python_pip.test.js

import fs from 'fs'

import { expect } from 'chai'
import { useFakeTimers } from "sinon";

import pythonPip from "../../src/providers/python_pip.js"
import {getCustomPath, invokeCommand } from "../../src/tools.js"

let clock

async function sharedComponentAnalysisTestFlow(testCase, usePipDepTreeUtility) {
	// load the expected list for tsharedComponentAnalysisTestFlowhe scenario
	let expectedSbom = fs.readFileSync(`test/providers/tst_manifests/pip/${testCase}/expected_component_sbom.json`).toString().trim()
	expectedSbom = JSON.stringify(JSON.parse(expectedSbom))
	// invoke sut stack analysis for scenario manifest
	let opts = { TRUSTIFY_DA_PIP_USE_DEP_TREE: usePipDepTreeUtility.toString() }
	let providedDatForComponent = await pythonPip.provideComponent(`test/providers/tst_manifests/pip/${testCase}/requirements.txt`, opts)
	// verify returned data matches expectation
	expect(providedDatForComponent).to.deep.equal({
		ecosystem: 'pip',
		contentType: 'application/vnd.cyclonedx+json',
		content: expectedSbom
	})
}

async function sharedStackAnalysisTestFlow(testCase, usePipDepTreeUtility) {
	// load the expected graph for the scenario
	let expectedSbom = fs.readFileSync(`test/providers/tst_manifests/pip/${testCase}/expected_stack_sbom.json`).toString()
	expectedSbom = JSON.stringify(JSON.parse(expectedSbom))
	// invoke sut stack analysis for scenario manifest
	let pipPath = getCustomPath("pip3");
	try {
		invokeCommand(pipPath, ['install', '-r', `test/providers/tst_manifests/pip/${testCase}/requirements.txt`])
	} catch (error) {
		throw new Error('fail installing requirements.txt manifest in created virtual python environment', {cause: error})
	}
	let opts = { TRUSTIFY_DA_PIP_USE_DEP_TREE: usePipDepTreeUtility.toString() }
	let providedDataForStack = await pythonPip.provideStack(`test/providers/tst_manifests/pip/${testCase}/requirements.txt`, opts)
	// new(year: number, month: number, date?: number, hours?: number, minutes?: number, seconds?: number, ms?: number): Date

	// providedDataForStack.content = providedDataForStack.content.replaceAll("\"timestamp\":\"[a-zA-Z0-9\\-\\:]+\"","")
	// verify returned data matches expectation
	expect(providedDataForStack).to.deep.equal({
		ecosystem: 'pip',
		contentType: 'application/vnd.cyclonedx+json',
		content: expectedSbom
	})
}

suite('testing the python-pip data provider', () => {
	[
		{name: 'requirements.txt', expected: true},
		{name: 'some_other.file', expected: false}
	].forEach(testCase => {
		test(`verify isSupported returns ${testCase.expected} for ${testCase.name}`, () =>
			expect(pythonPip.isSupported(testCase.name)).to.equal(testCase.expected)
		)
	});

	[
		// "pip_requirements_txt_no_ignore",
		"pip_requirements_txt_ignore"
	].forEach(testCase => {
		let scenario = testCase.replace('pip_requirements_', '').replaceAll('_', ' ')
		test(`verify requirements.txt sbom provided for stack analysis with scenario ${scenario}`, async () => {
			await sharedStackAnalysisTestFlow(testCase, false);
			// these test cases takes ~2500-2700 ms each pr >10000 in CI (for the first test-case)
		}).timeout(process.env.GITHUB_ACTIONS ? 30000 : 10000)

		test(`verify requirements.txt sbom provided for component analysis with scenario ${scenario}`, async () => {
			await sharedComponentAnalysisTestFlow(testCase, false);
			// these test cases takes ~1400-2000 ms each pr >10000 in CI (for the first test-case)
		}).timeout(process.env.GITHUB_ACTIONS ? 15000 : 10000)

		test(`verify requirements.txt sbom provided for stack analysis using pipdeptree utility with scenario ${scenario}`, async () => {
			await sharedStackAnalysisTestFlow(testCase, true);
			// these test cases takes ~2500-2700 ms each pr >10000 in CI (for the first test-case)
		}).timeout(process.env.GITHUB_ACTIONS ? 30000 : 10000)

		test(`verify requirements.txt sbom provided for component analysis using pipdeptree utility with scenario ${scenario}`, async () => {
			await sharedComponentAnalysisTestFlow(testCase, true);
			// these test cases takes ~1400-2000 ms each pr >10000 in CI (for the first test-case)
		}).timeout(process.env.GITHUB_ACTIONS ? 15000 : 10000)
	});

}).beforeAll(() => clock = useFakeTimers(new Date('2023-10-01T00:00:00.000Z'))).afterAll(()=> clock.restore());

suite('testing the python-pip data provider with virtual environment', () => {
	[
		"pip_requirements_virtual_env_txt_no_ignore",
		"pip_requirements_virtual_env_with_ignore"
	].forEach(testCase => {
		let scenario = testCase.replace('pip_requirements_', '').replaceAll('_', ' ')
		test(`verify requirements.txt sbom provided for stack analysis using virutal python environment, with scenario ${scenario}`, async () => {
			// load the expected sbom stack analysis
			let expectedSbom = fs.readFileSync(`test/providers/tst_manifests/pip/${testCase}/expected_stack_sbom.json`,).toString()
			expectedSbom = JSON.stringify(JSON.parse(expectedSbom), null, 4)
			// invoke sut stack analysis for scenario manifest
			let providedDataForStack = await pythonPip.provideStack(`test/providers/tst_manifests/pip/${testCase}/requirements.txt`, {
				TRUSTIFY_DA_PYTHON_VIRTUAL_ENV: "true"
			})
			// new(year: number, month: number, date?: number, hours?: number, minutes?: number, seconds?: number, ms?: number): Date

			// providedDataForStack.content = providedDataForStack.content.replaceAll("\"timestamp\":\"[a-zA-Z0-9\\-\\:]+\"","")
			// verify returned data matches expectation
			providedDataForStack.content = JSON.stringify(JSON.parse(providedDataForStack.content), null, 4)
			expect(providedDataForStack.content).to.deep.equal(expectedSbom)
			// expect(providedDataForStack).to.deep.equal({
			// 	ecosystem: 'pip',
			// 	contentType: 'application/vnd.cyclonedx+json',
			// 	content: expectedSbom
			// })
			// these test cases takes ~2500-2700 ms each pr >10000 in CI (for the first test-case)
		}).timeout(process.env.GITHUB_ACTIONS ? 60000 : 30000)
	})

}).beforeAll(() => {clock = useFakeTimers(new Date('2023-10-01T00:00:00.000Z'))}).afterAll(()=> clock.restore());

suite('testing python-pip PEP 508 marker handling', () => {
	const markerTestCase = 'pip_requirements_txt_marker_skip'

	/** Verify that packages with environment markers (PEP 508) that are not installed
	 *  in the current environment are silently skipped, while marker-constrained
	 *  packages that ARE installed are still included in the SBOM. */
	test('verify marker-constrained uninstalled packages are skipped in component analysis', async () => {
		// given: pip environment where only six and certifi are installed (pywin32 is Windows-only)
		const pipFreezeOutput = 'six==1.16.0\ncertifi==2023.7.22\n'
		const pipShowOutput =
			'Name: certifi\nVersion: 2023.7.22\nSummary: Python package for providing Mozilla\'s CA Bundle.\nRequires: \nRequired-by: ' +
			'\n---\n' +
			'Name: six\nVersion: 1.16.0\nSummary: Python 2 and 3 compatibility utilities\nRequires: \nRequired-by: '

		process.env['TRUSTIFY_DA_PIP_FREEZE'] = Buffer.from(pipFreezeOutput).toString('base64')
		process.env['TRUSTIFY_DA_PIP_SHOW'] = Buffer.from(pipShowOutput).toString('base64')

		try {
			// when: component analysis is run against a manifest with a Windows-only marker package
			let expectedSbom = fs.readFileSync(`test/providers/tst_manifests/pip/${markerTestCase}/expected_component_sbom.json`).toString().trim()
			expectedSbom = JSON.stringify(JSON.parse(expectedSbom))

			let result = await pythonPip.provideComponent(`test/providers/tst_manifests/pip/${markerTestCase}/requirements.txt`, {})

			// then: SBOM contains six and certifi but not pywin32
			expect(result).to.deep.equal({
				ecosystem: 'pip',
				contentType: 'application/vnd.cyclonedx+json',
				content: expectedSbom
			})
		} finally {
			delete process.env['TRUSTIFY_DA_PIP_FREEZE']
			delete process.env['TRUSTIFY_DA_PIP_SHOW']
		}
	}).timeout(10000)

}).beforeAll(() => clock = useFakeTimers(new Date('2023-10-01T00:00:00.000Z'))).afterAll(() => clock.restore());