Add support for Poetry

README.md

@@ -37,7 +37,7 @@ with support from Google. This is not an official Google or Trail of Bits produc
 
 ## Features
 
-* Support for auditing local environments and requirements-style files
+* Support for auditing local environments, requirements-style files, and poetry.lock files.
 * Support for multiple vulnerability services
   ([PyPI](https://warehouse.pypa.io/api-reference/json.html#known-vulnerabilities),
   [OSV](https://osv.dev/docs/))

pip_audit/_cli.py

@@ -17,6 +17,7 @@
     PYPI_URL,
     DependencySource,
     PipSource,
+    PoetrySource,
     PyProjectSource,
     RequirementSource,
     ResolveLibResolver,
@@ -330,8 +331,14 @@ def _dep_source_from_project_path(
     project_path: Path, resolver: ResolveLibResolver, state: AuditState
 ) -> DependencySource:  # pragma: no cover
     # Check for a `pyproject.toml`
+    poetry_lock = project_path / "poetry.lock"
+    if poetry_lock.is_file():
+        logger.debug("using PoetrySource as dependency source")
+        return PoetrySource(path=poetry_lock)
+
     pyproject_path = project_path / "pyproject.toml"
     if pyproject_path.is_file():
+        logger.debug("using PyProjectSource as dependency source")
         return PyProjectSource(pyproject_path, resolver, state)
 
     # TODO: Checks for setup.py and other project files will go here.

pip_audit/_dependency_source/__init__.py

@@ -10,6 +10,7 @@
     DependencySourceError,
 )
 from .pip import PipSource, PipSourceError
+from .poetry import PoetrySource
 from .pyproject import PyProjectSource
 from .requirement import RequirementSource
 from .resolvelib import PYPI_URL, ResolveLibResolver
@@ -23,6 +24,7 @@
     "DependencySourceError",
     "PipSource",
     "PipSourceError",
+    "PoetrySource",
     "PyProjectSource",
     "RequirementSource",
     "ResolveLibResolver",

pip_audit/_dependency_source/poetry.py

@@ -0,0 +1,58 @@
+"""
+Collect dependencies from `poetry.lock` files.
+"""
+from __future__ import annotations
+
+import logging
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Iterator
+
+import toml
+from packaging.version import InvalidVersion, Version
+
+from pip_audit._dependency_source import DependencySource
+from pip_audit._fix import ResolvedFixVersion
+from pip_audit._service import Dependency, ResolvedDependency, SkippedDependency
+
+logger = logging.getLogger(__name__)
+
+
+@dataclass(frozen=True)
+class PoetrySource(DependencySource):
+    """
+    Dependency sourcing from `poetry.lock`.
+    """
+
+    path: Path
+
+    def collect(self) -> Iterator[Dependency]:
+        """
+        Collect all of the dependencies discovered by this `PoetrySource`.
+        """
+        with self.path.open("r") as stream:
+            packages = toml.load(stream)
+        for package in packages["package"]:
+            name = package["name"]
+            try:
+                version = Version(package["version"])
+            except InvalidVersion:
+                skip_reason = (
+                    "Package has invalid version and could not be audited: "
+                    f"{name} ({package['version']})"
+                )
+                logger.debug(skip_reason)
+                yield SkippedDependency(name=name, skip_reason=skip_reason)
+            else:
+                yield ResolvedDependency(name=name, version=version)
+
+    def fix(self, fix_version: ResolvedFixVersion) -> None:
+        """
+        Fixes a dependency version for this `PoetrySource`.
+
+        Requires poetry to be installed in the same env.
+
+        Note that poetry ignores the version we want to update to,
+        and goes straight to the latest version allowed in metadata.
+        """
+        raise NotImplementedError("fix is not supported for poetry yet")  # pragma: no cover

test/dependency_source/test_poetry.py

@@ -0,0 +1,34 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+from packaging.version import Version
+
+from pip_audit._dependency_source import PoetrySource
+from pip_audit._service import ResolvedDependency, SkippedDependency
+
+TEST_DATA_PATH = Path(__file__).parent / "data"
+
+
+def test_collect(tmp_path: Path) -> None:
+    lock_content = (TEST_DATA_PATH / "poetry.lock").read_text()
+    lock_path = tmp_path / "poetry.lock"
+    lock_path.write_text(lock_content)
+    sourcer = PoetrySource(path=lock_path)
+    actual = list(sourcer.collect())
+    expected = [
+        ResolvedDependency(name="jinja2", version=Version("2.11.3")),
+        ResolvedDependency(name="markupsafe", version=Version("2.1.1")),
+    ]
+    assert actual == expected
+
+
+def test_invalid_version(tmp_path: Path) -> None:
+    lock_content = (TEST_DATA_PATH / "poetry.lock").read_text()
+    lock_content = lock_content.replace("2.11.3", "oh-hi-mark")
+    lock_path = tmp_path / "poetry.lock"
+    lock_path.write_text(lock_content)
+    sourcer = PoetrySource(path=lock_path)
+    deps = list(sourcer.collect())
+    assert [dep.name for dep in deps] == ["jinja2", "markupsafe"]
+    assert isinstance(deps[0], SkippedDependency)