The Python stdlib for DevSecOps

Quick reference

Files

$from pathlib import Path
$Path(p).read_text(encoding="utf-8")
$p.stat().st_mode & 0o777
$sorted(p.parent.glob("*.conf"))

Processes

$import subprocess, shlex
$shlex.split(cmd, posix=True)
$subprocess.run(argv, check=True)
$subprocess.run(argv, capture_output=True)

Network

$import socket, ssl
$socket.create_connection((h, p), 5)
$ssl.create_default_context()
$sock.getpeercert()

Crypto

$import hashlib, hmac, secrets
$hashlib.sha256(data).hexdigest()
$hmac.compare_digest(a, b)
$secrets.token_hex(32)

Explained

Files

from pathlib import Path starts it. Path(p).read_text(encoding="utf-8") returns the whole file as a string. p.stat().st_mode & 0o777 gives the permission bits without parsing ls. sorted(p.parent.glob("*.conf")) lists the config files an audit should read.

Processes

import subprocess, shlex. shlex.split(cmd, posix=True) turns a command into an argument list without a shell. subprocess.run(argv, check=True) raises on a non-zero exit. subprocess.run(argv, capture_output=True) keeps stdout and stderr apart, which is the only way to report one without the other.

Network

import socket, ssl. socket.create_connection((h, p), 5) opens a TCP connection with a timeout. ssl.create_default_context() gives a verified TLS context. sock.getpeercert() returns the certificate as a dictionary of fields.

Crypto

import hashlib, hmac, secrets. hashlib.sha256(data).hexdigest() prints a digest. hmac.compare_digest(a, b) compares without a timing leak. secrets.token_hex(32) makes a token that is safe to use.

In one line

Check one import

$python3 -c 'import ssl, hmac'