feat(python): support PKG-INFO and METADATA

[knqyf263]

Currently, Trivy traverses all paths and looks for all Pipfile.lock or poetry.lock in a container image. However, the image sometimes has only Pipfile.lock and doesn't install python packages listed in the Pipfile.lock. A python package should have PKG-INFO and METADATA depending on egg or wheel.

https://packaging.python.org/discussions/wheel-vs-egg/

To avoid false positives from Pipfile.lock, we are probably able to take advantage of *.dist-info/METADATA and *.egg-info/PKG-INFOfile.

How it works:

1. Look for all *.dist-info and *.egg-info directory
   • Note that *.egg-info is sometimes a file.
2. Parse PKG-INFO or METADATA under those directories
3. Extract a python package name and version
4. Use them for vulnerability detection

How to implement it:

1. Add a new parser here like pkg/egg/parse.go or pkg/python/egg/parse.go
2. Add a new analyzer here like analyzer/library/egg/egg.go
3. Add a new detector here

I'm sure the first two tasks are not difficult and good for the first contributor as well. There are a few things to consider when implementing it in Trivy.

[dai-dao]

Hello , i would like to take on this feature

[dai-dao]

hello, so i've spent some time on this, and figured out the following:

1. Pipfile.lock doesn't include all sub-dependencies packages, only some of it. So if you want to parse METADA and PKG_INFO and get a list of all the sub-dependencies, the final list will be much bigger than the list in Pipfile.lock
2. A simpler solution would probably be to parse Pipfile.lock and get the list of dependencies , then verify it by parsing site-packages folder for those packages only

Let me know what you think. Cheers

[knqyf263]

This issue aims to scan python packages without Pipfile.lock. Some packages are not listed in Pipfile.lock and it might be false negative. It would be great if you get a bigger list than Pipfile.lock.

[westonsteimel]

Clair appears to take a similar approach here if that is useful to anyone who may take on implementing this: https://github.com/quay/claircore/blob/master/python/packagescanner.go

[github-actions]

This issue is stale because it has been labeled with inactivity.