https://blogs.python-gsoc.orgUpdates on different articles published on BreadGenie's BlogenThu, 19 Aug 2021 02:33:16 +0000https://blogs.python-gsoc.org/en/breadgenies-blog/gsoc-week-11-1/GSoC period is over. I'm a bit sad but happy that it happened. I was able to learn a lot and was able to hangout with some of the coolest people I've ever met. Thank you to my mentors (Terri, John, Anthony, Harmandeep and Saurabh) and fellow contributors (Sahil, Harsh and Dmitry Volodin) for helping me out through the whole period.<br><br> My eyes may be taking a rest after my LASIK surgery while you are reading this. Probably the longest rest without any screens for my whole life. Excited and a bit nervous of how I will have to handle time without any electronic equipments for a week. Hoping everyone will stay healthy and hydrated.<br><br> Until next time<br> - Breadmsuhailbh07@gmail.com (BreadGenie)Thu, 19 Aug 2021 02:33:16 +0000https://blogs.python-gsoc.org/en/breadgenies-blog/gsoc-week-11-1/https://blogs.python-gsoc.org/en/breadgenies-blog/gsoc-week-10-1/Hello everyone! <br> <h2>What did you do this week?</h2> Wrote docs for backported fix utility and added explicit distro specification for the same. <h2>What is coming up next?</h2> Improving backported fix utility and extend support to redhat distros. <h2>Did you get stuck anywhere?</h2> No.msuhailbh07@gmail.com (BreadGenie)Thu, 19 Aug 2021 02:26:17 +0000https://blogs.python-gsoc.org/en/breadgenies-blog/gsoc-week-10-1/https://blogs.python-gsoc.org/en/breadgenies-blog/gsoc-week-9-2/Semester Exams :/ See ya next week! 👋🏻msuhailbh07@gmail.com (BreadGenie)Wed, 11 Aug 2021 11:14:52 +0000https://blogs.python-gsoc.org/en/breadgenies-blog/gsoc-week-9-2/https://blogs.python-gsoc.org/en/breadgenies-blog/gsoc-week-8-1/Hello everyone! <br> <h2>What did you do this week?</h2> I worked on reducing the verbosity of the tool, fixing a bug where the scanner throws error due to the scanned file being not what the tool expects (METADATA file present in python packages) and made checkers for pigz and sane-backends. <h2>What is coming up next?</h2> Improving backported package prompt utility and adding checkers. <h2>Did you get stuck anywhere?</h2> No.msuhailbh07@gmail.com (BreadGenie)Wed, 04 Aug 2021 12:31:48 +0000https://blogs.python-gsoc.org/en/breadgenies-blog/gsoc-week-8-1/https://blogs.python-gsoc.org/en/breadgenies-blog/gsoc-week-7-2/Hello everyone! <br> <h2>What did you do this week?</h2> I worked on adding a backported package prompt utility which outputs whether the packages scanned are backported or not and made checkers for open-vm-tools, nano, pscs-lite and poppler. <h2>What is coming up next?</h2> Improving backported package prompt utility and adding checkers. <h2>Did you get stuck anywhere?</h2> No.msuhailbh07@gmail.com (BreadGenie)Tue, 27 Jul 2021 08:02:15 +0000https://blogs.python-gsoc.org/en/breadgenies-blog/gsoc-week-7-2/https://blogs.python-gsoc.org/en/breadgenies-blog/gsoc-week-6-1/Hello everyone! <br> <h2>What did you do this week?</h2> I worked on the binary scanner of the CVE Binary Tool and managed to improve the performance by ~60% (<a href="https://github.com/intel/cve-bin-tool/pull/1227#issuecomment-881434989">Benchmarks</a>) and made checkers for Lua, mdadm, mtr and TrouSerS. <h2>What is coming up next?</h2> Adding backported package prompt utility and adding checkers. <h2>Did you get stuck anywhere?</h2> No.msuhailbh07@gmail.com (BreadGenie)Wed, 21 Jul 2021 15:41:42 +0000https://blogs.python-gsoc.org/en/breadgenies-blog/gsoc-week-6-1/https://blogs.python-gsoc.org/en/breadgenies-blog/gsoc-week-5-1/Hello everyone! <br> <h2>What did you do this week?</h2> I have extended the package list parser support for distros using pacman package manager and made checkers for gupnp, kbd, hunspell and kexec-tools. <h2>What is coming up next?</h2> Improving the package list parser utility and adding checkers. <h2>Did you get stuck anywhere?</h2> No.msuhailbh07@gmail.com (BreadGenie)Wed, 14 Jul 2021 05:38:21 +0000https://blogs.python-gsoc.org/en/breadgenies-blog/gsoc-week-5-1/https://blogs.python-gsoc.org/en/breadgenies-blog/gsoc-week-4-2/Hello everyone! <br> <h2>What did you do this week?</h2> I have added the package list parser support for distros with dpkg or rpm package manager. Currently the package list parser support is extended to CentOS, Debian, Fedora, OpenSUSE, PopOS!, RedHat Enterprise Linux and Ubuntu. I have made checkers for enscript, cryptsetup, gpgme and cronie. <h2>What is coming up next?</h2> Possibly adding package list parser support for distros using pacman package manager like Manjaro Linux and Arch Linux and add checkers. <h2>Did you get stuck anywhere?</h2> No.msuhailbh07@gmail.com (BreadGenie)Wed, 07 Jul 2021 06:37:32 +0000https://blogs.python-gsoc.org/en/breadgenies-blog/gsoc-week-4-2/https://blogs.python-gsoc.org/en/breadgenies-blog/gsoc-week-3-1/Hello everyone!<br> <h2>What did you do this week?</h2> I have almost completed the package list parser for CentOS package lists, since I downloaded the wrong .iso file for Fedora I chose to jump to CentOS (^-^"), and made checkers for ftp, bolt, gnome-shell and accountsservice. The package list parser could potentially work on any systems that use the rpm package manager since I'm using it to fetch the installed packages. <h2>What is coming up next?</h2> Adding package list parser support for Fedora and other distros and add checkers. <h2>Did you get stuck anywhere?</h2> No.msuhailbh07@gmail.com (BreadGenie)Mon, 28 Jun 2021 15:30:34 +0000https://blogs.python-gsoc.org/en/breadgenies-blog/gsoc-week-3-1/https://blogs.python-gsoc.org/en/breadgenies-blog/gsoc-week-2-2/Hello everyone!<br> <h2>What did you do this week?</h2> I have almost completed the package list parser for Ubuntu package lists and made checkers for ftp and logrotate and wrote docs for python and ubuntu package list parser. The package list parser will also work on Debian systems since I'm using <span style="background-color: black; color: white;"> dpkg-query</span> to fetch the installed packages. <h2>What is coming up next?</h2> Adding package list parser support for Fedora and add checkers. <h2>Did you get stuck anywhere?</h2> No.msuhailbh07@gmail.com (BreadGenie)Tue, 22 Jun 2021 10:13:40 +0000https://blogs.python-gsoc.org/en/breadgenies-blog/gsoc-week-2-2/https://blogs.python-gsoc.org/en/breadgenies-blog/gsoc-week-1-2/Hello everyone!<br> <h2>What did you do this week?</h2> I have almost completed the package list parser for python packages and made a checker for dpkg. I have also tried to improve checker support for python packages and hopefully won't hit false positives.<br> <h3>Some insights on why package list parsers are made when we already have checkers</h3> <ul> <li><h4>Package list parsers are much faster than the usual scanning with checkers.</h4> Package list parsers takes an input, requiremens.txt, where the package names are listed and then use the pip freeze command to collect the installed python packages to find product name and version values and is then compared with the requirements.txt to filter out the needed packages. Then the vendor values are fetched from a CSV file containing vendor, product values. Finally the vendor, product, version values are used to query the CVE database. <br> But the the checkers have to scan the files in a package one by one to find the necessary version strings and product name which consumes a lot of time. <h4>Benchmarks</h4> <ul> <li><a href="https://user-images.githubusercontent.com/63963181/122037637-65491480-cdf2-11eb-98aa-c1ead6593b84.png">Using Checkers</a></li> <li><a href="https://user-images.githubusercontent.com/63963181/122037517-464a8280-cdf2-11eb-9004-0ae04568eebb.png">Using Package list parser</a></li> </ul> <br>That's ~7.3x faster than using checkers. :D (Scanning all my user installed python packages)</li> <li><h4>Package list parsers can detect more products than checkers</h4>Since package list parser doesn't depend on checkers it can detect more vendor-product pairs than scanning using checkers (but can hit some false positives too, eg: commonmark and zstandard).<br> Here 4 unique products are scanned while using checkers and 9 unique products (just the products with vendor-product pairs in the CVE database)while using package list parser. </li></ul> <h2>What is coming up next?</h2> Refactoring the parser code for better runtime, writing the docs for parser and adding checkers. <h2>Did you get stuck anywhere?</h2> No.msuhailbh07@gmail.com (BreadGenie)Tue, 15 Jun 2021 10:49:57 +0000https://blogs.python-gsoc.org/en/breadgenies-blog/gsoc-week-1-2/https://blogs.python-gsoc.org/en/breadgenies-blog/gsoc-week-0/Hello Everyone!<br> I'm Muhammed Suhail, a pre-final year student at GEC Palakkad.<br><br> I'll be working on CVE Binary Tool this summer on adding a tool for the CVE Binary tool that reads a package list (like requirements.txt) and scan for CVEs for the packages in the list which will immensely improve the time for scanning packages compared to binary scans. <h2>What did you do this week?</h2> I worked on implementing the parser specifically for the PyPI packages list, which takes a requirements.txt (for now) file as an input using a -L or --package-list flag and extracts the necessary values for the CVE Binary Tool to check for CVEs under the hood. <h2>What will you be doing for the rest of the week?</h2> I will be further improving the parser for PyPI packages and will be adding the checkers for some of those packages to the CVE Binary Tool. <h2>Did you get stuck anywhere?</h2> Yup, I had a bit of difficulty in understanding pytest parametrization.<br> Also one of the tests I wrote is unstable for now. So I will be rewriting that after I brainstorm how to make it stable this week.<br><br> Looking forward to a fruitful summer with mentors and fellow contributors :Dmsuhailbh07@gmail.com (BreadGenie)Wed, 09 Jun 2021 14:13:22 +0000https://blogs.python-gsoc.org/en/breadgenies-blog/gsoc-week-0/