8000 Support Python packages that aren't on PyPI · Issue #755 · ossf/package-analysis · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Support Python packages that aren't on PyPI #755

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue an 8000 d contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
maxfisher-g opened this issue Jun 8, 2023 · 2 comments
Open

Support Python packages that aren't on PyPI #755

maxfisher-g opened this issue Jun 8, 2023 · 2 comments
Labels
dynamic analysis Issues specific to the implementation of Dynamic Analysis enhancement New feature or request

Comments

@maxfisher-g
Copy link
Contributor
maxfisher-g commented Jun 8, 2023 •
edited
Loading

Packages such as https://github.com/ytisf/PyExfil have not been updated on PyPI and the current installation instructions recommend cloning from GitHub and running pip setup.py install. It would be nice if we could support analysis of Python packages with this kind of installation flow.

It's also released as a .zip file with a nonstandard structure
@maxfisher-g maxfisher-g added dynamic analysis Issues specific to the implementation of Dynamic Analysis enhancement New feature or request labels Jun 14, 2023
@dukecat0
Copy link
Contributor

pip setup.py install is not a valid command.
Usually pip install git+https://github.com/ytisf/PyExfil.git should work if the package needs to be installed from GitHub. This command will install it directly without needing to clone and run install commands manually.

@maxfisher-g
Copy link
Contributor Author
maxfisher-g commented Jun 20, 2023 •
edited
Loading

Good point @dukecat0. I guess in general it would be nice to be able to override the install command in certain cases. This will be enabled by #301 (i.e. copying the analyze script into the sandbox at runtime rather than embedding it into the sandbox image)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
dynamic analysis Issues specific to the implementation of Dynamic Analysis enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@dukecat0 @maxfisher-g
0