[Starlingx-discuss] Bandit
Saul Wold
sgw at linux.intel.com
Wed May 6 17:59:20 UTC 2020
TSC Members:
During the TSC call today, I brought up running bandit[0] to the flock
repos. Bandit is a code scanner that looks for common security related
issues in Python. It was initially an OpenStack project that has since
migrated to Python Code Quality Authority. It is actively being
maintained. Bandit is being used by other OpenStack projects via Tox and
Zuul jobs such as Cinder and Armada[1].
There are other possible options[2] (not a comprehensive search), but
they don't are either older (not maintained), python2 only or not truly
opensource. If the community has other suggestions, I am welcome the
additional data.
The zuul job should not add too much time, since all the zuul jobs run
in parallel. Currently the zuul job is no-voting, the initial scan has
identified about 75 High issues. Most are dealing with subprocess being
called with shell equals True, there is also a few deprecated libraries.
These will need to be evaluated, it's on the schedule for the PTG.
There are also options to set a baseline and use it for checking new
failures.
Based on the above are there any objections to continue enabling bandit
for the StarlingX project's python code?
Sau!
[0] https://github.com/PyCQA/bandit
[1] https://wiki.openstack.org/wiki/Security/Projects/Bandit
[2] https://geekflare.com/find-python-security-vulnerabilities/
More information about the Starlingx-discuss
mailing list