[Starlingx-discuss] Bandit

Saul Wold sgw at linux.intel.com
Wed May 6 17:59:20 UTC 2020


TSC Members:

During the TSC call today, I brought up running bandit[0] to the flock 
repos. Bandit is a code scanner that looks for common security related 
issues in Python. It was initially an OpenStack project that has since 
migrated to Python Code Quality Authority. It is actively being 
maintained. Bandit is being used by other OpenStack projects via Tox and 
Zuul jobs such as Cinder and Armada[1].

There are other possible options[2] (not a comprehensive search), but 
they don't are either older (not maintained), python2 only or not truly 
opensource. If the community has other suggestions, I am welcome the 
additional data.

The zuul job should not add too much time, since all the zuul jobs run 
in parallel. Currently the zuul job is no-voting, the initial scan has 
identified about 75 High issues. Most are dealing with subprocess being 
called with shell equals True, there is also a few deprecated libraries.
These will need to be evaluated, it's on the schedule for the PTG. 
There are also options to set a baseline and use it for checking new 
failures.

Based on the above are there any objections to continue enabling bandit 
for the StarlingX project's python code?

Sau!


[0] https://github.com/PyCQA/bandit
[1] https://wiki.openstack.org/wiki/Security/Projects/Bandit
[2] https://geekflare.com/find-python-security-vulnerabilities/



More information about the Starlingx-discuss mailing list