Class: Homebrew::DevCmd::GenerateVulnsAdvisories Private

Inherits:
AbstractCommand show all
Defined in:
dev-cmd/generate-vulns-advisories.rb,
sorbet/rbi/dsl/homebrew/dev_cmd/generate_vulns_advisories.rbi

This class is part of a private API. This class may only be used in the Homebrew/brew repository. Third parties should avoid using this class if possible, as it may be removed or changed without warning.

Defined Under Namespace

Classes: Args

Instance Method Summary collapse

Methods inherited from AbstractCommand

command, command_name, dev_cmd?, #initialize, parser, ruby_cmd?

Methods included from Utils::Output::Mixin

#issue_reporting_message, #odebug, #odeprecated, #odie, #odisabled, #ofail, #oh1, #oh1_title, #ohai, #ohai_title, #onoe, #opoo, #opoo_outside_github_actions, #opoo_without_github_actions_annotation, #pretty_cannot_install, #pretty_deprecated, #pretty_disabled, #pretty_duration, #pretty_install_status, #pretty_installed, #pretty_uninstalled, #pretty_unmarked, #pretty_upgradable, #pretty_warning

Constructor Details

This class inherits a constructor from Homebrew::AbstractCommand

Instance Method Details

#all_variation_patches(formula) ⇒ Array<Hash{String => T.untyped}>

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Formula#serialized_patches reflects the currently simulated OS and architecture; a patch inside e.g. on_linux is invisible under SimulateSystem.with(os: :sequoia). Collect the union of the base patches array and every OS/arch variation from Formula#to_hash_with_variations so platform-gated resolves annotations are exported.

Parameters:

Returns:



76
77
78
79
80
81
 
# File 'dev-cmd/generate-vulns-advisories.rb', line 76

def all_variation_patches(formula)
  hash = formula.to_hash_with_variations
  base = hash.fetch("patches")
  variation_patches = hash.fetch("variations").values.filter_map { |v| v["patches"] }
  (base + variation_patches.flatten(1)).uniq
end

#args ⇒ Homebrew::DevCmd::GenerateVulnsAdvisories::Args

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



10
 
# File 'sorbet/rbi/dsl/homebrew/dev_cmd/generate_vulns_advisories.rbi', line 10

def args; end

#first_fixed_version(formula, vuln_id) ⇒ String, Symbol

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Walk homebrew-core git history (newest first) via Vulns::History and return the pkg_version at the oldest revision where vuln_id still appears in the formula's resolved patch ids: the version at which the fix first shipped. Untrusted history (a shallow clone, no git history or a revision that fails to load) returns :history_unavailable so the caller skips the record rather than inventing a boundary. Only invoked for records with no existing file, so the cost is bounded to newly annotated (formula, CVE) pairs.

Because resolved_ids includes CVEs inferred from patch URLs and apply file paths, this finds the true fix version when the CVE is named there. When a resolves line was added to a patch that had already shipped without a CVE reference, it finds when resolves was added (too recent); those cases are hand-corrected in the advisory repository, which Vulns::OsvExport.run then preserves.

Historical revisions are loaded under the enclosing SimulateSystem (latest macOS/ARM) only; a resolves that lives inside e.g. on_linux is invisible here and falls through to the current pkg_version. FormulaVersions caches by revision alone, so per-variation historical loading would need separate instances; deferred until a variation-only security annotation actually exists in core.

Parameters:

Returns:



106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
 
# File 'dev-cmd/generate-vulns-advisories.rb', line 106

def first_fixed_version(formula, vuln_id)
  # The path-filtered `git rev-list` over the whole homebrew-core history
  # dominates runtime; {Homebrew::Vulns::History} caches it per formula
  # so subsequent CVEs for the same formula reuse it.
  @history ||= T.let(Homebrew::Vulns::History.new, T.nilable(Homebrew::Vulns::History))

  last_fixed = T.let(formula.pkg_version.to_s, String)
  result = @history.walk(formula) do |old|
    next last_fixed unless Homebrew::Vulns::Scanner.resolved_ids(old.serialized_patches).include?(vuln_id)

    last_fixed = old.pkg_version.to_s
    nil
  end
  if result == :history_unavailable
    record_id = Homebrew::Vulns::OsvExport.record_id(formula, vuln_id)
    opoo "#{record_id}: formula history is unavailable; skipping automatic generation"
    return :history_unavailable
  end

  # An exhausted walk means every revision resolved the CVE.
  result || last_fixed
end

#run ⇒ void

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

This method returns an undefined value.

Raises:



30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
 
# File 'dev-cmd/generate-vulns-advisories.rb', line 30

def run
  tap = CoreTap.instance
  raise TapUnavailableError, tap.name unless tap.installed?

  dir = args.named.fetch(0)

  Formulary.enable_factory_cache!
  Homebrew::API.with_no_api_env do
    latest_macos = MacOSVersion.new((HOMEBREW_MACOS_NEWEST_UNSUPPORTED.to_i - 1).to_s).to_sym
    Homebrew::SimulateSystem.with(os: latest_macos, arch: :arm) do
      annotated = tap.formula_names.filter_map do |name|
        formula = Formulary.factory(name)
        patches = all_variation_patches(formula)
        [formula, patches] if Homebrew::Vulns::Scanner.resolved_ids(patches).any?
      rescue
        onoe "Error loading formula '#{name}'."
        raise
      end
      ohai "#{annotated.size} formulae with security `resolves` annotations"

      if args.dry_run?
        annotated.each do |formula, patches|
          Homebrew::Vulns::Scanner.resolved_ids(patches).each do |vuln_id|
            puts "#{Homebrew::Vulns::OsvExport::ID_PREFIX}-#{formula.name}-#{vuln_id}"
          end
        end
        next
      end

      written = Homebrew::Vulns::OsvExport.run(
        annotated, dir,
        first_fixed: ->(formula, vuln_id) { first_fixed_version(formula, vuln_id) }
      )
      written.each { |p| puts "  wrote #{p}" } if args.verbose?
      ohai "#{written.size} records written to #{dir}"
    end
  end
end