From 5c0dd11ef1cbc0293615062c9866051a8f440488 Mon Sep 17 00:00:00 2001
From: Ondrej Nosek <onosek@redhat.com>
Date: Jun 01 2022 10:17:09 +0000
Subject: Set up bandit scanner for rpkg


JIRA: RHELCMP-9049

Signed-off-by: Ondrej Nosek <onosek@redhat.com>

---

diff --git a/jenkins_test.dockerfile b/jenkins_test.dockerfile
index 3c40da4..ea7e687 100644
--- a/jenkins_test.dockerfile
+++ b/jenkins_test.dockerfile
@@ -1,4 +1,4 @@
-FROM fedora:34
+FROM fedora:35
 LABEL \
     name="rpkg test" \
     description="Run tests using tox with Python 3" \
@@ -22,11 +22,12 @@ RUN dnf -y install \
         krb5-devel \
         openssl-devel \
         make \
-        git
+        git \
+        bandit
 RUN dnf clean all
 
 WORKDIR /src
 
 COPY . .
 
-CMD ["tox", "-e", "py36,py39,flake8"]
+CMD ["tox", "-e", "py36,py39,flake8,bandit"]
diff --git a/tests/test_cli.py b/tests/test_cli.py
index 4e69656..6a692ac 100644
--- a/tests/test_cli.py
+++ b/tests/test_cli.py
@@ -1405,7 +1405,7 @@ class LookasideCacheMock(object):
             f.write('binary data')
 
     def hash_file(self, filename):
-        md5 = hashlib.md5()
+        md5 = hashlib.md5()  # nosec
         with open(filename, 'rb') as f:
             content = f.read()
             md5.update(content)
diff --git a/tox.ini b/tox.ini
index 8817e20..1fd2d84 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,5 +1,5 @@
 [tox]
-envlist = py27,py36,py39,py310,flake8,doc
+envlist = py27,py36,py39,py310,flake8,doc,bandit
 
 [testenv]
 skip_install = True
@@ -48,3 +48,10 @@ deps =
     sphinx-rtd-theme
 changedir = {toxinidir}/doc
 commands = make html
+
+[testenv:bandit]
+basepython = python3
+skip_install = true
+deps = bandit
+commands = bandit -r -ll pyrpkg tests
+ignore_outcome = True