Use system pycurl packages instead of pip installation#13994
Closed
valentijnscholten wants to merge 2 commits intoDefectDojo:devfrom
Closed
Use system pycurl packages instead of pip installation#13994valentijnscholten wants to merge 2 commits intoDefectDojo:devfrom
valentijnscholten wants to merge 2 commits intoDefectDojo:devfrom
Conversation
Remove pycurl from requirements.txt and use OS-provided packages instead: - Debian: python3-pycurl (7.45.6) - Alpine: py3-curl (7.45.6) Benefits: - Eliminates pycurl compilation during Docker builds - Removes need for curl-dev/libcurl4-openssl-dev build dependencies - Faster Docker image builds - Consistent pycurl version across Debian and Alpine images pycurl is only needed for Celery SQS broker support. It is not directly imported by DefectDojo code - it's a transitive dependency that Celery uses when configured with an SQS broker (DD_CELERY_BROKER_SCHEME=sqs). The system packages provide the same functionality without requiring compilation toolchains in the Docker build stage.
valentijnscholten
requested review from
Maffooch and
mtesauro
as code owners
Maffooch
approved these changes
Dec 29, 2025
blakeaowens
approved these changes
Dec 30, 2025
Member
Author
|
Now that is looks like we will keep building our own pscyopg and uwsgi packages, moving pycurl to a system package has limited benefits. I created #14004 instead to use the recommened way to install celery + sqs dependencies. |
Jino-T
approved these changes
Dec 30, 2025
Member
Author
|
Closing as we're going with #14004 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Remove pycurl from
requirements.txtand use OS-provided system packages instead to eliminate the need for compilation during Docker builds.Why Remove pycurl from requirements.txt?
1. pycurl is NOT directly used by DefectDojo
pycurl is only a transitive dependency for Celery's SQS broker transport. It's only needed when
DD_CELERY_BROKER_SCHEME=sqsis configured.2. No binary wheels for Linux
pycurl does not provide pre-compiled
manylinuxormusllinuxwheels, requiring compilation from source during every Docker build. This requires:curl-dev/libcurl4-openssl-devheadersgccand build toolsPYCURL_SSL_LIBRARY=opensslenvironment variable3. System packages are available and well-maintained
python3-pycurlpy3-curlBoth provide the same version, ensuring consistency across image variants.
Impact on Users
pip install pycurlor system package)