mdebray/tvl-depot
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(tools): add rust-crates-advisory

Browse source 
We have a bunch of crates in `third_party/rust-crates`; it would be
great if we could check them for existing CVEs.

This tool does that, it takes the rust security advisory database,
parses the applicable CVEs, and cross-checks them against the actual
crate versions we list in our package database.

The dumb parser we wrote is tested against all entries in the
database, so we will notice when upstream breaks their shit.
Checking the semver stuff is easy enough with the semver crate.

If an advisory matches, it prints the whole thing and fails the build.

Change-Id: I9e912c43d37a685d9d7a4424defc467a171ea3c4
Reviewed-on: https://cl.tvl.fyi/c/depot/+/2818
Tested-by: BuildkiteCI
Reviewed-by: tazjin <mail@tazj.in>
Reviewed-by: sterni <sternenseemann@systemli.org>
This commit is contained in:
Profpatsch 2021-04-04 04:04:20 +02:00
parent 72924facae
commit 952afb7da9
8 changed files with 208 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

4
users/Profpatsch/blog/default.nix
View file

@ -81,7 +81,7 @@ let
me.netencode.record-splice-env
runOr return500
"importas" "-i" "path" "path"
"if" [ me.lib.eprintf "GET \${path}\n" ]
"if" [ depot.tools.eprintf "GET \${path}\n" ]
runOr return404
"backtick" "-ni" "TEMPLATE_DATA" [
"ifelse" [ bins.test "$path" "=" "/notes" ]
@ -118,7 +118,7 @@ let
"importas" "?" "?"
"ifelse" [ bins.test "$?" "-eq" "0" ]
[]
"if" [ me.lib.eprintf "runOr: exited \${?}, running \${1}\n" ]
"if" [ depot.tools.eprintf "runOr: exited \${?}, running \${1}\n" ]
"$1"
];