maurice/snix
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore: move format-audit-result.jq out of //users/sterni

Browse source 
In the spirit of the readTree filter we should also not include files in
user directories from the outside.

Change-Id: I1abe36a721048900d2758b5986063b68b8d1af93
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5200
Reviewed-by: sterni <sternenseemann@systemli.org>
Reviewed-by: tazjin <tazjin@tvl.su>
Autosubmit: sterni <sternenseemann@systemli.org>
Tested-by: BuildkiteCI
This commit is contained in:
sterni 2022-02-03 14:44:03 +01:00 • committed by clbot
parent c3684740ad
commit 5d06425655
4 changed files with 15 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
users/sterni/nixpkgs-crate-holes/default.nix
View file

@ -147,7 +147,7 @@ let
bins.jq
"-rj"
"-f"
./format-audit-result.jq
../../../tools/rust-crates-advisory/format-audit-result.jq
"--arg"
"attr"
strAttr

61
users/sterni/nixpkgs-crate-holes/format-audit-result.jq
View file

@ -1,61 +0,0 @@
# Link to human-readable advisory info for a given vulnerability
def link:
[ "https://rustsec.org/advisories/", .advisory.id, ".html" ] | add;
# Format a list of version constraints
def version_list:
[ .[] | "`" + . + "`" ] | join("; ");
# show paths to fixing this vulnerability:
#
# - if there are patched releases, show them (the version we are using presumably
# predates the vulnerability discovery, so we likely want to upgrade to a
# patched release).
# - if there are no patched releases, show the unaffected versions (in case we
# want to downgrade).
# - otherwise we state that no unaffected versions are available at this time.
#
# This logic should be useful, but is slightly dumber than cargo-audit's
# suggestion when using the non-JSON output.
def patched:
if .versions.patched == [] then
if .versions.unaffected != [] then
"unaffected: " + (.versions.unaffected | version_list)
else
"no unaffected version available"
end
else
"patched: " + (.versions.patched | version_list)
end;
# if the vulnerability has aliases (like CVE-*) emit them in parens
def aliases:
if .advisory.aliases == [] then
""
else
[ " (", (.advisory.aliases | join(", ")), ")" ] | add
end;
# each vulnerability is rendered as a (normal) sublist item
def format_vulnerability:
[ " - "
, .package.name, " ", .package.version, ": "
, "[", .advisory.id, "](", link, ")"
, aliases
, ", ", patched
, "\n"
] | add;
# be quiet if no found vulnerabilities, otherwise render a GHFM checklist item
if .vulnerabilities.found | not then
""
else
([ "- [ ] "
, "`", $attr, "`: "
, (.vulnerabilities.count | tostring)
, " vulnerabilities in Cargo.lock"
, if $maintainers != "" then " (cc " + $maintainers + ")" else "" end
, "\n"
] + (.vulnerabilities.list | map(format_vulnerability))
) | add
end