
    ܖi>                       d Z ddlmZ ddlZddlZddlZddlmZ ddlm	Z	 ddl
mZ ddlmZmZ ddlmZ dd	lmZ dd
lmZ ddlmZ ddlmZmZmZ ddlmZmZmZmZ ddl m!Z! ddl"m#Z# ddl$m%Z%m&Z& ddl'm(Z( ddl)m*Z*m+Z+  ejX                  e-      Z. ej^                  dej`                        Z1 G d de      Z2 G d de      Z3 G d de      Z4y)zK
Collect dependencies from one or more `requirements.txt`-formatted files.
    )annotationsN)Iterator)	ExitStack)Path)NamedTemporaryFileTemporaryDirectory)IO)SpecifierSet)canonicalize_name)Version)InstallRequirementInvalidRequirementLineRequirementsFile)DependencyFixErrorDependencySourceDependencySourceErrorInvalidRequirementSpecifier)ResolvedFixVersion)
Dependency)ResolvedDependencySkippedDependency)
AuditState)
VirtualEnvVirtualEnvErrorz==(?P<version>.+?)$c                      e Zd ZdZdddddg  e       d	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 ddZddZddZddZdd	Z	dd
Z
	 	 	 	 	 	 ddZy)RequirementSourcezP
    Wraps `requirements.txt` dependency resolution as a dependency source.
    FN)require_hashesno_depsdisable_pipskip_editable	index_urlextra_index_urlsstatec                   || _         || _        || _        || _        || _        || _        || _        || _        i | _        y)a  
        Create a new `RequirementSource`.

        `filenames` provides the list of filepaths to parse.

        `require_hashes` controls the hash policy: if `True`, dependency collection
        will fail unless all requirements include hashes.

        `disable_pip` controls the dependency resolution policy: if `True`,
        dependency resolution is not performed and the inputs are checked
        and treated as "frozen".

        `no_deps` controls whether dependency resolution can be disabled even without
        hashed requirements (which implies a fully resolved requirements file): if `True`,
        `disable_pip` is allowed without a hashed requirements file.

        `skip_editable` controls whether requirements marked as "editable" are skipped.
        By default, editable requirements are not skipped.

        `index_url` is the base URL of the package index.

        `extra_index_urls` are the extra URLs of package indexes.

        `state` is an `AuditState` to use for state callbacks.
        N)	
_filenames_require_hashes_no_deps_disable_pip_skip_editable
_index_url_extra_index_urlsr#   
_dep_cache)	self	filenamesr   r   r   r    r!   r"   r#   s	            l/var/www/html/content-pipeline/venv/lib/python3.12/site-packages/pip_audit/_dependency_source/requirement.py__init__zRequirementSource.__init__/   sH    J $-'+#!1
79    c              #    K   g }g }	 | j                   D ]  }|j                         rst        dd      }|j                  d      5 }t	        j
                  ||       ddd       |j                          t        |j                        }|j                  |       |j                  |        | j                  |      E d{    |D ]  }|j                           y# 1 sw Y   xY w7 (# |D ]  }|j                           w xY ww)z
        Collect all of the dependencies discovered by this `RequirementSource`.

        Raises a `RequirementSourceError` on any errors.
        wF)modedeleterN)r%   is_fifor   openshutilcopyfileobjcloser   nameappend_collect_from_filesunlink)r-   collect_files	tmp_filesfilenametmp_filefts          r/   collectzRequirementSource.collect^   s      	$	 OO / ##%
  2s5IH!s+ 8q**1h78 NN$#HMM2H$$X.$$X.7/< //>>>  
8 8 ?  
sA   D=C, CA%C, C*C, DC'	#C, ,DDc           	   #    K   g }| j                   }|D ]  }t        j                  |      }t        |j                        dkD  r7|j                  d   }t        d| d|j                   d|j                         |xs t        d |j                  D              }|j                  |j                          | j                  r=| j                  s|st        d      | j                  t        |      |      E d {    y g }| j                   r|j!                  d       |D ]  }|j                  dt#        |      g         t%        || j&                  | j(                  | j*                        }	 t-               5 }	|j/                  |	       d d d        |j2                  D ]  \  }}t5        ||	        y 7 # 1 sw Y   /xY w# t0        $ r}
t        t#        |
            |
d }
~
ww xY ww)
Nr   requirement file z$ contains invalid specifier at line : c              3  4   K   | ]  }|j                     y w)N)hash_options).0reqs     r/   	<genexpr>z8RequirementSource._collect_from_files.<locals>.<genexpr>   s     2_33C3C2_s   zsthe --disable-pip flag can only be used with a hashed requirements files or if the --no-deps flag has been providedz--require-hashesz-r)r<   version)r&   r   	from_fileleninvalid_linesr   line_numbererror_messageanyrequirementsextendr(   r'   RequirementSourceError_collect_preresolved_depsiterr=   strr   r*   r+   r#   r   creater   installed_packagesr   )r-   r.   reqsr   rB   rfinvalidve_argsveve_direxcr<   rO   s                r/   r>   z%RequirementSource._collect_from_files   s    )+#33! 	)H!++H5B2##$q(**1-1'z 2#//073H3H2IK  ,_s2_r2_/_NKK(	)  ==,>  55d4j.QQQNN-.! 	2HNND#h-01	2 $2H2H$**U	<#% "		&!"  22 	AMD'$$@@	A% R" " 	<(S2;	<sO   C8G+:F7;A3G+/
G 9F9G %G+9G>G 	G(G##G((G+c                   t               5 }| j                  D cg c]  }|j                  t        d             }}t	        | j                  |      D ]5  \  }}|j                  d      5 }t        j                  ||       ddd       7 	 | j                  D ]k  }| j                  j                  d|j                  j                   d|j                  j                   d|j                   d       | j                  ||       m 	 ddd       yc c}w # 1 sw Y   xY w# t        $ r0}t        j!                  d	|        | j#                  |       |d}~ww xY w# 1 sw Y   yxY w)
zJ
        Fixes a dependency version for this `RequirementSource`.
        zr+)r4   r6   NzFixing dependency z (z => )zJencountered an exception while applying fixes, recovering original files: )r   r%   enter_contextr   zipr8   r9   r:   r#   update_statedepr<   rO   	_fix_file	Exceptionloggerwarning_recover_files)	r-   fix_versionstack_rA   rB   rC   rD   es	            r/   fixzRequirementSource.fix   sg    [ 	E MQOO(GH##$6D$AB(I ( '*$//9&E 4"(]]3' 41&&q(34 44 $ :HJJ++,[__-A-A,B"[__E\E\D]]a&../q2 NN8[9:	 	(4 4  `ab`cd ##I.%	 	sR   E"D/E+D
EA:D"EDE"	E++EEEE'c           	        t        t        j                  |j                                     }t	               }|D ]  }t        |t              r|j                  |j                  j                         rw|j                  k|j                  |j                        }|s|j                  ||j                  <   |||j                  k7  st        d|j                   dt        |             t        |t              st        d| dt        |              |j!                  d      5 }d}|D ]  }t        |t              rt#        |j                        |j$                  j&                  k(  r}d}|j                  j)                  |j$                  j*                        rL|j                  j)                  |j*                        s't-        d	|j*                         |j                  _        t/        |j1                         |
        |slt2        j5                  d| d|j$                  j&                          t/        d|
       t/        |j$                  j&                   d	|j*                   |
       d d d        y # 1 sw Y   y xY w)N)rB   package  has duplicate requirements: rH   z has invalid requirement: r3   FTz==)filez:added fixed subdependency explicitly to requirements file rI   z/    # pip-audit: subdependency explicitly fixed)listr   parseas_posixdict
isinstancer   markerevaluaterM   getr<   	specifierRequirementFixErrorr[   r   r8   r   rj   canonical_namecontainsrO   r
   printdumpsrm   rn   )	r-   rB   rp   r^   req_specifiersrM   duplicate_req_specifierrD   founds	            r/   rk   zRequirementSource._fix_file   s-    $**H4E4E4GHI
 37& 	C3 23ZZ'3::+>+>+@GG'*8*<*<SXX*F'./2}}N388,,=-"388*,I#c(T  C!78)'z1KCPSH:V !	* ]]3 	Z1E 
+s$67)#((3{7U7UU E}}--#//!mm44[5H5HI,82k>Q>Q=R9S,T)ciik*
+& Pj;??#A#A"BD E 778;;N;N:OPWXY=	Z 	Z 	Zs   'EI<<Jc                8   t        | j                  |      D ]G  \  }}	 |j                  d       |j                  d      5 }t	        j
                  ||       d d d        I y # 1 sw Y   xY w# t        $ r"}t        j                  d|        Y d }~}d }~ww xY w)Nr   r3   z/encountered an exception during file recovery: )	rh   r%   seekr8   r9   r:   rl   rm   rn   )r-   rA   rB   rC   rD   rs   s         r/   ro   z RequirementSource._recover_files  s    "%dooy"A 		Hha ]]3' 41&&x34		4 4  !PQRPSTU	s/   "A. A"A."A+	'A..	B7BBc           	   #    K   t               }|D ]  }|j                  s|rt        d|j                          d      |j                  $t        |j                  j                  d       _| j                  r%|j                  rt        |j                  d       |j                  |j                  j                         s|j                  |j                        }|s|j                  ||j                  <   n5||j                  k7  r$t        d|j                   dt        |             #|j                   rt        |j                  d	       J|j                  s$t        d|j                   d
t        |             t"        j%                  t        |j                              }|$t        d|j                   dt        |             t'        |j                  t)        |j+                  d                    yw)z=
        Collect pre-resolved (pinned) dependencies.
        zrequirement z does not contain a hashNz5could not deduce package version from URL requirement)r<   skip_reasonzrequirement marked as editablerv   rw   z?URL requirements cannot be pinned to a specific package versionz is not pinned: z$ is not pinned to an exact version: rO   )r|   rK   rX   r   rM   r   requirement_lineliner)   is_editabler<   r~   r   r   r   r[   is_urlPINNED_SPECIFIER_REmatchr   r   group)r-   r^   r   r   rM   r   pinned_specifiers          r/   rY   z+RequirementSource._collect_preresolved_deps'  s     37& 9	_C##,|CIIK=H`-abbww (--22 W  ""s'SXXCcddzz%cjj.A.A.C &4&8&8&B#*+.==sxx( )CMM9,sxxj(Ec#hZP   zz' a  ]],|CHH:EUVYZ]V^U_-`aa#6#<#<S=O#P #+0&sxxj0TUXY\U]T^_  )7;K;Q;QR[;\3]^^s9	_s   H	H)r.   
list[Path]r   boolr   r   r   r   r    r   r!   z
str | Noner"   z	list[str]r#   r   returnNone)r   Iterator[Dependency])r.   r   r   r   )rp   r   r   r   )rB   r   rp   r   r   r   )rA   zlist[IO[str]]r   r   )r^   zIterator[InstallRequirement]r   r   r   r   )__name__
__module____qualname____doc__r   r0   rF   r>   rt   rk   ro   rY    r1   r/   r   r   *   s      %!# $&(&L-:-: 	-:
 -: -: -: -: $-: -: 
-:^-^-A^:@ZD
@_0@_BF@_	@_r1   r   c                      e Zd ZdZy)rX   z8A requirements-parsing specific `DependencySourceError`.Nr   r   r   r   r   r1   r/   rX   rX   j  s    Br1   rX   c                      e Zd ZdZy)r   z4A requirements-fixing specific `DependencyFixError`.Nr   r   r1   r/   r   r   p  s    >r1   r   )5r   
__future__r   loggingrer9   collections.abcr   
contextlibr   pathlibr   tempfiler   r   typingr	   packaging.specifiersr
   packaging.utilsr   packaging.versionr   pip_requirements_parserr   r   r   pip_audit._dependency_sourcer   r   r   r   pip_audit._fixr   pip_audit._servicer   pip_audit._service.interfacer   r   pip_audit._stater   pip_audit._virtual_envr   r   	getLoggerr   rm   compileVERBOSEr   r   rX   r   r   r1   r/   <module>r      s    #  	  $    ;  - - %   . ) N ' >			8	$ bjj!7D }_( }_@
	2 		, 	r1   