Class: Homebrew::DevCmd::GenerateVulnsAdvisories Private

Inherits:
AbstractCommand show all
Defined in:
dev-cmd/generate-vulns-advisories.rb,
sorbet/rbi/dsl/homebrew/dev_cmd/generate_vulns_advisories.rbi

This class is part of a private API. This class may only be used in the Homebrew/brew repository. Third parties should avoid using this class if possible, as it may be removed or changed without warning.

Defined Under Namespace

Classes: Args

Instance Method Summary collapse

Methods inherited from AbstractCommand

command, command_name, dev_cmd?, #initialize, parser, ruby_cmd?

Methods included from Utils::Output::Mixin

#issue_reporting_message, #odebug, #odeprecated, #odie, #odisabled, #ofail, #oh1, #oh1_title, #ohai, #ohai_title, #onoe, #opoo, #opoo_outside_github_actions, #opoo_without_github_actions_annotation, #pretty_deprecated, #pretty_disabled, #pretty_duration, #pretty_install_status, #pretty_installed, #pretty_uninstalled, #pretty_unmarked, #pretty_upgradable, #pretty_warning

Constructor Details

This class inherits a constructor from Homebrew::AbstractCommand

Instance Method Details

#all_variation_patches(formula) ⇒ Array<Hash{String => T.untyped}>

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Formula#serialized_patches reflects the currently simulated OS and architecture; a patch inside e.g. on_linux is invisible under SimulateSystem.with(os: :sequoia). Collect the union of the base patches array and every OS/arch variation from Formula#to_hash_with_variations so platform-gated resolves annotations are exported.

Parameters:

Returns:



71
72
73
74
75
76
 
# File 'dev-cmd/generate-vulns-advisories.rb', line 71

def all_variation_patches(formula)
  hash = formula.to_hash_with_variations
  base = hash.fetch("patches")
  variation_patches = hash.fetch("variations").values.filter_map { |v| v["patches"] }
  (base + variation_patches.flatten(1)).uniq
end

#args ⇒ Homebrew::DevCmd::GenerateVulnsAdvisories::Args

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



10
 
# File 'sorbet/rbi/dsl/homebrew/dev_cmd/generate_vulns_advisories.rbi', line 10

def args; end

#run ⇒ void

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

This method returns an undefined value.

Raises:



28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
 
# File 'dev-cmd/generate-vulns-advisories.rb', line 28

def run
  tap = CoreTap.instance
  raise TapUnavailableError, tap.name unless tap.installed?

  dir = args.named.first

  Formulary.enable_factory_cache!
  annotated = Homebrew.with_no_api_env do
    latest_macos = MacOSVersion.new((HOMEBREW_MACOS_NEWEST_UNSUPPORTED.to_i - 1).to_s).to_sym
    Homebrew::SimulateSystem.with(os: latest_macos, arch: :arm) do
      tap.formula_names.filter_map do |name|
        formula = Formulary.factory(name)
        patches = all_variation_patches(formula)
        [formula, patches] if Homebrew::Vulns::Scanner.resolved_ids(patches).any?
      rescue
        onoe "Error loading formula '#{name}'."
        raise
      end
    end
  end
  ohai "#{annotated.size} formulae with security `resolves` annotations"

  if args.dry_run?
    annotated.each do |formula, patches|
      Homebrew::Vulns::Scanner.resolved_ids(patches).each do |vuln_id|
        puts "#{Homebrew::Vulns::OsvExport::ID_PREFIX}-#{formula.name}-#{vuln_id}"
      end
    end
    return
  end

  written = Homebrew::Vulns::OsvExport.run(annotated, T.must(dir))
  written.each { |p| puts "  wrote #{p}" } if args.verbose?
  ohai "#{written.size} records written to #{dir}"
end