MobSF / mobsfscan

mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Swift, and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher.
GNU Lesser General Public License v3.0
607 stars 97 forks source link

error: externally-managed-environment python3 #93

Closed marcgeeklaberge closed 2 weeks ago

marcgeeklaberge commented 1 month ago

Input for our partial github action workflow

steps:
    - uses: actions/checkout@v4
    - name: ios security scan
      uses: MobSF/mobsfscan@main
      with:
        args: 'ios --json -c .mobsf'
steps:
    - uses: actions/checkout@v4
    - name: android security scan
      uses: MobSF/mobsfscan@main
      with:
        args: 'android --json -c .mobsf'

Output

Run MobSF/mobsfscan@main
  with:
    args: ios --json -c .mobsf
Run echo "::group::Installing mobsfscan dependencies"
  echo "::group::Installing mobsfscan dependencies"
  python3 -m pip install -r /home/runner/work/_actions/MobSF/mobsfscan/main/requirements.txt
  echo "::endgroup::"
  shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
Installing mobsfscan dependencies
  error: externally-managed-environment

  × This environment is externally managed
  ╰─> To install Python packages system-wide, try apt install
      python3-xyz, where xyz is the package you are trying to
      install.

      If you wish to install a non-Debian-packaged Python package,
      create a virtual environment using python3 -m venv path/to/venv.
      Then use path/to/venv/bin/python and path/to/venv/bin/pip. Make
      sure you have python3-full installed.

      If you wish to install a non-Debian packaged Python application,
      it may be easiest to use pipx install xyz, which will manage a
      virtual environment for you. Make sure you have pipx installed.

      See /usr/share/doc/python3.[1](https://github.com/X/X/actions/runs/11347522201/job/31559107127#step:3:1)2/README.venv for more information.

  note: If you believe this is a mistake, please contact your Python installation or OS distribution provider. You can override this, at the risk of breaking your Python installation or OS, by passing --break-system-packages.
  hint: See PEP [6](https://github.com/X/X/actions/runs/11347522201/job/31559107127#step:3:7)68 for the detailed specification.
  Error: Process completed with exit code 1.
Run MobSF/mobsfscan@main
  with:
    args: android --json -c .mobsf
Run echo "::group::Installing mobsfscan dependencies"
  echo "::group::Installing mobsfscan dependencies"
  python3 -m pip install -r /home/runner/work/_actions/MobSF/mobsfscan/main/requirements.txt
  echo "::endgroup::"
  shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
Installing mobsfscan dependencies
  error: externally-managed-environment

  × This environment is externally managed
  ╰─> To install Python packages system-wide, try apt install
      python3-xyz, where xyz is the package you are trying to
      install.

      If you wish to install a non-Debian-packaged Python package,
      create a virtual environment using python3 -m venv path/to/venv.
      Then use path/to/venv/bin/python and path/to/venv/bin/pip. Make
      sure you have python3-full installed.

      If you wish to install a non-Debian packaged Python application,
      it may be easiest to use pipx install xyz, which will manage a
      virtual environment for you. Make sure you have pipx installed.

      See /usr/share/doc/python3.1[2](https://github.com/X/X/actions/runs/11347522201/job/31559106654#step:3:2)/README.venv for more information.

  note: If you believe this is a mistake, please contact your Python installation or OS distribution provider. You can override this, at the risk of breaking your Python installation or OS, by passing --break-system-packages.
  hint: See PEP [6](https://github.com/X/X/actions/runs/11347522201/job/31559106654#step:3:7)68 for the detailed specification.
  Error: Process completed with exit code 1.

Temp Fix

We are temporarily adding a step, something like:

- uses: actions/setup-python@v5
      with:
        python-version: '3.10'
ajinabraham commented 2 weeks ago

Thanks I will update the instructions.