[Starlingx-discuss] Adding Bandit to additional repos and packages

Saul Wold sgw at linux.intel.com
Tue Apr 21 21:28:17 UTC 2020


Flock Folks,

Sorry I missed the Flock meeting this morning, I would like to discuss 
this in the community meeting if we have time.

We are working to add bandit[0] (the python static scanner), running it 
over all python.  Sharath is starting with adding a general zuul project 
template [1] that will be available to all StarlingX repos. An example 
of it's usage is in fault [2].

As Al pointed out in the initial (now abandoned) config review, we are 
running bandit in sysinv. I would like to know what the history of 
having tox.ini in the lower directories is.  As we want to run bandit on 
all the python code in config and other repos.  Is this something we can 
undo and move up?

Also, are we tracking someplace when we move something to the skip 
category? I see that most of the High issues are currently being 
skipped.  If we are skipping known issues, can we use the baseline 
feature somehow to catch potential new issues?

Thanks
   Sau!

[0] https://github.com/PyCQA/bandit
[1] https://review.opendev.org/#/c/721294/
[2] https://review.opendev.org/#/c/721307/



More information about the Starlingx-discuss mailing list