Aura – Python source code auditing and static analysis on a large scale (2022)
1–10 of 15 posts
Re: Aura – Python source code auditing and static analysis on a large scale (2022)
#2Unfortunately, there hasn't been a release since 2021, Similarly no commits to the branches master, or dev in the past ~14 months.
Re: Aura – Python source code auditing and static analysis on a large scale (2022)
#3Unfortunately, there hasn't been a release since 2021, Similarly no commits to the branches master, or dev in the past ~14 months.
Hello, author of Aura here.
The project is in fact active! But in a different branch called "ambience". Which is a very big refactor into transforming Aura (which is now designed to be run locally as tui) into server/web application. It would allow to automatically monitor and audit all used python packages in an organization by using an http reverse proxy to intercept python package installations. It's taking me currently long time to finish that big refactor as I am currently the only active developer there so apologies if the project seems to be abandoned, I'm just hesitating to merge the changes from ambience branch into main (which is what people see) as the new refactor is not stable yet as compared to master & dev as that was tested and tuned on the whole PyPI.
Very early alpha version is available here: https://ambience.sourcecode.ai if someone is interested in checking it out.
Re: Aura – Python source code auditing and static analysis on a large scale (2022)
#4Unfortunately, there hasn't been a release since 2021, Similarly no commits to the branches master, or dev in the past ~14 months.
Hello, author of Aura here. The project is in fact active! But in a different branch called "ambience". Which is a very big refactor into transforming Aura (which is now designed to be run locally as tui) into server/web application. It would allow to automatically monitor and audit all used python packages in an organization by using an http reverse proxy to intercept python package installations. It's taking me cur…
Will a command-line tool still be provided too?
Re: Aura – Python source code auditing and static analysis on a large scale (2022)
#5Earlier quoted context omitted.
Hello, author of Aura here. The project is in fact active! But in a different branch called "ambience". Which is a very big refactor into transforming Aura (which is now designed to be run locally as tui) into server/web application. It would allow to automatically monitor and audit all used python packages in an organization by using an http reverse proxy to intercept python package installations. It's taking me cur…
Will a command-line tool still be provided too?
I second this question. While server versions are nice, I need command line, local-only versions to use for my code review as I can’t pass code and dependencies to third parties.
Re: Aura – Python source code auditing and static analysis on a large scale (2022)
#6Earlier quoted context omitted.
Hello, author of Aura here. The project is in fact active! But in a different branch called "ambience". Which is a very big refactor into transforming Aura (which is now designed to be run locally as tui) into server/web application. It would allow to automatically monitor and audit all used python packages in an organization by using an http reverse proxy to intercept python package installations. It's taking me cur…
Will a command-line tool still be provided too?
Yes, command line version will be always available, this is just an additional mode built on top of it, it's using in fact the same API interface as CLI version to spawn scans and parses out the JSON output format into persistent DB with some postprocessing to be more suitable for web app.
Re: Aura – Python source code auditing and static analysis on a large scale (2022)
#7Unfortunately, there hasn't been a release since 2021, Similarly no commits to the branches master, or dev in the past ~14 months.
Hello, author of Aura here. The project is in fact active! But in a different branch called "ambience". Which is a very big refactor into transforming Aura (which is now designed to be run locally as tui) into server/web application. It would allow to automatically monitor and audit all used python packages in an organization by using an http reverse proxy to intercept python package installations. It's taking me cur…
very helpful comment, you might want to add that to the readme or a pinned issue
Re: Aura – Python source code auditing and static analysis on a large scale (2022)
#8Earlier quoted context omitted.
Will a command-line tool still be provided too?
Yes, command line version will be always available, this is just an additional mode built on top of it, it's using in fact the same API interface as CLI version to spawn scans and parses out the JSON output format into persistent DB with some postprocessing to be more suitable for web app.
Are you using SARIF for the JSON output? It is a standard for static analysis tool output.
Re: Aura – Python source code auditing and static analysis on a large scale (2022)
#9[dead]
Re: Aura – Python source code auditing and static analysis on a large scale (2022)
#10Unfortunately, there hasn't been a release since 2021, Similarly no commits to the branches master, or dev in the past ~14 months.
Hello, author of Aura here. The project is in fact active! But in a different branch called "ambience". Which is a very big refactor into transforming Aura (which is now designed to be run locally as tui) into server/web application. It would allow to automatically monitor and audit all used python packages in an organization by using an http reverse proxy to intercept python package installations. It's taking me cur…
Could aura scan packages at the pulp pypi proxy? https://github.com/pulp