pypi

README

PyPI

Reference matching

For PyPI, we find package reference URLs by doing a BigQuery query on the public PyPI dataset.

bq query --max_rows=10000000 --format=json --nouse_legacy_sql < pypi_links.sql > pypi_links.json

This is also continuously updated and available at https://storage.googleapis.com/pypa-advisory-db/triage/pypi_links.json

However this includes packages that no longer exist or were deleted, so we check against the pypi simple API to make sure any matches actually exist.

Version matching

We also extract all valid versions by doing:

bq query --max_rows=10000000 --format=json --nouse_legacy_sql < pypi_versions.sql > pypi_versions.json

This is also continuously updated and available at https://storage.googleapis.com/pypa-advisory-db/triage/pypi_versions.json

Documentation

Index

• func NormalizePackageName(name string) string
• type PyPI
  • func New(pypiLinksPath string, pypiVersionsPath string) *PyPI
  • func (p *PyPI) Matches(cve cves.CVE, falsePositives *triage.FalsePositives) []string
  • func (p *PyPI) PackageURL(pkg string) string
  • func (p *PyPI) Versions(pkg string) []string

Functions

func NormalizePackageName

func NormalizePackageName(name string) string

NormalizePackageName normalizes a PyPI package name.

Types

type PyPI

type PyPI struct {
	// contains filtered or unexported fields
}

func New

func New(pypiLinksPath string, pypiVersionsPath string) *PyPI

func (*PyPI) Matches

func (p *PyPI) Matches(cve cves.CVE, falsePositives *triage.FalsePositives) []string

func (*PyPI) PackageURL

func (p *PyPI) PackageURL(pkg string) string

func (*PyPI) Versions

func (p *PyPI) Versions(pkg string) []string