FEAT: Replaced GPL/LGPL licensed dependencies with permissive alternate dependencies #1125

0xFirestorm · 2025-10-10T23:01:04Z

Description

This PR replaces three GPL/LGPL licensed dependencies with permissively licensed alternatives. All replacements maintain full backward compatibility with existing functionality.
Dependencies Replaced:

aioconsole → questionary (GPL-3.0 → MIT)
Used in XPIA manual workflow for async user input
File: pyrit/executor/workflow/xpia.py
pycountry → iso3166 (LGPL-2.1 → Apache-2.0)
Provides country/region names for bias testing datasets
File: pyrit/datasets/seclists_bias_testing_dataset.py
Added hardcoded subdivision list extracted from pycountry's subdivision list, since iso3166 only provides countries
fpdf2 → ReportLab (LGPL-3.0 → BSD)
Generates PDFs and overlays text on existing PDFs
File: pyrit/prompt_converter/pdf_converter.py
Implemented custom text wrapping to match original behavior.

Issue no:
#1123

@romanlutz

Tests and Documentation

Unit test for the three modified files:

romanlutz

Thanks for coming up with replacement suggestions! I responded on all three. Let me knwo what you think.

pyrit/datasets/seclists_bias_testing_dataset.py

romanlutz · 2025-10-10T23:16:02Z

pyrit/datasets/seclists_bias_testing_dataset.py

-    subdivisions = list(pycountry.subdivisions)
+    # NEW:
+    # Build country names list from iso3166
+    country_names = [c.name for c in countries]


if we're just doing a list like this for subdivision names why not for countries as well? Perhaps that's simpler than adding a dependency

romanlutz · 2025-10-10T23:22:57Z

pyrit/executor/workflow/xpia.py

+            prompt = "Please trigger the processing target's execution and paste the output here:"
+            return await questionary.text(prompt).ask_async()  # type: ignore


I'm reluctant to introduce yet another dependency just for this one line...

So far, this workflow is something we run by itself anyway so blocking with input(...) would be ok. Or maybe something like

await asyncio.to_thread(input, prompt)

is also fine. Not sure if that messes with jupyter, though.

pyrit/prompt_converter/pdf_converter.py

…ce_gpl_libraries

0xFirestorm · 2025-10-13T18:55:51Z

@0xFirestorm please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
@microsoft-github-policy-service agree [company="{your company}"]
Options:

(default - no company specified) I have sole ownership of intellectual property rights to my Submissions and I am not making Submissions in the course of work for my employer.
@microsoft-github-policy-service agree
(when company given) I am making Submissions in the course of work for my employer (or my employer has intellectual property rights in my Submissions by contract or applicable law). I have permission from my employer to make Submissions and enter into this Agreement on behalf of my employer. By signing below, the defined term “You” includes me and my employer.
@microsoft-github-policy-service agree company="Microsoft"
Contributor License Agreement

@microsoft-github-policy-service agree

…zure#1124)

0xFirestorm · 2025-10-15T00:54:15Z

Hi @romanlutz ,
I’ve removed the krippendorff dependency and implemented the functionality myself. I’ve pushed the changes. Could you please review them when you get a chance?

romanlutz · 2025-10-15T01:28:15Z

Sounds good. I wanted to review but it seems like you pulled in th changes from the Entra PR. I'll pull when that's merged to make it easier to see the actual diff

romanlutz

Marked as "request changes" just because of krippendorff which we need to address differently as discussed via Discord. Thanks for the excellent contribution and please feel free to ping me on Discord anytime.

romanlutz · 2025-10-15T04:15:43Z

pyproject.toml

    "feedgen>=1.0.0",
    "flake8>=7.2.0",
    "flake8-copyright>=0.2.4",
+    "fpdf2>=2.8.3",


This should probably be removed?

romanlutz · 2025-10-15T04:17:18Z

pyrit/score/scorer_evaluation/krippendorff.py

+    Parameters
+    ----------
+    n_v : ndarray, with shape (V,)
+        Number of pairable elements for each value.
+
+    dtype : data-type
+        Result and computation data-type.
+
+    Returns
+    -------
+    e : ndarray, with shape (V, V)


Across this file, the doc style isn't what we're using elsewhere ("Google style"). Can you adjust that?

pyrit/prompt_converter/pdf_converter.py

romanlutz · 2025-10-15T04:29:41Z

pyrit/prompt_converter/pdf_converter.py

-from fpdf import FPDF
 from pypdf import PageObject, PdfReader, PdfWriter

+# from fpdf import FPDF


Suggested change

# from fpdf import FPDF

romanlutz · 2025-10-15T04:30:39Z

pyrit/prompt_converter/pdf_converter.py

+    # def _generate_pdf(self, content: str) -> bytes:
+    #     """
+    #     Generates a PDF with the given content.
+
+    #     Args:
+    #         content (str): The text content to include in the PDF.
+
+    #     Returns:
+    #         bytes: The generated PDF content in bytes.
+    #     """
+    #     pdf = FPDF(format=(self._page_width, self._page_height))  # Use custom page size
+    #     pdf.add_page()
+    #     pdf.set_font(self._font_type, size=self._font_size)  # Use custom font settings
+    #     pdf.multi_cell(self._column_width, self._row_height, content)  # Use configurable cell dimensions
+
+    #     pdf_bytes = BytesIO()
+    #     pdf.output(pdf_bytes)
+    #     return pdf_bytes.getvalue()
+


Please remove this and the references to FPDF in the code below. I'll validate this with an example I have and will report back.

…ce_gpl_libraries

…estorm/PyRIT into feat/replace_gpl_libraries

…ce_gpl_libraries

romanlutz · 2025-10-21T06:40:33Z

pyrit/score/scorer_evaluation/scorer_evaluator.py

 from pyrit.score.scorer_evaluation.metrics_type import MetricsType
 from pyrit.score.true_false.true_false_scorer import TrueFalseScorer

+from .krippendorff import alpha as _krippendorff_alpha


we should probably just call it that from the start

romanlutz · 2025-10-21T06:44:22Z

pyrit/score/scorer_evaluation/krippendorff.py

@@ -0,0 +1,154 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+"""Krippendorff's alpha for ordinal data.


Is this adapted from LightTag/simpledorff? If so, it would be nice to give them a shoutout in the docstring.

We should also add the unit tests they have to make sure the implementation doesn't have a small bug anywhere.

Yes, it was inspired by LightTag/simpledorff’s decomposition but reimplemented in numpy based form for ordinal data. I’ll add a docstring acknowledgment and create equivalent unit tests.

romanlutz · 2025-10-21T06:45:34Z

pyrit/score/scorer_evaluation/krippendorff.py

Would be great if the function was broken up a bit more to help with readability and to make it easier to understand. If you want I can provide suggestions.

Sure, I’d appreciate some suggestions on that.

Sounds good. I should be able to get to this by Thursday.

romanlutz

This is essentially ready, just needs a few small tweaks. We can merge it this week and include in our upcoming release.

Shahmir Siddiqui added 2 commits October 10, 2025 15:13

Replaced GPL dependencies with permissive alternatives.

8fb1f33

Ran Pre-Commit Hooks

4e94c0d

romanlutz reviewed Oct 10, 2025

View reviewed changes

Shahmir Siddiqui added 5 commits October 10, 2025 17:08

Removed Unnecessary Encoding Declaration

a6335b2

Merge branch 'main' of https://github.com/Azure/PyRIT into feat/repla…

cd97d9e

…ce_gpl_libraries

Hardcoded list of country names to avoid external dependency

55bb556

Merge branch 'main' of https://github.com/Azure/PyRIT into feat/repla…

e0cd883

…ce_gpl_libraries

Use blocking input() for manual prompt; remove questionary

10790d7

rlundeen2 assigned romanlutz Oct 14, 2025

jsong468 and others added 4 commits October 14, 2025 17:43

[BREAKING] FEAT: Enable Entra ID Authentication across the codebase (A…

855d72a

…zure#1124)

MAINT: Cache Azure ML/Foundry token in integration test (Azure#1132)

313b8f6

Replace external krippendorff with internal implementation

d32b2ed

Updated pyproject.toml, typing/flake8 fixes

a41231a

Merge branch 'main' into feat/replace_gpl_libraries

2485e9a

romanlutz requested changes Oct 15, 2025

View reviewed changes

Shahmir Siddiqui added 5 commits October 15, 2025 12:03

Remove fpdf from unit test; Add reportlab

b206daf

Merge branch 'main' of https://github.com/Azure/PyRIT into feat/repla…

82bb0f9

…ce_gpl_libraries

Merge branch 'feat/replace_gpl_libraries' of https://github.com/0xFir…

926dd2a

…estorm/PyRIT into feat/replace_gpl_libraries

Refactored Krippendorff's alpha implementation according to pyrits scope

04b629c

Merge branch 'main' of https://github.com/Azure/PyRIT into feat/repla…

386afdb

…ce_gpl_libraries

romanlutz reviewed Oct 21, 2025

View reviewed changes

		prompt = "Please trigger the processing target's execution and paste the output here:"
		return await questionary.text(prompt).ask_async() # type: ignore

FEAT: Replaced GPL/LGPL licensed dependencies with permissive alternate dependencies #1125

Are you sure you want to change the base?

FEAT: Replaced GPL/LGPL licensed dependencies with permissive alternate dependencies #1125

Uh oh!

Conversation

0xFirestorm commented Oct 10, 2025

Description

Tests and Documentation

Uh oh!

romanlutz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

0xFirestorm commented Oct 13, 2025

Uh oh!

0xFirestorm commented Oct 15, 2025

Uh oh!

romanlutz commented Oct 15, 2025

Uh oh!

romanlutz left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

romanlutz left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants