Draft PEP: Adding Vulnerability Data to the Simple API for Package Indexes

[pf_moore (Paul Moore)]

Trawling through the pip-audit discussion, I found this:

@pf_moore

For example, I note that the PyPI JSON API has “vulnerabilities” as a key at the project level. Surely vulnerabilities should be flagged at release level at a minimum, if not at file level? Consider the example from that 3rd pip issue - if a company mirrors PyPI on its local index, and adds a wheel for a project that fixes a known vulnerability that upstream hasn’t dealt with yet - surely an audit should report that the project is safe if the build uses that local wheel, but not if it uses the upstream code?

That’s the sort of issue we should be discussing and resolving in a PEP for exposing vulnerability data.

I had forgotten that previous discussion, and as a result raised this again here. It really isn’t a useful way to spend people’s time, expecting them to hunt out all of this context. It’s the job of the PEP to collect and summarise prior discussions and conclusions in support of the proposal (as well as prior objections, so that they can be addressed in the PEP). While I appreciate the PEP is still just a draft, I think it needs a significant amount of fleshing out before submitting it for public review.