pyupio / safety

Safety checks Python dependencies for known security vulnerabilities and suggests the proper remediations for vulnerabilities detected.
https://safetycli.com/product/safety-cli
MIT License
1.66k stars 141 forks source link

Replace ADD with COPY instruction in Dockerfile #331

Closed PeterDaveHello closed 3 years ago

PeterDaveHello commented 3 years ago

Reference:

For other items (files, directories) that do not require ADD’s tar auto-extraction capability, you should always use COPY.

codecov[bot] commented 3 years ago

Codecov Report

Merging #331 (ebb0884) into master (2e5b46b) will increase coverage by 0.32%. The diff coverage is n/a.

Impacted file tree graph

@@            Coverage Diff             @@
##           master     #331      +/-   ##
==========================================
+ Coverage   68.56%   68.88%   +0.32%     
==========================================
  Files           8        8              
  Lines         474      495      +21     
==========================================
+ Hits          325      341      +16     
- Misses        149      154       +5     
Impacted Files Coverage Δ
safety/cli.py 50.00% <0.00%> (-6.85%) :arrow_down:
safety/errors.py 100.00% <0.00%> (ø)
safety/constants.py 100.00% <0.00%> (ø)
safety/safety.py 92.96% <0.00%> (+6.78%) :arrow_up:

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update 2e5b46b...ebb0884. Read the comment docs.

rafaelpivato commented 3 years ago

Good point about ADD vs COPY. Nevertheless, I am not sure we need this. It would impact cached layers without actually fixing any bug. The best moment to make this change would be when we happen to change the layers for this image. You can consider adding this as part of #328

PeterDaveHello commented 3 years ago

The cache impact will be only one time, as I'm still working on #328 and they are independent, maybe we can get this merged first?