Package: shouldi
shouldiWhat Is ShouldI?shouldiis a tool that runs static analysis tools to let you know if there are
any issues in any of the python packages you were thinking of installing.shouldiis similar to things likeGo Report Card.shouldiis in its very early stages. Expect things to change.Installation$python3-mpipinstall-UshouldiUsageThere are several different subcommands ofshoudliinstallAnalogous topip installbut runs checks to tell you if you should installusePoint this command at any Git URL or directory and it will run appropriate
static analysis tools for that languageprojectAuto discover projects and depedencies of those projects within a directoryInstall CommandRun bandit and safety. Tell the person who ran the command not to install the
Python package if there were any issues found by either tool.$shouldiinstallinsecure-packagebanditbandit is okay to installDo not install insecure-package! {'safety_check_number_of_issues': 1}Use CommandGiven a Git URL or a directory, figure out what the language the codebase is and
run the appropriate static analysis tools for that language.Tools for each language are as follows.You must have the following tools installed on the systemgolanggolangci-lintjavadependency-checkjavascriptnpm-auditpythonsafetybanditrustcargo-audit$shouldiusehttps://github.com/trekhleb/javascript-algorithms{'static_analysis': SAResultsSpec(critical=1, high=2941, medium=16, low=41049, report={'npm_audit_output': {'info': 0, 'low': 41049, 'moderate': 16, 'high': 2941, 'critical': 1}})}Project CommandGiven a directory, output a JSON describing the dependencies found within that
directory.At the moment it will auto discover Python dependencies listed insetup.py'sinstall_requiressection or withinrequirements.txtDependencies which cannot be automatically identified can be specified in YAML
files.dependencies:python:name:Pythonurl:https://python.orglicense:Python License 2.0Here's an example of running the project command on theshouldicodebase with
the abovedeps.yamladding in dependencies that couldn't be auto discovered.$shouldiprojectcreate-adddeps.yaml--.{"dependencies": [{"extra": {"pypi": {"euuid": "7bd67f47-9972-57fd-8da1-233783b35321","license": "Apache 2","name": "aiohttp","url": "https://pypi.org/pypi/aiohttp","uuid": null}},"license": "Apache 2","name": "aiohttp","url": "https://github.com/aio-libs/aiohttp","uuid": "a6172a74-11ca-5624-bbf4-2e064084ee95"},{"extra": {"pypi": {"euuid": "8ce644e4-20ef-5a24-85bb-0449fb8e2c94","license": "","name": "bandit","url": "https://pypi.org/pypi/bandit","uuid": null}},"license": null,"name": "bandit","url": "https://bandit.readthedocs.io/en/latest/","uuid": "1fa385fc-91ae-59c5-8d4c-220b9820f173"},{"extra": {"pypi": {"euuid": "c09eaab1-7676-55b8-96fd-cb50f5dc125c","license": "MIT license","name": "safety","url": "https://pypi.org/pypi/safety","uuid": null}},"license": "MIT license","name": "safety","url": "https://github.com/pyupio/safety","uuid": "f2cc3711-8652-584d-8d46-7e060398eff4"},{"extra": {"pypi": {"euuid": "5143b2bf-be54-5688-8077-efbd038fbdc5","license": "MIT","name": "PyYAML","url": "https://pypi.org/pypi/PyYAML","uuid": null}},"license": "MIT","name": "PyYAML","url": "https://github.com/yaml/pyyaml","uuid": "406495d7-1ba9-5a7e-bec9-f2a1119d3913"},{"extra": {},"license": "Python License 2.0","name": "Python","url": "https://python.org","uuid": "807b7876-01ec-5fef-ad5a-4cc588b97719"},]}Licenseshouldi is distributed under theMIT License.What's This Really CalledThe real name of this package is "DFFML Evaluator for PyPi Packages".shouldiis mearly the command line invokation, and we claimshouldi, the package name
on PyPi, to avoid a supply chain attack.