pip-audit, An Old Pin With Advisories, A Clean Pin Without

pip-audit

The PyPA CLI (pip-audit) on EL 10, pinned to a version, in a virtual environment of its own with a link in the PATH. Original role for EL 10, live-tested with podman on Rocky Linux 10.

There is no package; the documented install is pip. EL 10 carries no pip-audit, and pip install into the system Python ties the CLI's dependencies to whatever the OS ships. This role puts the CLI in /opt/pip-audit, a venv apart from the system Python: an OS update cannot break it, and it cannot break the OS. The live test asserts import pip_audit fails in /usr/bin/python3.

Pinned, and checked for consistency. pip_audit_version is what gets installed; the live test runs pip check inside the venv and expects no broken requirements.

pip verifies nothing beyond TLS. The index is PyPI over HTTPS; there is no signature to check. For a byte-for-byte pin, give pip_audit_pip_extra_args a requirements file with hashes and --require-hashes, or a private index.

Proven to run. The live test calls pip-audit -r /tmp/pip-audit-p/req.txt --no-deps --progress-spinner off and expects "PYSEC-" - the whole tree loaded and the dependency auditor did its work.

An old pin with advisories, a clean pin without. The live test audits a requirements file pinning requests 2.19.0 and expects PYSEC advisory ids with exit code 1, then six 1.17.0 and expects "No known vulnerabilities found" with exit code 0. pip-audit reads the OSV and PyPI advisory data over the network for each run; the venv keeps it off the system Python it audits for others.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.