Python - Pip, Pipenv

See a breakdown of the file formats and features supported in Python.

OpenText Core SCA now tracks Python dependencies through:

• Pip (using the older requirements.txt files)

• Pipenv (using the newer Pipfile.lock files)

• file fingerprinting, to find dependencies not defined in manifest-files

Pip

To achieve the fastest and most accurate results, create a file containing the resolved dependency tree before scanning. This can be accomplished using the High Performance Scans technology in OpenText Core SCA CLI. By executing the resolve command, the CLI automatically identifies all manifest files that lack the recommended lock files and generates them as needed. The first part of the name is based on the name of the file it was generated from. The file naming format is as follows:

<FILE_NAME>.pip.debricked.lock

Example: .requirements.txt.pip.debricked.lock

If at least one of the supported files is committed to the repository, it will be automatically scanned for dependencies when integrated with OpenText Core SCA CI/CD pipeline.

File fingerprinting

OpenText Core SCA supports scanning for Python dependencies not defined in manifest files through file fingerprinting. OpenText Core SCA database contains the hashes of .whl files as well as their unpacked contents (including .py files) for all packages in the Python package index (PyPI). This is used when comparing with the contents of your application, to ensure as accurate matches as possible.

For more information on file fingerprinting and how to set it up, see file fingerprinting.

Supported file formats and features

Package manager	Supported file formats	Root dependencies	Indirect dependencies	Dependency trees	Security scanning	License scanning	Root fix	Pull Request	Reachability Analysis	High Performance Scan
Pip	requirements.txt									Yes
Pipenv	Pipfile
Pipenv	Pipfile.lock									Yes
-	fingerprinted files (.py, .txt, .sh, .c, .egg, .h and more**)									-