Dependent Package "packaging" upgrade halts invocation
See original GitHub issueDescribe the issue
Currently we are running checkov in a CI environment in Azure DevOps over our Terraform configurations. Earlier today Checkov started failing to run, at first it was believed to link to the release that occurred earlier.
Investigation though has shown that the dependency packaging
has also had a release, wherein it has dropped LegacyVersion
from its codebase (see stack trace).
The quick solution is to pin packaging==21.3
to ensure the needed codebase functionality is in place.
This seems to only apply to environments that fresh install everything, as this was innoticed in local development until the CI pipeline triggered the issue.
Examples In the ADO CI this simple version should recreate the behavior:
- script: |
python -m pip install --upgrade pip setuptools wheel
pip install checkov
displayName: "Install Checkov"
- task: Bash@3
displayName: Run Checkov tests
inputs:
targetType: "inline"
script: |
checkov -d . -o cli
Exception Trace
Traceback (most recent call last):
File "/opt/hostedtoolcache/Python/3.8.15/x64/bin/checkov", line 2, in <module>
from checkov.main import run
File "/opt/hostedtoolcache/Python/3.8.15/x64/lib/python3.8/site-packages/checkov/main.py", line 20, in <module>
from checkov.argo_workflows.runner import Runner as argo_workflows_runner
File "/opt/hostedtoolcache/Python/3.8.15/x64/lib/python3.8/site-packages/checkov/argo_workflows/runner.py", line 7, in <module>
from checkov.common.images.image_referencer import ImageReferencer, Image
File "/opt/hostedtoolcache/Python/3.8.15/x64/lib/python3.8/site-packages/checkov/common/images/image_referencer.py", line 12, in <module>
from checkov.common.bridgecrew.vulnerability_scanning.image_scanner import image_scanner
File "/opt/hostedtoolcache/Python/3.8.15/x64/lib/python3.8/site-packages/checkov/common/bridgecrew/vulnerability_scanning/image_scanner.py", line 15, in <module>
from checkov.common.bridgecrew.vulnerability_scanning.integrations.docker_image_scanning import \
File "/opt/hostedtoolcache/Python/3.8.15/x64/lib/python3.8/site-packages/checkov/common/bridgecrew/vulnerability_scanning/integrations/docker_image_scanning.py", line 8, in <module>
from checkov.common.bridgecrew.vulnerability_scanning.integrations.twistcli import TwistcliIntegration
File "/opt/hostedtoolcache/Python/3.8.15/x64/lib/python3.8/site-packages/checkov/common/bridgecrew/vulnerability_scanning/integrations/twistcli.py", line 11, in <module>
from checkov.common.bridgecrew.platform_integration import bc_integration
File "/opt/hostedtoolcache/Python/3.8.15/x64/lib/python3.8/site-packages/checkov/common/bridgecrew/platform_integration.py", line 31, in <module>
from checkov.common.bridgecrew.wrapper import reduce_scan_reports, persist_checks_results, \
File "/opt/hostedtoolcache/Python/3.8.15/x64/lib/python3.8/site-packages/checkov/common/bridgecrew/wrapper.py", line 14, in <module>
from checkov.common.util.json_utils import CustomJSONEncoder
File "/opt/hostedtoolcache/Python/3.8.15/x64/lib/python3.8/site-packages/checkov/common/util/json_utils.py", line 6, in <module>
from packaging.version import LegacyVersion, Version
ImportError: cannot import name 'LegacyVersion' from 'packaging.version' (/opt/hostedtoolcache/Python/3.8.15/x64/lib/python3.8/site-packages/packaging/version.py)
Desktop (please complete the following information):
- OS: Ubuntu 20.04 ADO Pipeline Container
- Checkov Version: tested 2.2.124 and 2.2.116, likely applies to others if they have the dependency
Additional context
Release in packaging that causes this issue is 22.0
, 21.3
appears to function as expected.
Issue Analytics
- State:
- Created 9 months ago
- Reactions:5
- Comments:5 (1 by maintainers)
Thanks for that. I instead just explicitly installed the working version of
packaging
to work around it, since we run it in a parallel step to the plan due to the scale of the environment.Thank you all for reporting @YustinS @tyconsulting @philthynz et al.
We pinned the version of packaging for now, will work on a more permanent solution (see #4013 )
Fixed version is checkov 2.2.125