Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Aura – Python source code auditing and static analysis on a large scale (2022)

github.com

Post reply on HN
Print view View original

11–15 of 15 posts

Re: Aura – Python source code auditing and static analysis on a large scale (2022)

#11

Post by intense_feel »

pabs3 wrote: post #8
intense_feel wrote: post #6

Earlier quoted context omitted.

Yes, command line version will be always available, this is just an additional mode built on top of it, it's using in fact the same API interface as CLI version to spawn scans and parses out the JSON output format into persistent DB with some postprocessing to be more suitable for web app.

Are you using SARIF for the JSON output? It is a standard for static analysis tool output. https://sarifweb.azurewebsites.net/

SARIF is implemented as a separate output format and is supported. the "json" one contains more information such as taint traces (even unconfirmed ones that haven't reached sinks), anomaly tags, static behaviour etc... main json format is intended to capture as much data as possible so it can be analyzed later as the original intention is to hunt for malware, anomalies and doing research in general on top of the whole PyPI repository. I found SARIF to be more "practical" or actionable in terms of what needs to be done in fixing the source code or vulnerabilities found vs research oriented such as "this piece of code is doing network communication". Due to this differences it was added as a separate format which is a subset and reformatted (to the SARIF standard) "json" output format

Re: Aura – Python source code auditing and static analysis on a large scale (2022)

#12

Post by intense_feel »

westurner wrote: post #10
intense_feel wrote: post #3

Earlier quoted context omitted.

Hello, author of Aura here. The project is in fact active! But in a different branch called "ambience". Which is a very big refactor into transforming Aura (which is now designed to be run locally as tui) into server/web application. It would allow to automatically monitor and audit all used python packages in an organization by using an http reverse proxy to intercept python package installations. It's taking me cur…

Could aura scan packages at the pulp pypi proxy? https://github.com/pulp

I haven't used pulp so I am not sure but yes in theory. Several schemes are currently supported via URIs (pypi://, git://, http(s):// etc...) so if the destination to scan can be formatted as one of the already supported URI schemes then you can already scan it. URI providers are also using plugin architecture so adding a new one for better integration with pulp (such as autodiscovering packages) should be trivial. Thank you for the suggestion, the pulp project looks interesting and I would definitely check it out!

Re: Aura – Python source code auditing and static analysis on a large scale (2022)

#13

Post by intense_feel »

tda wrote: post #7
intense_feel wrote: post #3

Earlier quoted context omitted.

Hello, author of Aura here. The project is in fact active! But in a different branch called "ambience". Which is a very big refactor into transforming Aura (which is now designed to be run locally as tui) into server/web application. It would allow to automatically monitor and audit all used python packages in an organization by using an http reverse proxy to intercept python package installations. It's taking me cur…

very helpful comment, you might want to add that to the readme or a pinned issue

Thank you for the suggestion, that is indeed a good idea. I will modify the README to include some explanation about the current status and why the main & dev branches may seem to be stale

Re: Aura – Python source code auditing and static analysis on a large scale (2022)

#14

Post by pabs3 »

intense_feel wrote: post #11
pabs3 wrote: post #8

Earlier quoted context omitted.

Are you using SARIF for the JSON output? It is a standard for static analysis tool output. https://sarifweb.azurewebsites.net/

SARIF is implemented as a separate output format and is supported. the "json" one contains more information such as taint traces (even unconfirmed ones that haven't reached sinks), anomaly tags, static behaviour etc... main json format is intended to capture as much data as possible so it can be analyzed later as the original intention is to hunt for malware, anomalies and doing research in general on top of the whol…

Great approach, thanks for that.

Re: Aura – Python source code auditing and static analysis on a large scale (2022)

#15

Post by westurner »

intense_feel wrote: post #12
westurner wrote: post #10

Earlier quoted context omitted.

Could aura scan packages at the pulp pypi proxy? https://github.com/pulp

I haven't used pulp so I am not sure but yes in theory. Several schemes are currently supported via URIs (pypi://, git://, http(s):// etc...) so if the destination to scan can be formatted as one of the already supported URI schemes then you can already scan it. URI providers are also using plugin architecture so adding a new one for better integration with pulp (such as autodiscovering packages) should be trivial. T…

Gitea can also (scan and build and test and) host python packages [1], conda packages [2], container images, etc.

[1] https://docs.gitea.io/en-us/usage/packages/pypi/

[2] https://docs.gitea.io/en-us/usage/packages/conda/

https:// URLs probably already solve for scanning Python packages hosted by Gitea and/or Pulp with Aura.

From https://news.ycombinator.com/item?id=33563857 :

> Additional lists of static analysis, dynamic analysis, SAST, DAST, and other source code analysis tools: https://news.ycombinator.com/item?id=24511280 https://analysis-tools.dev/tools?languages=python

Post reply on HN