requirements.txt: Ithuluzi Eliyinhloko noma Usongo Olufihliwe?
Yonke iphrojekthi yePython inayo. Lokho kubukeka kumsulwa requirements.txt ehleli empandeni ye-repo yakho, ifayela pip install requirements.txt I-consumers, uhlu lwezinto ezixhomeke kuzo, yebo, kodwa uma ungaqaphile, ingaba umnyango ovulekile kakhulu wezakhiwo ezingazinzile, amaphakheji asengozini, kanye nezinkinga zokuphepha ezingathi sína.
Ekugcineni, izidingo.txt ilawula ukuthi yimaphi amaphakheji eqembu lesithathu adonswa uhlelo lwakho lokusebenza. Uma ulusebenzisa pip ufake -r requirements.txt, Umphathi wephakheji kaPython ufaka konke ukuncika okubhalwe ohlwini. Kodwa nansi inkinga: uma ungaphini izinguqulo eziqondile, u- ukwethemba i-PyPI ukuze njalo kusebenze inguqulo ephephile, ehambisanayo, nengashintshiwe, njalo. Akuyona indlela i-AppSec yesimanje esebenza ngayo.
Ngaphandle kokuphina, ukwakheka kungaphuka. Okubi nakakhulu, uhlelo lwakho lokusebenza lungase ludle amaphakheji anonya ngokungazi. Ukuguqulwa okuvulekile (Ifulethi >=1.0, isibonelo) noma imikhawulo yenguqulo ekhululekile (i-django~=3.2) ziyindawo evundile yokufaka ikhodi engavikelekile. Yingakho ukuphatha kahle izidingo.txt kuwumsebenzi oyinhloko wokuphepha.
Lapho i-pip freeze kanye ne-pip install requirements.txt Breakdown
ipayipi iqhwa kulula, kodwa futhi kuyingozi uma kusetshenziswa ngaphandle kokuqonda ukuthi kubamba ini. Abathuthukisi bavame ukukhiqiza izidingo.txt usebenzisa izidingo ze-pip freeze.txt, belindele ukuthi kuzovala indawo yabo. Kodwa i-freeze ayiqinisekisi ukuphepha noma imvelaphi yokuxhomekeka; imane ilahle konke okufakiwe njengamanje, kufaka phakathi amaphakheji aguqukayo kanye nalawo angase abe yisikhathi.
Manje cabanga ngomuntu osebenza naye eqenjini, noma i-CI yakho, egijima ngokungazi pip ufake -r requirements.txtUma lelo fayela lihlanganisa okulahliwe, okusengozini, noma ngisho amaphakheji ahlanganisiwe okubhala, usanda kuzenzakalelayo isigameko sokuphepha.
Isibonelo esisheshayo:
# Developer's freeze output pip freeze > requirements.txt boto3==1.24.20 requests==2.27.1 ⚠️ Isibonelo esingavikelekile, ungasisebenzisi ekukhiqizeni
Manje engeza lokhu ku-CI yakho pipeline:
- name: Install dependencies run: pip install -r requirements.txtUthemba ukuthi indawo ingaphindwaphindwa, ukuthi akukho okushintshile ku-PyPI, nokuthi konke ukuncika isaphephile. Lokho kuyisiphetho esikhulu uma uthembele ku- izidingo ze-pip freeze.txt ukuhamba komsebenzi.
Izinsongo Zangempela ze-AppSec: Ukudideka Kokuqhathanisa Nokuthembela ku-requirements.txt
Abahlaseli bathanda izimiso zemvelo ezivulekile. Kungani? Ngoba abathuthukisi bavame ukuthembela kokuzenzakalelayo kanye nokuthembana okungacacile. Nansi indlela abahlasela ngayo besebenzisa izidingo.txt:
- Ukuthayipha: Ukulayisha iphakheji enonya enegama elifana nelithi izicelo esikhundleni se izicelo. Kususwe uhlamvu olulodwa bese ukwakheka kwakho kuba okwenu.
izicelo # ⚠️ Isibonelo esichazayo, hhayi iphakheji yangempela yokufaka
- Ukudideka Kokuthembela: Uma iphakheji yakho yangaphakathi ingaphiniwe noma ingafakwanga ngasese, abahlaseli bangashicilela inguqulo enonya ku-PyPI enegama elifanayo. Uma i-CI yakho ingaqinisekisi imithombo, uzofaka iphakheji yabo esikhundleni seyakho.
Zombili lezi zihlaselo zisebenzisa ukuntuleka kokulawula okuqinile kanye nokulawula umthombo ku izidingo.txtUma eyakho uthi nje i-lib-yangaphakathi ethile, bese ugijima izidingo zokufaka ipayipi.txt ku-CI, ingase ilande iphakheji engalungile endaweni engafanele.
Ukuvikela izidingo.txt ku CI/CD Pipelines nge-Hashes kanye ne-Pinning
Nansi indlela yokuqinisa izidingo.txt ngokumelene nezinsongo zomhlaba wangempela:
- Phina izinguqulo eziqondile: Sebenzisa njalo == kuwo wonke amaphakheji akho izidingo.txtAwekho amakhadi asendle, awekho amabanga.
- Sebenzisa –kudinga ama-hashe: Lokhu kwenza pip ufake -r requirements.txt qinisekisa ubuqotho bephakheji ngayinye elandiwe.
Isibonelo:
flask==2.2.5 \ --hash=sha256:<actual_hash_here> ⚠️ Isibonelo esibonakalayo, shintsha nge-hash yangempela kumaphrojekthi angempela
- Hlukanisa izakhiwo zakho: Yakha njalo ezitsheni ezihlanzekile nezincane. Ungalokothi uthembele esithombeni esiyisisekelo ngokungaboni.
- Sebenzisa inkomba ye-PyPI yangasese: Bamba i-proxy/cache yakho bese ubuka amaphakheji athembekile kuphela.
Sebenzisa ukuskena kokuthembela: Hlanganisa amathuluzi afana ukuhlolwa kwe-pip noma sebenzisa SBOMukuhlaziywa okusekelwe ku- pipelines.
Isibonelo sesiqephu sezenzo ze-GitHub:
- name: Secure install run: pip install --require-hashes -r requirements.txt⚠️ Ezemfundo pipeline isibonelo, vumelanisa nendawo okuyo
Ukuphathwa okuqinile kwe pip ufake -r requirements.txt in CI/CD ingenye yezindlela ezilula zokunciphisa ingozi yomthombo ovulekile.
Izakhiwo Eziphindaphindwayo: Ukuzigcina Zizinzile Kuzo Zonke Izindawo
Uma uhlelo lwakho lokusebenza lusebenza endaweni kodwa lwehluleka ekuhleleni noma ekukhiqizeni, ukuncika okungaguquki ku izidingo.txt bavame ukusolwa. Ngisho nokuzulazula kwenguqulo encane kubangela izinkinga ezinkulu.
Sebenzisa lawa masu:
- pip-amathuluzi: Sebenzisa ukuhlanganisa amapayipi ukukhiqiza izidingo.txt kusuka a izidingo.inIxazulula ukuncika ngokuphina okufanele.
- Izimpawu zemvelo: Kumaphakheji athile e-OS noma ukuncika kwenguqulo ethile yePython, sebenzisa omaka abanjengo uhlelo_lwesikhulumi == 'i-Linux'.
- Ukulondolozwa kwesikhashana kwe-Docker: Ku-CI, cache izendlalelo zakho ze-Docker ngemuva kokufaka ukuncika kusuka ku- izidingo.txt ukunciphisa ukuguquguquka kokwakhiwa.
Isibonelo ngamathuluzi e-pip:
# requirements.in flask # Compile pip-compile requirements.in ⚠️ Isibonelo esibonakalayo, umphumela wangempela uncike endaweni okuyo
Umphumela uphiniwe ngokuphelele izidingo.txt.
Amathuluzi afana ipayipi iqhwa, uma kuhlanganiswe ne pip ufake -r requirements.txt ngesikhathi sokwakha, kudinga ukuzithiba kanye nokuvikelwa okwengeziwe.
Isiphetho: Ukuvala Izidingo Zakho Ngokuzethemba
Ukuphatha kabi izidingo.txt akuyona nje imikhuba emibi; kuyingozi yokuphepha esebenzayo. Ukuchofoza okuxekethile, ukufakwa okungaqinisekisiwe, kanye nokuthembela okungaboni kubabhalisi abavulekile yizona ndlela abahlaseli abaxhaphaza ngayo CI/CD pipelineLokhu akuzona iziphambeko ezingokwemfundiso; ziyasetshenziswa nsuku zonke.
Ukubopha ukuthembela kungaphezu nje komkhuba omuhle kakhulu. Kungumugqa wakho wokuqala wokuzivikela ekuhlaselweni kwe-supply chain ePython. Hlanganisa lokho ne –kudinga ama-hashe, yakha ukwahlukaniswa, kanye namathuluzi aphindaphindwayo afana pip-amathuluzi, futhi uthola a pipeline lokho kunzima kakhulu ukuyekethisa.
Ukuthi uyasebenzisa izidingo zokufaka ipayipi.txt endaweni noma ku-CI, qinisekisa njalo futhi uqaphe ukuthi yini engena ezakhiweni zakho. Amathuluzi anjenge- I-Xygeni hlinzeka ngokubonakala, ukuphoqelelwa kwenqubomgomo, kanye nokuhlola okuzenzakalelayo okuvala uchungechunge lwakho lokuhlinzeka nge-Python kusuka izidingo ze-pip freeze.txt kuze kube sekukhiqizweni.
