refactor(rust-crates-advisory): redo tree-lock-file-report in bash

I think migrating the execline scripts over to bash makes sense:

1. Ever since nixpkgs-fmt, execline scripts in depot have become a huge
   pain to write and edit and I can't think of a satisfying solution to
   this problem.

2. The scripts here require remembering things across loop cycles (i. e.
   the status variable) which is not possible in pure execline. As a a
   workaround we used to read the entire report into memory first and
   check if it was empty (tying us to the argv limit for the report
   length).

Change-Id: I954b08b982ef947f9014a685676d2b83a2aec4d2
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5259
Reviewed-by: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI
This commit is contained in:
sterni 2022-02-06 12:56:58 +01:00
parent 8ffcf8d7ce
commit ffec3c70f4

View file

@ -4,7 +4,6 @@ let
bins =
depot.nix.getBins pkgs.s6-portable-utils [ "s6-ln" "s6-cat" "s6-echo" "s6-mkdir" "s6-test" "s6-touch" "s6-dirname" ]
// depot.nix.getBins pkgs.coreutils [ "printf" ]
// depot.nix.getBins pkgs.lr [ "lr" ]
// depot.nix.getBins pkgs.cargo-audit [ "cargo-audit" ]
// depot.nix.getBins pkgs.jq [ "jq" ]
@ -106,41 +105,20 @@ let
exit "''${PIPESTATUS[0]}" # inherit exit code from cargo-audit
'';
tree-lock-file-report = depot.nix.writeExecline "tree-lock-file-report"
{
readNArgs = 1;
} [
"backtick"
"-E"
"report"
[
"pipeline"
[ bins.find "$1" "-name" "Cargo.lock" "-and" "-type" "f" "-print0" ]
"forstdin"
"-E"
"-0"
"lockFile"
"backtick"
"-E"
"depotPath"
[
"pipeline"
[ bins.s6-dirname "$lockFile" ]
bins.sed
"s|^\\.|/|"
]
lock-file-report
"$depotPath"
"$lockFile"
"false"
]
"if"
[ bins.printf "%s\n" "$report" ]
# empty report implies success (no advisories)
bins.s6-test
"-z"
"$report"
];
tree-lock-file-report = pkgs.writers.writeBash "tree-lock-file-report" ''
set -euo pipefail
status=0
root="''${1:-.}"
# Find prints the found lockfiles as <DEPOT ROOT>\t<LOCKFILE DIR>\t<LOCKFILE PATH>\0
while IFS=$'\t' read -r -d $'\0' entryPoint dir lockFile; do
label="$(printf '%s' "$dir" | "${bins.sed}" "s|^$entryPoint|/|")"
"${lock-file-report}" "$label" "$lockFile" || status=1
done < <("${bins.find}" "$root" -type f -name Cargo.lock -printf '%H\t%h\t%p\0' )
exit $status
'';
check-all-our-lock-files = depot.nix.writeExecline "check-all-our-lock-files" { } [
"backtick"