checking pyspark against gemnasium throws an exception

[stesix]

command to reproduce the issue: echo 'pyspark==3.1.2' | skjold -v audit --sources gemnasium -

Result:

Warning: No 'pyproject.toml' found!
sources: []
report_only: False
report_format: cli
verbose: True
cache_dir: .skjold_cache
cache_expires: 43200
ignore_file: .skjoldignore
Using .skjold_cache as cache location
Using .skjoldignore as ignore file
Checking 1 package(s).
Using ['gemnasium'] as source(s).
Traceback (most recent call last):
  File "/usr/local/lib/python3.8/site-packages/packaging/specifiers.py", line 634, in __init__
    parsed.add(Specifier(specifier))
  File "/usr/local/lib/python3.8/site-packages/packaging/specifiers.py", line 98, in __init__
    raise InvalidSpecifier(f"Invalid specifier: '{spec}'")
packaging.specifiers.InvalidSpecifier: Invalid specifier: '('

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/merge/.local/bin/skjold", line 8, in <module>
    sys.exit(cli())
  File "/usr/local/lib/python3.8/site-packages/click/core.py", line 1128, in __call__
    return self.main(*args, **kwargs)
  File "/usr/local/lib/python3.8/site-packages/click/core.py", line 1053, in main
    rv = self.invoke(ctx)
  File "/usr/local/lib/python3.8/site-packages/click/core.py", line 1659, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "/usr/local/lib/python3.8/site-packages/click/core.py", line 1395, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "/usr/local/lib/python3.8/site-packages/click/core.py", line 754, in invoke
    return __callback(*args, **kwargs)
  File "/usr/local/lib/python3.8/site-packages/click/decorators.py", line 84, in new_func
    return ctx.invoke(f, obj, *args, **kwargs)
  File "/usr/local/lib/python3.8/site-packages/click/core.py", line 754, in invoke
    return __callback(*args, **kwargs)
  File "/merge/.local/lib/python3.8/site-packages/skjold/cli.py", line 184, in audit_
    findings = audit(config, packages, ignore=ignore)
  File "/merge/.local/lib/python3.8/site-packages/skjold/tasks.py", line 222, in audit
    is_vulnerable, advisories = source.is_vulnerable_package(
  File "/merge/.local/lib/python3.8/site-packages/skjold/sources/gemnasium.py", line 140, in is_vulnerable_package
    if candidate.is_affected(package_version):
  File "/merge/.local/lib/python3.8/site-packages/skjold/sources/gemnasium.py", line 81, in is_affected
    affected_versions = map(allows_, self.vulnerable_version_range)
  File "/merge/.local/lib/python3.8/site-packages/skjold/sources/gemnasium.py", line 66, in vulnerable_version_range
    return [
  File "/merge/.local/lib/python3.8/site-packages/skjold/sources/gemnasium.py", line 67, in <listcomp>
    specifiers.SpecifierSet(x, prereleases=True)
  File "/usr/local/lib/python3.8/site-packages/packaging/specifiers.py", line 636, in __init__
    parsed.add(LegacySpecifier(specifier))
  File "/usr/local/lib/python3.8/site-packages/packaging/specifiers.py", line 253, in __init__
    super().__init__(spec, prereleases)
  File "/usr/local/lib/python3.8/site-packages/packaging/specifiers.py", line 98, in __init__
    raise InvalidSpecifier(f"Invalid specifier: '{spec}'")
packaging.specifiers.InvalidSpecifier: Invalid specifier: '('

[twu]

👋 Thanks for reporting this :) It looks like gemnasium is using (,0) (See pypi/pyspark/CVE-2020-27218.yml) to mark false positives which results in the above error. I will start working on skjold again soon-ish once RL has cleaned up a little. If you want tackle this I'm happy to review and merge 🙇