mirror of
https://github.com/jxxghp/MoviePilot.git
synced 2026-10-28 19:06:36 +08:00
115 lines
4.0 KiB
Python
115 lines
4.0 KiB
Python
"""
|
|
将 uv 导出的锁定 URL 依赖转换为漏洞审计可识别的精确版本。
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import re
|
|
import tomllib
|
|
from pathlib import Path
|
|
|
|
DIRECT_REFERENCE = re.compile(
|
|
r"^(?P<indent>\s*)(?P<name>[A-Za-z0-9_.-]+)\s+@\s+"
|
|
r"(?P<url>\S+)(?P<suffix>.*)$"
|
|
)
|
|
|
|
# free-threaded Brotli 保留 1.2.0 包元数据以使用无 GIL 源码，但源码提交已包含
|
|
# 1.2.1 的安全修复；仅在漏洞数据库匹配时使用修复版本，不改变实际安装来源。
|
|
AUDIT_VERSION_OVERRIDES = {
|
|
(
|
|
"brotli",
|
|
"https://github.com/google/brotli/archive/0ed4268a4401abcb4472096340477cf4af7d1a2b.tar.gz",
|
|
): "1.2.1",
|
|
}
|
|
|
|
|
|
def _canonicalize_name(name: str) -> str:
|
|
"""
|
|
按 Python 包索引规则规范化分发包名。
|
|
"""
|
|
return re.sub(r"[-_.]+", "-", name).lower()
|
|
|
|
|
|
def _locked_url_versions(lock_file: Path) -> dict[tuple[str, str], str]:
|
|
"""
|
|
读取锁文件中 URL 来源与已解析版本的唯一映射。
|
|
"""
|
|
with lock_file.open("rb") as file:
|
|
document = tomllib.load(file)
|
|
|
|
versions: dict[tuple[str, str], str] = {}
|
|
locked_versions: dict[tuple[str, str], str] = {}
|
|
for package in document.get("package", []):
|
|
source = package.get("source") or {}
|
|
url = source.get("url")
|
|
name = package.get("name")
|
|
version = package.get("version")
|
|
if not all(isinstance(value, str) and value for value in (url, name, version)):
|
|
continue
|
|
key = (_canonicalize_name(name), url)
|
|
locked_previous = locked_versions.setdefault(key, version)
|
|
if locked_previous != version:
|
|
raise ValueError(f"锁文件包含冲突的 URL 依赖版本：{name} @ {url}")
|
|
audit_version = AUDIT_VERSION_OVERRIDES.get(key, version)
|
|
previous = versions.setdefault(key, audit_version)
|
|
if previous != audit_version:
|
|
raise ValueError(f"锁文件包含冲突的 URL 依赖版本：{name} @ {url}")
|
|
return versions
|
|
|
|
|
|
def normalize_requirements(requirements: str, lock_file: Path) -> str:
|
|
"""
|
|
保留环境标记和注释，将直接引用替换为锁文件中的精确版本。
|
|
|
|
:param requirements: uv 导出的完整依赖文本，保留环境标记、注释与换行
|
|
:param lock_file: 用于核对包名、URL 和精确版本的锁文件
|
|
:return: 将直接 URL 引用替换为精确版本后的审计清单
|
|
:raises ValueError: 锁文件版本存在冲突，或某个直接引用无法定位
|
|
"""
|
|
versions = _locked_url_versions(lock_file)
|
|
normalized_lines = []
|
|
for line in requirements.splitlines(keepends=True):
|
|
body = line.rstrip("\r\n")
|
|
newline = line[len(body):]
|
|
match = DIRECT_REFERENCE.match(body)
|
|
if not match:
|
|
normalized_lines.append(line)
|
|
continue
|
|
|
|
key = (_canonicalize_name(match.group("name")), match.group("url"))
|
|
version = versions.get(key)
|
|
if not version:
|
|
raise ValueError(
|
|
"导出的 URL 依赖无法在锁文件中定位精确版本："
|
|
f"{match.group('name')} @ {match.group('url')}"
|
|
)
|
|
normalized_lines.append(
|
|
f"{match.group('indent')}{match.group('name')}=={version}"
|
|
f"{match.group('suffix')}{newline}"
|
|
)
|
|
|
|
normalized = "".join(normalized_lines)
|
|
if any(DIRECT_REFERENCE.match(line) for line in normalized.splitlines()):
|
|
raise ValueError("审计清单仍包含未规范化的 URL 依赖")
|
|
return normalized
|
|
|
|
|
|
def main() -> None:
|
|
"""
|
|
读取 uv 导出文件并写入适合 pip-audit 的锁定版本清单。
|
|
"""
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument("--lock", type=Path, required=True)
|
|
parser.add_argument("--input", type=Path, required=True)
|
|
parser.add_argument("--output", type=Path, required=True)
|
|
args = parser.parse_args()
|
|
args.output.write_text(
|
|
normalize_requirements(args.input.read_text(encoding="utf-8"), args.lock),
|
|
encoding="utf-8",
|
|
)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|