Package: secpip
Secpip - Secure Pip Package Management ToolSecpip is command line interface to manage (install, download, uninstall, migrate) python libraries securely.Explore the docs »View Demo·Report Bug·Request FeatureTable of ContentsAbout the ProjectGetting StartedPrerequisitesInstallationUsageRoadmapContributingLicenseContactAcknowledgementsAbout The ProjectSecpip is command line interface to manage pip packages in secure way.Secpip controls the given package version has known vulnerability or not according to vulnerability database published assafety-db.If given package has vulnerability, Secpip tries to find available secure versions of package.After secure version of package found, it automatically install the secure package (if '--secure' and '--auto' tags are used).Abilities of SecpipPackage vulnerability check and extraction from virtual environments.Downloads pip packages(secure) if offline installation needed to another environments or nodes.You can install libraries as online and offline to virtual environments by using Secpip easily.It is based on pip(wraps pip commands) so you need to install pip.It checks python package security conditions by using safety library according to published vulnerabilities.It create a report the result of operation.It create/build/dump python virtual environments.It uninstall multiple packages from virtual environment with one command by taking requirements file.It migrate virtual environment to another one or new one securely.Getting StartedDefinitions and examples about installation and usage of Secpip modules.You can follow these steps to install and use Secpip.Prerequisitespython3pipvirtualenv : A tool for creating isolated virtual python environments.InstallationFirstly Install python 3 and pip.Install From RepoClone the repogitclonehttps://github.com/myasinsaglam/secpip.gitInstall Requirements from requirements.txtpipinstall-rrequirements.txtInstall SecpipIn project directory runpipinstall.orpythonsetup.pyinstallInstall via pippipinstallsecpipUsage:Entrypoints and example commands explained here.Entrypointusage: secpip <command> [<args>]
Commands:
  install               Install pip packages by using secpip abilities (secure, report, auto_mode)
  dump                  Package/Download pip packages by using secpip abilities (secure, report, auto_mode)
  uninstall             Uninstall pip packages from venv as single or batch from requirements
  migrate               Migrate virtual environment to another one securely
  sync                  Synchronize Database from web
General Options:
  --secure              Secure option to check known vulnerabilities. If package is not secure operation not allowed to package
  --auto                Use with secure option. It replace vulnerable package with next secure version, If no secure package exists it create warning and install insecure one.      

Secure pip package manager...

positional arguments:
  command     {install, dump, uninstall}

optional arguments:
  -h, --help  show this help message and exitInstallInstall command description and argumentsusage: secpip install [-h] [--secure] [--auto] [--report REPORT_DIR]
              [-v ENVIRONMENT_DIR] [-p PACKAGE_DIR] [-r REQUIREMENTS_DIR]

Install pip packages as online or offline with security check

optional arguments:
  -h, --help            show this help message and exit
  --secure              A flag for security check option
  --auto                A flag for auto correct versions by replacing secure
                        one
  --report REPORT_DIR   Report Extraction Option
  -v ENVIRONMENT_DIR, --venv_dir ENVIRONMENT_DIR
                        Python environment path to install modules
  -p PACKAGE_DIR, --package_dir PACKAGE_DIR
                        Downloaded package directory for offline install
  -r REQUIREMENTS_DIR, --requirements_file REQUIREMENTS_DIR
                        Requirements txt i/o file path, default is
                        {current_path}/requirements.txtExamplesOptional flags[--secure] - security check if package not secure, operation is not allowed on vulnerable package[--auto] - auto replace with secure version[--report] report filename - writes operation report to given file.Online single package install to virtual environment(optional - if not it installs current python environment)secpipinstall[packagename]-v[venvdir]--secure--autoOffline single package install from package directory to virtual environment(optional - if not it installs current python environment)secpipinstall[packagename]-v[venvdir]-p[downloadedpackagedirectory]--secure--autoOnline install packages from requirements file to virtual environmentsecpipinstall-r[requirementspath]-v[venvdir]--secure--auto--report[reportfilename]Offline install requirements file packages from package directory to virtual environment(optional - if not it installs current python environment)secpipinstall-r[requirementspath]-v[venvdir]-p[downloadedpackagedirectory]--secure--autoDumpDump command description and argumentsusage: secpip dump [-h] [--secure] [--auto] [--report REPORT_DIR]
              [-v ENVIRONMENT_DIR] [-p PACKAGE_DIR] [-r REQUIREMENTS_DIR]

Dump pip packages:
            - from package name to to directory as setup file
            - from requirements to directory as setup files
            - from venv to directory as setup files
            - from venv to requirements as metadata

optional arguments:
  -h, --help            show this help message and exit
  --secure              A flag for security check option
  --auto                A flag for auto correct versions
  --report REPORT_DIR   Report Extraction Option
  -v ENVIRONMENT_DIR, --venv_dir ENVIRONMENT_DIR
                        Python environment path to extract installed modules
  -p PACKAGE_DIR, --package_dir PACKAGE_DIR
                        Downloaded package directory for offline install
  -r REQUIREMENTS_DIR, --requirements_file REQUIREMENTS_DIR
                        Requirements txt i/o file path, default is
                        {current_path}/requirements.txtExamplesOptional flags[--secure] - security check if package not secure, operation is not allowed on vulnerable package[--auto] - auto replace with secure version[--report] report filename - writes operation report to given file.Single package download to directorysecpipdump[packagename]-p[directorytodownload]--secure--autoDownload packages from virtual environment to directorysecpipdump-v[venvdir]-p[downloadedpackagedirectory]--secure--autoDownload packages from requirements file to directorysecpipdump-r[requirementspath]-p[downloadedpackagedirectory]--secure--autoUninstallDump command description and arguments. This command just added to uninstall multiple packages. :)Multiple packages can be uninstall from environment by using requirements file argument.usage: secpip uninstall [-h] [-venv ENVIRONMENT_DIR] [-r REQUIREMENTS_DIR]

Uninstall pip packages as batch by using requirement file

optional arguments:
  -h, --help            show this help message and exit
  -v ENVIRONMENT_DIR, --venv_dir ENVIRONMENT_DIR
                        Python environment path that will be uninstall modules
                        from
  -r REQUIREMENTS_DIR, --requirements_file REQUIREMENTS_DIR
                        Requirements txt i/o file path, default is
                        {current_path}/requirements.txtExamplesOptional flags[-v], [--venv_dir] - Environment directory is optional if not given it uses currently active python environment.Single package uninstall from environmentsecpipuninstall[packagename]-v[venvdir]--secure--autoMultiple package uninstall from environmentsecpipuninstall-r[requirementspath]-v[venvdir]--secure--autoMigrateMigrate command description and argumentsusage: secpip migrate [-h] [--secure] [--auto] [--report REPORT_DIR] -s SRC_VENV -d
              DST_VENV

Migrate virtual environment to another virtual environment

optional arguments:
  -h, --help            show this help message and exit
  --secure              A flag for security check option
  --auto                A flag for auto correct versions
  --report REPORT_DIR   Report Extraction Option
  -s SRC_VENV, --src SRC_VENV
                        Source Python environment path to migrate modules
  -d DST_VENV, --dst DST_VENV
                        Destination Python environment path to migrate modulesExamplesOptional flags[--secure] - security check if package not secure, operation is not allowed on vulnerable package[--auto] - auto replace with secure version[--report] report filename - writes operation report to given file.Migrate virtual env to another new one securelysecpipmigrate-s[SourcePythonenvironmentpath]-d[DestinationPythonenvironmentpath]--secure--autoSync:Just run command below to sync vulnerability database.secpipsyncRoadmapImprove Windows support -- It can only be installed in virtual environmentAdd excluded packages optionCollect vulnerabilities from different sources, validate and extend vulnerability database with Ai (apply Nlp techniques on vulnerability sources, source code analysis etc.)Service for vulnerability checkSee theopen issuesfor a list of proposed features (and known issues).ContributingContributions are what make the open source community such an amazing place to be learn, inspire, and create. Any contributions you make aregreatly appreciated.Fork the ProjectCreate your Feature Branch (git checkout -b feature/AmazingFeature)Commit your Changes (git commit -m 'Add some AmazingFeature')Push to the Branch (git push origin feature/AmazingFeature)Open a Pull RequestLicenseDistributed under the MIT License. SeeLICENSEfor more information.ContactM.Yasin SAGLAM-myasinsaglam@crypttech.comProject Link:https://github.com/myasinsaglam/secpipAcknowledgementsThis project was supported by theCRYPTTECHsafety-dbbest-readme-template