search

pyupio / safety

Safety checks Python dependencies for known security vulnerabilities and suggests the proper remediations for vulnerabilities detected.
https://safetycli.com/product/safety-cli
MIT License
1.66k stars 141 forks source link

Safety 2.x fails when git is not installed #397

Closed andyjones closed 1 year ago

andyjones commented 1 year ago

Thanks for safety!

I get the following error running safety 2.x:

FileNotFoundError: [Errno 2] No such file or directory: 'git'
Unhandled exception happened: [Errno 2] No such file or directory: 'git'

It looks like Safety 2.x introduces some checks to see if this is in a git repo. This check fails when the git binary is unavailable (eg. running safety against a dockerised application).

Reproduce the issue by running safety when git is not in the path eg.

python -m venv .venv
. .venv/bin/activate
pip install safety
PATH="`pwd`.venv/bin" safety check
codecov[bot] commented 1 year ago

Codecov Report

Merging #397 (2f0bbd5) into develop (fac16b6) will decrease coverage by 0.09%. The diff coverage is 50.00%.

@@             Coverage Diff             @@
##           develop     #397      +/-   ##
===========================================
- Coverage    86.14%   86.05%   -0.10%     
===========================================
  Files           14       14              
  Lines         1711     1714       +3     
===========================================
+ Hits          1474     1475       +1     
- Misses         237      239       +2
Impacted Files Coverage Δ
safety/util.py 81.37% <50.00%> (-0.36%) :arrow_down:

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update fac16b6...2f0bbd5. Read the comment docs.

cb22 commented 1 year ago

Hey @andyjones - thanks for the PR!

We're going to merge this in ASAP and get 2.1.1 released with it included.

Looks like all of our tests run in containers that have git installed, so we didn't pick this up before release - I'll add a few new cases once the release is out to make sure we catch this case going forward.