not install the dependencies when doing editable install
	// because we can't verify if dependencies are pinned
	// https://pip.pypa.io/en/stable/topics/secure-installs/#do-not-use-setuptools-directly
	// https://github.com/pypa/pip/issues/4995
	if strings.EqualFold(cmd[i], "--no-deps") {
	hasNoDeps = true
	continue
	}
	// https://pip.pypa.io/en/stable/cli/pip_install/#cmdoption-e
	if slices.Contains([]string{"-e", "--editable"}, cmd[i]) {
	isEditableInstall = true
	continue
	}
	// https://github.com/ossf/scorecard/issues/1306#issuecomment-974539197.
	if strings.EqualFold(cmd[i], "--require-hashes") {
	hasRequireHashes = true
	break
	}
	// Catch not handled flags, otherwise is package
	if isFlag(cmd[i]) {
	continue
	}
	// Wheel package
	// Exclude *.whl as they're mostly used
	// for tests. See https://github.com/ossf/scorecard/pull/611.
	if strings.HasSuffix(cmd[i], ".whl") {
	// We continue because a command may contain
	// multiple packages to install, not just `.whl` files.
	hasWheel = true
	continue
	}
	// Editable install package source
	if isEditableInstall {
	isPinned := isPinnedEditableSource(cmd[i])
	if !isPinned {
	isPinnedEditableInstall = false
	}
	continue
	}
	hasAdditionalArgs = true
	}
	// --require-hashes and -e flags cannot be used together in pip install
	// -e and *.whl package cannot be used together in pip install
	// If is editable install, it's secure if package is from local source
	// or from remote (VCS install) pinned by hash, and if dependencies are
	// not installed.
	// Example: `pip install --no-deps -e git+https://git.repo/some_pkg.git@da39a3ee5e6b4b0d3255bfef95601890afd80709`
	if isEditableInstall {
	return !hasNoDeps || !isPinnedEditableInstall
	}
	// If hashes are required, it's pinned.
	if hasRequireHashes {
	return false
	}
	// With additional arguments, it's unpinned.
	// Example: `pip install bla.whl pkg1`
	if hasAdditionalArgs {
	return true
	}
	// No additional arguments and hashes are not required.
	// The only pinned command is `pip install *.whl`
	if hasWheel {
	return false
	}
	// Any other form of install is unpinned,
	// e.g. `pip install`.
	return true
	}

So the equivalent for poetry would be some combination of sync or install?

Poetry will display a Warning when executing an install command if poetry.lock and pyproject.toml are not synchronized.
Normally, you should prefer poetry sync to poetry install to avoid untracked outdated packages.

[ff137]

Hi Spencer,

Apologies, but I don't quite understand what this means.

Does this mean that OSSF Scorecard does not natively pick up pinned dependencies in a poetry.lock file?

I assume that there are other projects using OSSF Scorecards, which rely on poetry ... What do they do to get pinned dependencies to be picked up correctly?

[spencerschrock]

We don't score based on the existence of poetry.lock no. Rather the invocation of the command to make sure it's being used in a way that the poetry.lock is being used. I don't use Poetry so I was leaving a comment about whether we would want to look for poetry sync calls vs. poetry install

I assume that there are other projects using OSSF Scorecards, which rely on poetry ... What do they do to get pinned dependencies to be picked up correctly?

There's lots of room for improvement in how we handle ecosystems. I don't think anyone has asked us about Poetry before.

[ff137]

Interesting - I'm quite surprised that Poetry hasn't come up yet. It seemed quite pervasive to me.

I could look at trying to contribute something for this. The only question I would have is how the current requirements.txt files are parsed to identify how they're pinned or not.

All I know so far is that this is the github action performing the scorecard analysis for our project: https://github.com/openwallet-foundation/acapy/blob/main/.github/workflows/scorecard.yml

That's basically all I know! The workflow doesn't seem to need any specific config, so I imagine any poetry support should be implemented to be automatic.

Poetry lock files are all pinned dependencies. That's what poetry helps to accomplish. So, I guess the scorecard would just need to detect that these dependencies exist / are defined in the lock file, and that they are all pinned by references.

[spencerschrock]

The only question I would have is how the current requirements.txt files are parsed to identify how they're pinned or not.

See above response for how things are parsed in Scorecard, which is focused on the pip invocation rather than the requirements file:
#4516 (comment)