Class: Homebrew::Cmd::Vulns Private

Inherits:
AbstractCommand show all
Defined in:
cmd/vulns.rb,
sorbet/rbi/dsl/homebrew/cmd/vulns.rbi

This class is part of a private API. This class may only be used in the Homebrew/brew repository. Third parties should avoid using this class if possible, as it may be removed or changed without warning.

Defined Under Namespace

Classes: Args

Constant Summary collapse

FIX_TYPES =

This constant is part of a private API. This constant may only be used in the Homebrew/brew repository. Third parties should avoid using this constant if possible, as it may be removed or changed without warning. 

%w[released patch any none unreleased].freeze

Instance Method Summary collapse

Methods inherited from AbstractCommand

command, command_name, dev_cmd?, #initialize, parser, ruby_cmd?

Methods included from Utils::Output::Mixin

#issue_reporting_message, #odebug, #odeprecated, #odie, #odisabled, #ofail, #oh1, #oh1_title, #ohai, #ohai_title, #onoe, #opoo, #opoo_once, #opoo_outside_github_actions, #opoo_without_github_actions_annotation, #pretty_cannot_install, #pretty_deprecated, #pretty_disabled, #pretty_duration, #pretty_install_status, #pretty_installed, #pretty_uninstalled, #pretty_unmarked, #pretty_upgradable, #pretty_warning

Constructor Details

This class inherits a constructor from Homebrew::AbstractCommand

Instance Method Details

#args ⇒ Homebrew::Cmd::Vulns::Args

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



10
 
# File 'sorbet/rbi/dsl/homebrew/cmd/vulns.rbi', line 10

def args; end

#brewfile_path(value) ⇒ String?

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

A bare --brewfile (no =path) yields true from OptionParser at runtime; the generated RBI types it as T.nilable(String), so accept the wider type here and normalise true/"" to the nil default.

Parameters:

Returns:



139
140
141
 
# File 'cmd/vulns.rb', line 139

def brewfile_path(value)
  value.presence if value.is_a?(String)
end

#fix_type ⇒ Symbol?

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



159
160
161
162
163
164
165
166
167
168
169
170
 
# File 'cmd/vulns.rb', line 159

def fix_type
  if args.fix_available?
    :released
  elsif args.no_fix_available?
    :unreleased
  elsif (raw = args.fix_type)
    raw = raw.downcase
    raise UsageError, "`--fix-type` must be one of: #{FIX_TYPES.join(", ")}" unless FIX_TYPES.include?(raw)

    raw.to_sym
  end
end

#formulae ⇒ Array<Formula>

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



102
103
104
105
106
107
108
109
110
111
112
113
114
 
# File 'cmd/vulns.rb', line 102

def formulae
  list = T.let([], T::Array[Formula])
  if (brewfile = args.brewfile)
    require "bundle/brewfile"
    list += Homebrew::Bundle::Brewfile.read(file: brewfile_path(brewfile)).entries
                                      .select { |e| e.type == :brew }
                                      .map { |e| Formulary.resolve(e.name) }
  end
  list += args.named.to_resolved_formulae if args.named.any?
  list = installed_formulae if !args.brewfile && args.no_named?
  list += list.flat_map { |f| f.recursive_dependencies.map(&:to_formula) } if args.deps?
  list.uniq(&:full_name)
end

#installed_formulae ⇒ Array<Formula>

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



117
118
119
120
121
122
123
124
125
126
127
128
 
# File 'cmd/vulns.rb', line 117

def installed_formulae
  Formula.racks.filter_map do |rack|
    Formulary.from_rack(rack)
  rescue Homebrew::UntrustedTapError => e
    untrusted_skipped << e.message.lines.first.to_s.strip
    unscanned_formulae[rack.basename.to_s] = "untrusted_tap"
    nil
  rescue
    unscanned_formulae[rack.basename.to_s] = "resolution_error"
    nil
  end.uniq(&:name)
end

#max_summary ⇒ Integer

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:

Raises:



149
150
151
152
153
154
155
156
 
# File 'cmd/vulns.rb', line 149

def max_summary
  raw = args.max_summary
  return Homebrew::Vulns::Output::DEFAULT_MAX_SUMMARY if raw.nil?

  raise UsageError, "`--max-summary` must be a non-negative integer" unless raw.match?(/\A\d+\z/)

  raw.to_i
end

#run ⇒ void

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

This method returns an undefined value.



52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
 
# File 'cmd/vulns.rb', line 52

def run
  require "vulns"

  summary_width = max_summary
  severity = Homebrew::Vulns.min_severity(args.severity)

  results = Homebrew::Vulns::Scanner.new(
    formulae,
    ignore_patches: !args.no_ignore_patches?,
    min_severity:   severity,
    fix_type:,
  ).scan

  if args.json?
    Homebrew::Vulns::Output.json(results, unscanned_formulae:)
  else
    Homebrew::Vulns::Output.text(
      results,
      max_summary:  summary_width,
      list_skipped: args.list_skipped?,
    )
  end

  if untrusted_skipped.any?
    kegs = Utils.pluralize("installed keg", untrusted_skipped.size, include_count: true)
    opoo <<~EOS
      #{kegs} from an untrusted tap not scanned:
        #{untrusted_skipped.join("\n  ")}
      Run `brew trust` on the formula or tap to include it in future scans.
    EOS
    Homebrew.failed = true
  end
  if results.outdated_without_sbom.any?
    opoo <<~EOS
      The installed source of #{results.outdated_without_sbom.sort.join(", ")} could not be determined
      (older than the current formula and no SBOM was written at install time). Results above reflect
      the current formula version, not what is installed. Run `brew upgrade` for accurate results.
    EOS
    Homebrew.failed = true
  end
  if unscanned_formulae.value?("resolution_error")
    ofail <<~EOS
      Some installed formulae could not be resolved.
      Reconcile scan coverage with `brew info --installed`.
    EOS
  end
  Homebrew.failed = true if results.any_open?
end

#unscanned_formulae ⇒ Hash{String => String}

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



144
145
146
 
# File 'cmd/vulns.rb', line 144

def unscanned_formulae
  @unscanned_formulae ||= T.let({}, T.nilable(T::Hash[String, String]))
end

#untrusted_skipped ⇒ Array<String>

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



131
132
133
 
# File 'cmd/vulns.rb', line 131

def untrusted_skipped
  @untrusted_skipped ||= T.let([], T.nilable(T::Array[String]))
end