Class: Homebrew::DevCmd::AdvisoryMatch Private

Inherits:
AbstractCommand show all
Defined in:
dev-cmd/advisory-match.rb,
sorbet/rbi/dsl/homebrew/dev_cmd/advisory_match.rbi

This class is part of a private API. This class may only be used in the Homebrew/brew repository. Third parties should avoid using this class if possible, as it may be removed or changed without warning.

Defined Under Namespace

Classes: Args, CountEmitter, DirEmitter, Emitter, JsonEmitter

Instance Method Summary collapse

Methods inherited from AbstractCommand

command, command_name, dev_cmd?, #initialize, parser, ruby_cmd?

Methods included from Utils::Output::Mixin

#issue_reporting_message, #odebug, #odeprecated, #odie, #odisabled, #ofail, #oh1, #oh1_title, #ohai, #ohai_title, #onoe, #opoo, #opoo_outside_github_actions, #opoo_without_github_actions_annotation, #pretty_deprecated, #pretty_disabled, #pretty_duration, #pretty_install_status, #pretty_installed, #pretty_uninstalled, #pretty_unmarked, #pretty_upgradable, #pretty_warning

Constructor Details

This class inherits a constructor from Homebrew::AbstractCommand

Instance Method Details

#args ⇒ Homebrew::DevCmd::AdvisoryMatch::Args

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



10
 
# File 'sorbet/rbi/dsl/homebrew/dev_cmd/advisory_match.rbi', line 10

def args; end

#build_emitter ⇒ Emitter

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



236
237
238
239
240
241
242
243
244
 
# File 'dev-cmd/advisory-match.rb', line 236

def build_emitter
  if (dir = args.output)
    DirEmitter.new(dir, verbose: args.verbose?)
  elsif args.json?
    JsonEmitter.new
  else
    CountEmitter.new
  end
end

#each_formula ⇒ T::Enumerator[Formula]

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:

Raises:



93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
 
# File 'dev-cmd/advisory-match.rb', line 93

def each_formula
  return args.named.to_resolved_formulae.each unless args.all?

  raise UsageError, "`--all` does not take named arguments" if args.named.any?

  tap = CoreTap.instance
  raise TapUnavailableError, tap.name unless tap.installed?

  Enumerator.new do |y|
    tap.formula_names.each do |name|
      y << Formulary.factory(name)
    rescue => e
      onoe "Error loading formula '#{name}': #{e}"
    end
  end
end

#emit_index(matcher) ⇒ void

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

This method returns an undefined value.

Parameters:

Raises:



247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
 
# File 'dev-cmd/advisory-match.rb', line 247

def emit_index(matcher)
  tap = CoreTap.instance
  raise TapUnavailableError, tap.name unless tap.installed?

  index = tap.formula_names.each_with_object({}) do |name, h|
    identity = matcher.identify(Formulary.factory(name))
    next unless identity.identifiable?

    h[name] = {
      git_repo:          identity.git_repo,
      git_tag:           identity.git_tag,
      primary_package:   identity.primary_package&.to_h,
      resource_packages: identity.resource_packages.transform_values(&:to_h),
      distro_packages:   identity.distro_packages,
    }.compact
  rescue => e
    onoe "Error loading formula '#{name}': #{e}"
  end
  puts JSON.pretty_generate(index)
end

#local_repology ⇒ Homebrew::Vulns::Repology?

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

A CI run that has just built the index locally (advisory-database's Ingest) reads it directly instead of fetching the published copy.

Returns:



86
87
88
89
90
 
# File 'dev-cmd/advisory-match.rb', line 86

def local_repology
  return unless (path = args.repology)

  Homebrew::Vulns::Repology.from_file(Pathname(path))
end

#report(matcher, formula, hits) ⇒ void

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

This method returns an undefined value.

Parameters:



119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
 
# File 'dev-cmd/advisory-match.rb', line 119

def report(matcher, formula, hits)
  ohai "#{formula.name} #{formula.pkg_version}"
  if hits.empty?
    puts "  No advisories matched."
    return
  end
  hits.sort_by { |h| [-h.vulnerability.severity_level, h.canonical_id] }.each do |hit|
    v = hit.vulnerability
    status, = matcher.range_status(hit)
    state = case status&.state
    when nil       then "uncomparable"
    when :affected then "AFFECTED#{", upstream fix #{status&.fixed_in}" if status&.fixed_in}"
    when :fixed    then "fixed (upstream #{status&.fixed_in || "?"})"
    else "not applicable"
    end
    summary = v.summary&.slice(0, 60)
    puts "  #{hit.canonical_id} [#{hit.strategy}, #{matcher.confidence_for(hit, status)}] " \
         "#{v.severity_display} #{state}" \
         "#{" (resource: #{hit.resource})" if hit.resource}" \
         "#{" — #{summary}" if summary}"
  end
end

#run ⇒ void

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

This method returns an undefined value.



48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
 
# File 'dev-cmd/advisory-match.rb', line 48

def run
  Formulary.enable_factory_cache!
  Homebrew.with_no_api_env do
    latest_macos = MacOSVersion.new((HOMEBREW_MACOS_NEWEST_UNSUPPORTED.to_i - 1).to_s).to_sym
    Homebrew::SimulateSystem.with(os: latest_macos, arch: :arm) do
      matcher = Homebrew::Vulns::Match.new(repology: local_repology, bulk: args.all? || args.index?)
      next emit_index(matcher) if args.index?

      emitter = build_emitter
      begin
        matcher.each_advisory_batch(each_formula) do |formula, hits|
          report(matcher, formula, hits) if text_mode?
          hits.each do |hit|
            # A `:not_applicable` hit (below every `introduced`) emitted
            # as `{introduced: 0}` with no `fixed` reads to OSV consumers
            # as currently affected; drop it instead.
            status, = matcher.range_status(hit)
            next if status&.state == :not_applicable

            first_fixed = matcher.first_fixed_version(formula, hit) unless args.no_history?
            next if first_fixed == :never_affected

            boundary = first_fixed if first_fixed.is_a?(String)
            emitter << matcher.to_brew_record(formula, hit, first_fixed: boundary)
          end
        end
      rescue Homebrew::Vulns::OSV::Error => e
        onoe "OSV query failed: #{e.message}"
        Homebrew.failed = true
      end
      emitter.finish
    end
  end
end

#text_mode? ⇒ Boolean

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:

  • (Boolean) 


111
112
113
 
# File 'dev-cmd/advisory-match.rb', line 111

def text_mode?
  !args.json? && args.output.nil?
end