Pip Inspector 树解析无法生成输出

Question

细节

Failure: PIP - Pip Inspector
  The Pip Inspector tree parse failed to produce output.

Overall Status: FAILURE_DETECTOR - Detect had one or more detector failures while extracting dependencies.

如需更多输出，请单击以展开。

[main] --- ======== Detect Issues ========
[main] ---
[main] --- DETECTORS:
[main] --- 	Detector Issue
[main] --- 		/workdir/test
[main] --- 		Failure: PIP - Pip Inspector
[main] --- 			The Pip Inspector tree parse failed to produce output.
[main] ---
[main] --- ======== Detect Result ========
[main] ---
[main] --- Black Duck Project BOM: https://org.blackducksoftware.com/api/projects/246c8952-7cb8-40e9-9987-35f7d4602ae1/versions/e1cb4204-42d0-4445-8675-978df62b150d/components
[main] ---
[main] --- ======== Detect Status ========
[main] ---
[main] --- GIT: SUCCESS
[main] --- PIP: FAILURE
[main] ---
[main] --- Signature scan / Snippet scan on /workdir/test: SUCCESS
[main] --- Overall Status: FAILURE_DETECTOR - Detect had one or more detector failures while extracting dependencies. Check that all projects build and your environment is configured correctly.
[main] ---
[main] --- If you need help troubleshooting this problem, generate a diagnostic zip file by adding '-d' to the command line, and provide it to Synopsys Technical Support. See 'Diagnostic Mode' in the Detect documentation for more information.
[main] ---
[main] --- ===============================
[main] ---
[main] --- Detect duration: 00h 00m 54s 951ms
[main] --- Exiting with code 5 - FAILURE_DETECTOR

环境：

• 产品：synopsys-detect-7.11.1.jar
• 其他：OpenJDK 11、Python 3.6 和 Python 2.7.5

根本原因

这次运行的更多输出，我看到它没有使用python（这是 python2）python3，所以运行pip-inspector.py失败了。

DEBUG [main-Executable_Stream_Thread] --- Python 2.7.5

...

[main] --- Running executable >/usr/bin/python /home/****/blackduck/runs/2022-03-01-07-45-05-986/shared/pip/pip-inspector.py --projectname=test

解决方案

将 python 链接到 python3，它适用于我的情况。

# save python to other name
sudo mv /usr/bin/python /usr/bin/python.old
# link python3 to python
sudo ln -s /usr/bin/python3 /usr/bin/python

然后再次尝试运行 bash <(curl -s -L https://detect.synopsys.com/detect7.sh)，我的测试命令：

bash <(curl -s -L https://detect.synopsys.com/detect7.sh) --blackduck.url=https://org.blackducksoftware.com --blackduck.api.token=MmMwMjdlOTctMT --detect.project.name=HUB --detect.project.version.name=TEST_v1.1.1 --detect.source.path=/workdir/test --logging.level.com.synopsys.integration=DEBUG --blackduck.trust.cert=TRUE --detect.tools.excluded=POLARIS --detect.blackduck.signature.scanner.snippet.matching=SNIPPET_MATCHING

如果你想使用 Docker 做 Blackduck 扫描，你可以创建一个 Docker 镜像。像这样

FROM openjdk:11

# Set DETECT version you need, if it's empty download the latest version.
# https://sig-repo.synopsys.com/artifactory/bds-integrations-release/com/synopsys/integration/synopsys-detect
ENV DETECT_LATEST_RELEASE_VERSION=""

RUN apt-get update \
    && apt-get upgrade -y \
    && apt-get install -y \
        git \
        python \
        pip \
    && apt-get autoremove \
    && apt-get clean

RUN curl -sSOL https://detect.synopsys.com/detect7.sh && bash detect7.sh --help \
    && rm -rf /usr/bin/python \
    && ln -s /usr/bin/python3 /usr/bin/python

WORKDIR /src

希望这有帮助。