capa icon indicating copy to clipboard operation
capa copied to clipboard

add lint/check to check extra dependency #2362

Open dhruvak001 opened this issue 1 year ago • 7 comments

Fixes https://github.com/mandiant/capa/issues/2362#issuecomment-2645291103

A check for extra packages during the installation of capa and its dependencies. This ensures that no unintended packages are installed.

[x] No CHANGELOG update needed [x] No new tests needed [x] No documentation update needed

dhruvak001 avatar Feb 08 '25 20:02 dhruvak001

@williballenthin for now i have kept run to Warning instead of exit code 1(to pass the ci and also get debug files). Shall i change it to exit 1 or keep it in Warning only?

Reference(artifcats .txt files) : https://github.com/mandiant/capa/actions/runs/13270649385/artifacts/2573886903

dhruvak001 avatar Feb 11 '25 19:02 dhruvak001

this should error out the CI run

williballenthin avatar Feb 11 '25 20:02 williballenthin

I have changed it to exit, but our master branch itself have many extra dependency which would conflict. Do we need to also remove it ?

dhruvak001 avatar Feb 12 '25 13:02 dhruvak001

what extra dependencies did you find?

williballenthin avatar Feb 12 '25 14:02 williballenthin

@williballenthin output data https://github.com/mandiant/capa/actions/runs/13290227487/artifacts/2579953653

diff.txt ->

0a1 -e git+https://github.com/mandiant/capa@63b7062f4d2689ba64e5ccee26d566668be018be#egg=flare_capa 2a4 altgraph==0.17.4 3a6 build==1.2.2 18c21,22 < pefile==2024.8.26 packaging==24.2 pefile==2023.2.7 25a30,32 pyinstaller-hooks-contrib==2025.1 pyinstaller==6.11.1 pyproject_hooks==1.2.0 26a34 pywin32-ctypes==0.2.3 31a40 tomli==2.2.1

dhruvak001 avatar Feb 12 '25 16:02 dhruvak001

@williballenthin all of the above dependency are expected packages. I have ignored them, but after numerous methods and tries > -e git+https://github.com/mandiant/capa@9aed266094a1e75258908d73802487b201c850f4#egg=flare_capa can't be ignored.

dhruvak001 avatar Feb 12 '25 19:02 dhruvak001

@williballenthin PR is almost done, there are some dependencies which i added especially in the code to get bypassed. These dependencies are expected according to me, if you can please review the code once.

dhruvak001 avatar Mar 12 '25 01:03 dhruvak001