Request to release the latest changes to pypi

[tejaschumbalkar]

We are affected due to jeremylong/DependencyCheck#5220

Can you release the latest changes to pypi?

[aikebah]

@tejaschumbalkar Have you seen https://github.com/jhermann/dependency-check-py#customization? You should be able to already upgrade locally to 7.4.4 with the configuration variables, no need to wait for a release from @jhermann (though an updated default version would be good).

[ShiboXing]

Hi @aikebah, thanks for the fix. Do you know the exact commands to execute?
I've set the version before installation but still get the SQL error:

export DEPENDENCY_CHECK_VERSION=7.4.4
export DEPENDENCY_CHECK_URL=https://github.com/jeremylong/DependencyCheck/releases/download/v7.4.4/dependency-check-7.4.4-release.zip
pip install 'dependency-check<1'

[aikebah]

@ShiboXing no python-user, but from the documentation of jhermann I deduce that.... assuming you did not customize it.... the current install of dependency-check cli is in ~/.local/dependencycheck and needs to be deleted... and then you just run dependencycheck with the environment variable DEPENDENCY_CHECK_VERSION set to 7.4.4

So the following I would expect to work:

rm -r ~/.local/dependency-check/bin/
export DEPENDENCY_CHECK_VERSION=7.4.4
dependency-check -v

[avoidik]

It seems DEPENDENCY_CHECK_URL should be set as well.

export DEPENDENCY_CHECK_URL='https://github.com/dependency-check/DependencyCheck/releases/download/v{version}/dependency-check-{version}-release.zip'
export DEPENDENCY_CHECK_VERSION='12.1.1'
dependency-check -v

How do you set NVD API key? Okay, this way:

dependency-check --nvdApiKey "$NVD_API_KEY" ...

[aikebah]

@avoidik It appears to me that this repo is stale and abandoned given that there have been no further updates/releases of it that are defaulting to a sane default version despite many new majors of the DependencyCheck software (among others due to changes at the NIST NVD). The current package still defaults to a 4-year old 6.x version of DependencyCheck.

In my view, even when not releasing to default to new majors, at the very least the move of the DependencyCheck project to the dependency-check github organisation should have been a trigger for a new release of this project had it been under active maintenance.

With that move (3 month ago, with a first release from the new repo location 2 months ago) the override of DEPENDENCY_CHECK_URL is indeed also required for continued use.

@jhermann Should this repository be considered abandonware? Or were you simply unaware of the changes?

[avoidik]

@aikebah indeed, it does look stale at a first glance, and didn't work out of the box for me, however it worked as expected (including NVD API authentication) after I added few environment varables and updated it. 🤷‍♂️

[avoidik]

Here is my working solution:

# set variables
export DEPENDENCY_CHECK_URL='https://github.com/dependency-check/DependencyCheck/releases/download/v{version}/dependency-check-{version}-release.zip'
export DEPENDENCY_CHECK_VERSION='12.1.1'
export DEPENDENCY_CHECK_HOME='dep-check-py'
export JAVA_HOME='/opt/jre'

# pick any jre you need
curl -fsSL https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.15%2B6/OpenJDK17U-jre_x64_linux_hotspot_17.0.15_6.tar.gz -o /tmp/jre.tar.gz
mkdir -p /opt/jre
tar -zxf /tmp/jre.tar.gz -C /opt/jre --strip-components 1
rm -f /tmp/jre.tar.gz

# prepare python venv
python -m venv /opt/venv
source /opt/venv/bin/activate
pip install dependency-check
dependency-check -v

# src - is a directory with the python source code to scan
# target - is a directory for scan results

mkdir -p target

CENTRAL_SEARCH_URL='https://central.sonatype.com/solrsearch/select'
NVD_API_KEY='...'

# scan
dependency-check \
        --scan src \
        --out target \
        --project sample-project \
        --exclude '**/__pycache__/**' \
        --centralUrl "$CENTRAL_SEARCH_URL" \
        --format JSON --format XML --format HTML \
        --nvdApiKey "$NVD_API_KEY" \
        --log target/dependency.log

The reports will be stored in the target directory and are ready to upload to SonarQube.

The central URL is changed to SonaType because current one search.maven.org is not a recommended option, and it seems supported on a best-effort basis based on https://status.maven.org/

The NVD API key could be requested at https://nvd.nist.gov/developers/request-an-api-key