How to get of rid of "Unable to find python site-packages directory. License detection is skipped. err="site-packages directory not found""

[sudhakarmancha]

Description

Hi Team,

Kudos to the entire team for building a such an amazing tool which enables developers early indication of vulnerabilities.

I have tried Trivy on package manger pom.xml ,the results are very encouraging . But its there is python scan errors.
I tried scanning the GitHub repo : https://github.com/CybOXProject/python-cybox.

Desired Behavior

Dependencies declared in requirements.txt file should be captured and their corresponding licenses should be provided in a json format

Actual Behavior

Ouput for Running trivy repo scan

D:\Shift_Left_Scripts>trivy repo "https://github.com/CybOXProject/python-cybox"
2024-12-11T18:34:42+05:30 INFO [vuln] Vulnerability scanning is enabled
2024-12-11T18:34:42+05:30 INFO [secret] Secret scanning is enabled
2024-12-11T18:34:42+05:30 INFO [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-12-11T18:34:42+05:30 INFO [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
Enumerating objects: 4265, done.
Counting objects: 100% (4265/4265), done.
Compressing objects: 100% (1954/1954), done.
Total 4265 (delta 3274), reused 3089 (delta 2306), pack-reused 0 (from 0)
2024-12-11T18:34:49+05:30 WARN [pip] Unable to find python site-packages directory. License detection is skipped. err="site-packages directory not found"
2024-12-11T18:34:49+05:30 INFO Number of language-specific files num=1
2024-12-11T18:34:49+05:30 INFO [pip] Detecting vulnerabilities...

D:\Shift_Left_Scripts>

Reproduction Steps

I understand may be requirments.txt might not have vulnerabilities but when i tried to perform License Scanning i get an error "Unable to find python `site-packages` directory. License detection is skipped.    err="site-packages directory not found".

How to move  forward with this error.?
 I tried checking documentation https://trivy.dev/latest/docs/coverage/language/python/#license-detection. This was of no help.

Target

Filesystem

Scanner

License

Output Format

Table

Mode

Standalone

Debug Output

D:\Shift_Left_Scripts>trivy repo --debug "https://github.com/CybOXProject/python-cybox"
2024-12-11T18:48:31+05:30       DEBUG   No plugins loaded
2024-12-11T18:48:31+05:30       DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2024-12-11T18:48:31+05:30       DEBUG   Cache dir       dir="C:\\Users\\Suda\\AppData\\Local\\trivy"
2024-12-11T18:48:31+05:30       DEBUG   Cache dir       dir="C:\\Users\\suda\\AppData\\Local\\trivy"
2024-12-11T18:48:31+05:30       DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2024-12-11T18:48:31+05:30       DEBUG   Ignore statuses statuses=[]
2024-12-11T18:48:31+05:30       DEBUG   DB update was skipped because the local DB is the latest
2024-12-11T18:48:31+05:30       DEBUG   DB info schema=2 updated_at=2024-12-11T06:14:55.050768502Z next_update=2024-12-12T06:14:55.050768092Z downloaded_at=2024-12-11T10:53:21.2154361Z
2024-12-11T18:48:31+05:30       DEBUG   [pkg] Package types     types=[library]
2024-12-11T18:48:31+05:30       DEBUG   [pkg] Package relationships     relationships=[unknown root direct indirect]
2024-12-11T18:48:31+05:30       INFO    [vuln] Vulnerability scanning is enabled
2024-12-11T18:48:31+05:30       INFO    [secret] Secret scanning is enabled
2024-12-11T18:48:31+05:30       INFO    [secret] If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-12-11T18:48:31+05:30       INFO    [secret] Please see also https://aquasecurity.github.io/trivy/v0.56/docs/scanner/secret#recommendation for faster secret detection
2024-12-11T18:48:31+05:30       DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2024-12-11T18:48:31+05:30       DEBUG   Initializing scan cache...      type="memory"
Enumerating objects: 4265, done.
Counting objects: 100% (4265/4265), done.
Compressing objects: 100% (1954/1954), done.
Total 4265 (delta 3274), reused 3089 (delta 2306), pack-reused 0 (from 0)
2024-12-11T18:48:37+05:30       DEBUG   [secret] No secret config detected      config_path="trivy-secret.yaml"
2024-12-11T18:48:37+05:30       DEBUG   Skipping path   path=".git"
2024-12-11T18:48:38+05:30       WARN    [pip] Unable to find python `site-packages` directory. License detection is skipped.    err="site-packages directory not found"
2024-12-11T18:48:38+05:30       DEBUG   OS is not detected.
2024-12-11T18:48:38+05:30       INFO    Number of language-specific files       num=1
2024-12-11T18:48:38+05:30       INFO    [pip] Detecting vulnerabilities...
2024-12-11T18:48:38+05:30       DEBUG   [pip] Scanning packages for vulnerabilities     file_path="requirements.txt"
2024-12-11T18:48:38+05:30       DEBUG   [vex] VEX filtering is disabled

Operating System

Windows 10

Version

D:\Shift_Left_Scripts>trivy --version
Version: 0.56.2
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-12-11 06:14:55.050768502 +0000 UTC
  NextUpdate: 2024-12-12 06:14:55.050768092 +0000 UTC
  DownloadedAt: 2024-12-11 10:53:21.2154361 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2024-10-26 02:39:43.510856723 +0000 UTC
  NextUpdate: 2024-10-29 02:39:43.510856543 +0000 UTC
  DownloadedAt: 2024-10-26 07:38:29.5320278 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[DmitriyLewen]

Hello @sudhakarmancha
Thank you for the kind words!

requirments.txt file doesn't contain information about licenses.
Therefore, Trivy detects licenses from **/site-packages/<pkg_name>-<pkg_version>.dist-info/METADATA files.

Unfortunately, there is no simple way to detect path to site-packages.
As you saw in docs, we try to detect this dir using VIRTUAL_ENV env and path to python binary.
But this is not always work.

If you want to detect licenses for python dependencies - you need to "help" Trivy detect site-packages dir.
One way is to:

• use VIRTUAL_ENV with path to site-packages dir when running Trivy.
• make sure that site-packages dir contains required packages (UUIC pip install command for your requirements.txt file should save them)

Regards, Dmitriy