Can the Python packaging scan packages in all of the directories?

[ysk24ok]

Question

According to https://aquasecurity.github.io/trivy/v0.54/docs/coverage/language/python/, for Python Trivy has scans for

• packages managers
• packaging

My container has requirements.txt and packages installed from the file using pip install -r.
IIUC, the pip scan, which is one of the scans for package managers, checks packages listed in the file, and the packaging scan checks packages installed on the file system.

It's possible to install the packages to wherever I want, but does the packaging scan all of the directories?

Target

Container Image

Scanner

Vulnerability

Output Format

None

Mode

None

Operating System

Linux

Version

No response

[knqyf263]

does the packaging scan all of the directories?

Yes

[ysk24ok]

Thank you!

[subodh101]

@knqyf263 Can it also check for directories into a storage/PVC mounted in a pod?
If yes, that means trivy checks all the root level folders?

bin   dev  home  lib64	mnt  proc     root  sbin  sys  usr
boot  etc  lib	 media	opt  project  run   srv   tmp  var

[knqyf263]

Yes, some directories are skipped by default, though.

trivy/pkg/fanal/walker/walk.go

Lines 17 to 22 in 2b6d8d9

	var defaultSkipDirs = []string{
	"**/.git",
	"proc",
	"sys",
	"dev",
	}

If you want, you can also pass --skip-dirs.

[subodh101]

Thank you for your reply.

trivy/pkg/fanal/analyzer/language/python/pip/pip.go

Line 132 in d1f8967

if venv := os.Getenv("VIRTUAL_ENV"); venv != "" {

Correct me if I am wrong with the flow of trivy execution?
1. If VIRTUAL_ENV is set, it tries to find the lib directory within the virtual environment and inside lib directory it looks for site-directory package.
2. From python executable’s directory, it constructs the path to lib directory by moving one level up and then followed by looking into site-directory package.
3. Lastly, It constructs a path two levels up from the python executable’s directory, then navigates to lib/site-packages.

And this is function keeps yielding the site-directory package paths to the parent function so that multiple location can be checked?

Why there is need to make a specific route because python executable’s directory could be located at a place deeper into the the folders such that constructing a path two levels up still won't find the lib/site-packages?

What happens if the python executable’s directory is not available in symbolic link or $PATH?
Edit: Above not relevant to container image scanning.

[ysk24ok]

For scanning packages (egg or wheel), I think python/packaging/packaging.go is used, not python/pip/pip.go, but I could be wrong.

[subodh101]

Okay, for "container scanning", only eggs and wheels are checked everywhere and skipping the some unnecessary folders?
https://aquasecurity.github.io/trivy/v0.54/docs/coverage/language/python/#packaging

[Not important] https://packaging.python.org/en/latest/discussions/wheel-vs-egg/ this link is broken, i found only a Japanese link.

[knqyf263]

Okay, for "container scanning", only eggs and wheels are checked everywhere and skipping the some unnecessary folders?

Yes, as documented.

[Not important] https://packaging.python.org/en/latest/discussions/wheel-vs-egg/ this link is broken, i found only a Japanese link.

We've fixed it in #7318.