|
4 | 4 | # SPDX-License-Identifier: Apache-2.0 |
5 | 5 | import logging |
6 | 6 | import os |
7 | | -import stat |
8 | 7 | import subprocess |
9 | | -import tempfile |
10 | | -import urllib.request |
11 | | -import zipfile |
12 | 8 | import sys |
13 | 9 |
|
14 | 10 | logger = logging.getLogger(__name__) |
15 | | -DEPENDENCY_CHECK_VERSION = "12.1.7" |
16 | 11 |
|
17 | | - |
18 | | -def _install_dependency_check(): |
19 | | - """Install OWASP dependency-check""" |
20 | | - try: |
21 | | - # Skip if explicitly disabled |
22 | | - if os.environ.get('FOSSLIGHT_SKIP_AUTO_INSTALL', '').lower() in ('1', 'true', 'yes'): |
23 | | - logger.info("Auto-install disabled by environment variable") |
24 | | - return |
25 | | - |
26 | | - env_home = os.environ.get('DEPENDENCY_CHECK_HOME', '').strip() |
27 | | - install_dir = None |
28 | | - forced_env = False |
29 | | - if env_home: |
30 | | - # Normalize |
31 | | - env_home_abs = os.path.abspath(env_home) |
32 | | - # Detect if env_home already the actual extracted root (ends with dependency-check) |
33 | | - candidate_bin_win = os.path.join(env_home_abs, 'bin', 'dependency-check.bat') |
34 | | - candidate_bin_nix = os.path.join(env_home_abs, 'bin', 'dependency-check.sh') |
35 | | - if os.path.exists(candidate_bin_win) or os.path.exists(candidate_bin_nix): |
36 | | - # env points directly to dependency-check root; install_dir is its parent |
37 | | - install_dir = os.path.dirname(env_home_abs) |
38 | | - forced_env = True |
39 | | - else: |
40 | | - # Assume env_home is the base directory where we should extract dependency-check/ |
41 | | - install_dir = env_home_abs |
42 | | - |
43 | | - if not install_dir: |
44 | | - # Fallback hierarchy: executable dir (if frozen) -> CWD |
45 | | - candidate_base = None |
46 | | - if getattr(sys, 'frozen', False): |
47 | | - exe_dir = os.path.dirname(os.path.abspath(sys.executable)) |
48 | | - candidate_base = os.path.join(exe_dir, 'fosslight_dc_bin') |
49 | | - |
50 | | - if not os.access(exe_dir, os.W_OK): |
51 | | - candidate_base = None |
52 | | - else: |
53 | | - logger.debug(f"Using executable directory base: {candidate_base}") |
54 | | - if not candidate_base: |
55 | | - candidate_base = os.path.abspath(os.path.join(os.getcwd(), 'fosslight_dc_bin')) |
56 | | - install_dir = candidate_base |
57 | | - else: |
58 | | - logger.debug(f"Resolved install_dir: {install_dir}") |
59 | | - bin_dir = os.path.join(install_dir, 'dependency-check', 'bin') |
60 | | - if sys.platform.startswith('win'): |
61 | | - dc_path = os.path.join(bin_dir, 'dependency-check.bat') |
62 | | - else: |
63 | | - dc_path = os.path.join(bin_dir, 'dependency-check.sh') |
64 | | - |
65 | | - # Check if dependency-check already exists |
66 | | - if os.path.exists(dc_path): |
67 | | - try: |
68 | | - result = subprocess.run([dc_path, '--version'], capture_output=True, text=True, timeout=10) |
69 | | - if result.returncode == 0: |
70 | | - logger.debug("dependency-check already installed and working") |
71 | | - # If we detected an existing root via env, retain it, else set home now. |
72 | | - if forced_env: |
73 | | - os.environ['DEPENDENCY_CHECK_HOME'] = env_home_abs |
74 | | - else: |
75 | | - os.environ['DEPENDENCY_CHECK_HOME'] = os.path.join(install_dir, 'dependency-check') |
76 | | - os.environ['DEPENDENCY_CHECK_VERSION'] = DEPENDENCY_CHECK_VERSION |
77 | | - return |
78 | | - except (subprocess.TimeoutExpired, FileNotFoundError) as ex: |
79 | | - logger.debug(f"Exception in dependency-check --version: {ex}") |
80 | | - pass |
81 | | - |
82 | | - # Download URL |
83 | | - download_url = (f"https://github.com/dependency-check/DependencyCheck/releases/" |
84 | | - f"download/v{DEPENDENCY_CHECK_VERSION}/" |
85 | | - f"dependency-check-{DEPENDENCY_CHECK_VERSION}-release.zip") |
86 | | - |
87 | | - os.makedirs(install_dir, exist_ok=True) |
88 | | - logger.info(f"Downloading dependency-check {DEPENDENCY_CHECK_VERSION} from {download_url} ...") |
89 | | - |
90 | | - # Download and extract |
91 | | - with urllib.request.urlopen(download_url) as response: |
92 | | - content = response.read() |
93 | | - |
94 | | - with tempfile.NamedTemporaryFile(suffix='.zip', delete=False) as tmp_file: |
95 | | - tmp_file.write(content) |
96 | | - tmp_zip_path = tmp_file.name |
97 | | - |
98 | | - with zipfile.ZipFile(tmp_zip_path, 'r') as zip_ref: |
99 | | - zip_ref.extractall(install_dir) |
100 | | - os.unlink(tmp_file.name) |
101 | | - |
102 | | - # Make shell scripts executable |
103 | | - if os.path.exists(bin_dir): |
104 | | - if sys.platform.startswith('win'): |
105 | | - # Windows: .bat files only |
106 | | - scripts = ["dependency-check.bat"] |
107 | | - else: |
108 | | - # Linux/macOS: .sh files only |
109 | | - scripts = ["dependency-check.sh", "completion-for-dependency-check.sh"] |
110 | | - |
111 | | - for script in scripts: |
112 | | - script_path = os.path.join(bin_dir, script) |
113 | | - if os.path.exists(script_path): |
114 | | - st = os.stat(script_path) |
115 | | - os.chmod(script_path, st.st_mode | stat.S_IEXEC) |
116 | | - |
117 | | - logger.info("✅ OWASP dependency-check installed successfully!") |
118 | | - logger.info(f"Installed to: {os.path.join(install_dir, 'dependency-check')}") |
119 | | - |
120 | | - # Set environment variables after successful installation |
121 | | - os.environ['DEPENDENCY_CHECK_VERSION'] = DEPENDENCY_CHECK_VERSION |
122 | | - os.environ['DEPENDENCY_CHECK_HOME'] = os.path.join(install_dir, 'dependency-check') |
123 | | - |
124 | | - return True |
125 | | - |
126 | | - except Exception as e: |
127 | | - logger.error(f"Failed to install dependency-check: {e}") |
128 | | - logger.info("dependency-check can be installed manually from: https://github.com/dependency-check/DependencyCheck/releases") |
129 | | - return False |
130 | | - |
131 | | - |
132 | | -def _auto_install_dependencies(): |
133 | | - """Auto-install required dependencies if not present.""" |
134 | | - # Only run this once per session |
135 | | - if hasattr(_auto_install_dependencies, '_already_run'): |
| 12 | +# Static path always used; environment overrides are ignored now. |
| 13 | +_PKG_DIR = os.path.dirname(__file__) |
| 14 | +_DC_HOME = os.path.join(_PKG_DIR, 'third_party', 'dependency-check') |
| 15 | + |
| 16 | +# Fallback: project root layout (editable install) or current working directory |
| 17 | +if not os.path.isdir(_DC_HOME): |
| 18 | + _PROJECT_ROOT = os.path.abspath(os.path.join(_PKG_DIR, '..', '..')) |
| 19 | + candidate = os.path.join(_PROJECT_ROOT, 'third_party', 'dependency-check') |
| 20 | + if os.path.isdir(candidate): |
| 21 | + _DC_HOME = candidate |
| 22 | + else: |
| 23 | + cwd_candidate = os.path.join(os.getcwd(), 'third_party', 'dependency-check') |
| 24 | + if os.path.isdir(cwd_candidate): |
| 25 | + _DC_HOME = cwd_candidate |
| 26 | +if not os.path.isdir(_DC_HOME) and getattr(sys, 'frozen', False): |
| 27 | + # Frozen executable scenario (PyInstaller onefile): check exe dir and _MEIPASS temp dir. |
| 28 | + exe_dir = os.path.dirname(os.path.abspath(sys.executable)) |
| 29 | + exe_candidate = os.path.join(exe_dir, 'third_party', 'dependency-check') |
| 30 | + if os.path.isdir(exe_candidate): |
| 31 | + _DC_HOME = exe_candidate |
| 32 | + else: |
| 33 | + tmp_root = getattr(sys, '_MEIPASS', '') |
| 34 | + if tmp_root: |
| 35 | + tmp_candidate = os.path.join(tmp_root, 'third_party', 'dependency-check') |
| 36 | + if os.path.isdir(tmp_candidate): |
| 37 | + _DC_HOME = tmp_candidate |
| 38 | + |
| 39 | + |
| 40 | +def get_dependency_check_script(): |
| 41 | + """Return path to static dependency-check CLI script or None if missing.""" |
| 42 | + bin_dir = os.path.join(_DC_HOME, 'bin') |
| 43 | + if sys.platform.startswith('win'): |
| 44 | + script = os.path.join(bin_dir, 'dependency-check.bat') |
| 45 | + else: |
| 46 | + script = os.path.join(bin_dir, 'dependency-check.sh') |
| 47 | + return script if os.path.isfile(script) else None |
| 48 | + |
| 49 | + |
| 50 | +def _set_version_env(script_path): |
| 51 | + """Attempt to run '--version' to populate DEPENDENCY_CHECK_VERSION; ignore errors.""" |
| 52 | + if not script_path or not os.path.exists(script_path): |
136 | 53 | return |
137 | | - _auto_install_dependencies._already_run = True |
138 | | - |
139 | 54 | try: |
140 | | - # Install binary version |
141 | | - _install_dependency_check() |
| 55 | + result = subprocess.run([script_path, '--version'], capture_output=True, text=True, timeout=8) |
| 56 | + if result.returncode == 0: |
| 57 | + version_line = (result.stdout or '').strip().splitlines()[-1] |
| 58 | + if version_line: |
| 59 | + os.environ['DEPENDENCY_CHECK_VERSION'] = version_line |
| 60 | + except Exception as ex: |
| 61 | + logger.debug(f"Could not obtain dependency-check version: {ex}") |
| 62 | + |
| 63 | + |
| 64 | +def _init_static_dependency_check(): |
| 65 | + if not os.path.isdir(_DC_HOME): |
| 66 | + logger.info("Dependency-check not found under third_party/dependency-check.") |
| 67 | + return |
| 68 | + os.environ['DEPENDENCY_CHECK_HOME'] = _DC_HOME |
| 69 | + script = get_dependency_check_script() |
| 70 | + _set_version_env(script) |
| 71 | + logger.debug(f"dependency-check home set to: {_DC_HOME}") |
142 | 72 |
|
143 | | - logger.info(f"✅ dependency-check setup completed with version {DEPENDENCY_CHECK_VERSION}") |
144 | | - except Exception as e: |
145 | | - logger.warning(f"Auto-install failed: {e}") |
146 | 73 |
|
| 74 | +# Perform lightweight initialization (no network, no extraction) |
| 75 | +_init_static_dependency_check() |
147 | 76 |
|
148 | | -# Auto-install on import |
149 | | -_auto_install_dependencies() |
| 77 | +__all__ = [ |
| 78 | + 'get_dependency_check_script' |
| 79 | +] |
0 commit comments